Symantec Access Management

I'm working on setting up siteMinder (Single Signon) with web agents. After running for a few days, the web agent will stop working and the error_log files says the following. And then I had to restart apache (webagent) for it to work again. We have cronjobs restarting apache everyday now to avoid this issue.

      [03/Jul/2016:10:06:05] [Information] SiteMinder Agent
        Server already running.
        Duplicate LLAWP processes not allowed, exiting.

Did anyone have similar issues? How can it be resolved? This is the version of webagent we're running.

SiteMinder APACHE 2.2 WebAgent, Version 12.52 QMR01, Update HF-01, Label 640.

This is most likely a known defect fixed in 12.52 SP1 CR2.

If feasible, I would suggest upgrading to the latest CR and see if it resolves the issue.

If not, please raise CA support ticket for RCA and possible dev fix.

I upgraded one of the web servers to the latest release (i believe) as follows, but the same issue persists.

[5611/2438792960][Sun Jul 10 2016 09:41:27] SiteMinder APACHE 2.2 WebAgent, Version 12.52 QMR01, Update HF-04, Label 2032.  [5611/2438792960][Sun Jul 10 2016 09:41:27] FileVersion: 12.52.0104.2032.

The latest release is CR5. Do you mind testing with it please?

What OS is this?

CentOS

# uname -r

2.6.32-573.18.1.el6.x86_64

Where can i get CR5?

You can download CR5 from here : https://support.ca.com/irj/portal/anonymous/SolutionResults?aparNo=RS89894&actionID=4

i see only a windows package there. We're running centos 6.

Also when i search on the download center, i don't see any SSO WebAgent. When click on the Windows package from your link, it says i don't have an active license for the product.

You will need to be logged in with your support.ca.com credential which is associated with your company ID to be able to download.

I do see all binary for all the platforms :

https://support.ca.com/irj/portal/solndtls?aparNo=RS89894&os=WINDOWS&actionID=3

Hi Ujwol,

Is CentOS now supported for CA Single Sign On components ?

Thanks,

Ankush

Hi Ankush,

Yes, CentOS is supported for agent component, via Linux-variant support statement in PSM.

Linux Reasonable Commercial Effort Statement:

This Support Statement applies to CA SiteMinder that offers documented support for one or more Linux Reference Platforms. CA strives to meet our clients’ diverse and ever changing needs. CA products support and manage many of today's leading platforms, operating systems and applications across the IT enterprise. A Linux Reference Platform is a specific version of a particular Linux variant, such as Red Hat Enterprise Server 5/6, which is used in CA development, QA, and Support, and is documented as a supported environment in which to run CA SiteMinder. To verify the Linux Reference Platforms supported for CA SiteMinder, review the system requirements section of the respective product documentation, or check with CA Support. Many of our clients use variants of the Linux operating system as their production operating system platform, for example Oracle Enterprise Linux, SUSE, etc. Some of those Linux variants claim compatibility (compatibility modes) with CA SiteMinder supported Linux Reference Platforms.

Note: CA does not test every possible configuration of CA SiteMinder running on the many Compatible Linux Variants available and cannot certify specific client configurations.

To facilitate a quick resolution and isolate the root cause of any potential product issue encountered running on Compatible Linux Variants, CA is establishing the following support protocol for CA SiteMinder operated in these environments:

 The current GA version of a Linux Reference Platform and the prior major version of that environment are supported. Any exceptions will be noted in respective product documentation.

 The client is responsible for properly configuring their Linux Variant to be compatible with a Linux Reference Platform supported by CA SiteMinder.

 The client is responsible for having an active maintenance agreement for both their CA SiteMinder and for the Compatible Linux variant.

 While CA does not require that clients recreate each issue on a Linux Reference Platform before contacting support, we can request that the client diagnose and troubleshoot specific issues without the Linux Variant "variable" through reproducing the issue on the Linux Reference Platform. CA will only do this when we have reason to believe the issue is directly related to the Compatible Linux Variant environment.



While functional problems are rare under Compatible Linux Variants, problems may occur related to the third-party components embedded in applications, and those embedded products’ support of Compatible Linux Variants may be limited or unavailable. Diagnosis and resolution of this class of problem may require the client to return to a Linux Reference Platform.

 Compatible Linux Variants are diverse; CA may require extra time to understand, collect data, troubleshoot and possibly reproduce reported issues.

 If CA Support cannot directly identify the root cause as a CA or a Compatible Linux Variant issue, client can open a support issue with their Compatible Linux Variant vendor and any other necessary third-party vendors to expedite the resolution of the issue. CA, the vendor(s), and the client will work together toward a quick resolution where there business relationship mechanism to do so. CA, Novell, and many other software vendors belong to the Technical Support Alliance Network (http://www.tsanet.org) that may be engaged by either CA or the Compatible Linux variant vendor if and when the need for a third-party arises as long as active maintenance exists for the CA and third party vendor’s product. Note if the customer does not have a Vendor support agreement for the Linux variant, there is no third party CA may work with.

 Any known issues with running CA SiteMinder on specific Compatible Linux Variants will be noted in the respective product documentation.

Thanks Ujwol for the information !!

Regards,

Ankush

Ujwol, cent is  only supported if the issue is logged as a ticket and reproduced in Red Hat, as are a number of other Linux variants.

worse, unless it changed since i was in support, there are actually known differences in CENT from Red Hat that cause issues. or so engineering told me one day when we could not repro something and sent up an RFI to hopefully get more from the client. simply put Engineering codes to Red Hat and Cent has known issues.

Hi ,

How many webserver instances / webagent / LLAWP Process  are running on this server ?

Since this is linux platform , you can try to clear semaphores holded by webserver & webagent process on the server and see if that helps.

Thanks,

Ankush

Since we're restarting apache daily now, we don't run into this issue often. But i can try removing the semaphores held by apache when it comes up again. What's the reasoning behind removing the semaphores. How does it help and will it have other side-effects? We're trying to avoid the situation where users cannot access the web services. If it happens, restarting apache is actually faster than cleaning up the semaphores, assuming it works.

Removing Semaphores helps if process doesn't gets cleared post restart. More details wrt semaphore gets logged in error_log of apache. Other solution you try are :--

1) an OS restart.

2) Changing ServerPath in webagent.conf ( ensure that is unique to a given apache instance )