Layer7 API Management

  • 1.  ssg log-entries without reference to affected policy

    Posted Aug 02, 2018 12:17 PM

    Hi all,

    we are currently seeing a huge amount of log-entries in our default ssg-log and it seems to be related to one or more SOAP-services. But we can't identify, which one in detail.

    The error message looks like this:

    2018-08-02T18:00:58.732+0200 INFO    1192 com.l7tech.xml.soap.SoapUtil: request's soapaction "http://soap-action-URL" did not match any operation in the wsdl. will try to match using the document instead

    Is there any chance to get further details or adjust the logging?

    Thank you!

     

    Ciao Stefan



  • 2.  Re: ssg log-entries without reference to affected policy

    Posted Aug 02, 2018 09:01 PM

    Hi Stefan,

     

    Earlier than that error, you should generally see a message something to the effect of "Processing request for <ServiceName>”, and it will likely share the thread number too. So in your example, you may see that with the same thread number of 1192. This should help point out which service was being called at the time of that error.

     

    Ultimately though, that error means that a request was made to the service which calls on an operation or action that the WSDL of the SOAP service does not declare, so the request is then dropped at that point.

     

    If you have customized your logging in any ways, you may need to report back with how you have it set up for the SSG log syslog and the log.levels cluster-wide property, as those may impact what shows up in your logs to help troubleshoot.



  • 3.  Re: ssg log-entries without reference to affected policy

    Posted Aug 03, 2018 06:38 AM

    Hi Dustin,

    thanks for your quick answer.

    But no, I don't see this other kind of message in our logs.

    Our CWP for log.levels is set to "com.l7tech.level = INFO" and the properties of the log sink are:

    - Severity Threshold: Info

    - Filter: Category=Gateway Log

    So do I need to add something to the filter? And if yes, which one? And how much more entries will this generate?
    Or should I create a dedicated log sink and filter it to the service in question? If I see then the same errors there, I have found it? And in case the log sink remains empty it's not the service in question?

    Thank you!

     

    Ciao Stefan



  • 4.  Re: ssg log-entries without reference to affected policy

    Posted Aug 03, 2018 07:32 AM

    Hi again,
    I could identify the affected service now via the service filter "workaround" in a dedicated log sink (with some luck I could find it within 10 minutes).
    But I still have a question to the reason of this error message. For this SOAP-Service we have enabled the Option "Allow requests intended for operations not supported by the WSDL". Will this still generate the above mentioned error message? And if yes, why? And can this be avoided? Or is the only solution to adjust the WSDL?

    Thank you!

     

    Ciao Stefan



  • 5.  Re: ssg log-entries without reference to affected policy

    Posted Aug 03, 2018 12:32 PM

    Hi Stefan,

     

    I'm happy to hear you were able to narrow it down far enough to find the affected service.

     

    In terms of that error you receive, here are my thoughts:

     

    • It's not an actual error (I think I missed this part earlier myself too), you'll notice it has the level of "INFO", so it's simply an informational message for your own records so that you know the request incoming didn't match any supported operations in the WSDL for that SOAP service. From there, it doesn't drop the request (which is what I mistakenly said earlier because I had forgot about the possibility of the override for this which you are using), it will simply continue onwards and as it says in the INFO dialogue – it tries to match it using the document instead. The whole request I believe should still succeed unless it gets caught elsewhere in policy. It would be type "WARNING" or "ERROR", I believe, if you hadn't used that override of "Allow requests intended for operations not supported by the WSDL".

     

    • I'd recommend keeping those entries just for completion sake, but if you are getting way too many of them or you do not find them useful at all, then absolutely you can look to hide them from being logged. However, this method would affect the Java class level rather than that very specific error message, so it may unintentionally hide more than you are wanting, so just keep this in mind. You can, for example, add "com.l7tech.xml.soap.SoapUtil.level = WARNING" to the log.levels cluster-wide property. At that point, it'll only log messages with "WARNING", "ERROR", or "SEVERE" that come from the com.l7tech.xml.soap.SoapUtil Java class.

     

    • On a side note though, I'd start to investigate why this service is receiving requests for operations that aren't supported, then evaluate if they should be supported (i.e. a bug in the WSDL file that should be supporting it but isn't written in a way that supports it), or if your requestor needs some additional training on how they generate their requests to your SOAP service. That, at least in my humble opinion, would be the more solid option rather than hiding log entries. But of course, you can still always do both too.


  • 6.  Re: ssg log-entries without reference to affected policy

    Posted Aug 06, 2018 04:01 AM

    Hi Dustin,

    thanks again for your answer.

    I added now "com.l7tech.xml.soap.SoapUtil.level = WARNING" to our log.levels CWP and the messages are gone now. But yes, I already asked the Service owner if there is maybe an updated WSDL.

    But is there any "trick" available like for the audit events, where we already using the following two CWPs:

    - audit.auditDetailExcludeList

    - audit.setDetailLevel.INFO

    To "hide" just a few specific ssg-logs? Or is this only possible for audit-logs?

     

    And back to the original question, where and how can I get your mentioned "Processing request for <ServiceName>” log entries? There are still other log entries in our ssg-log, but always only the PID is visible. What needs to be changed to get the required mapping between the PID and the <ServiceName>?

    Thank you!

     

    Ciao Stefan



  • 7.  Re: ssg log-entries without reference to affected policy

    Posted Aug 10, 2018 08:01 PM

    Hi Stefan,

     

    Glad to hear those pesky messages are gone for you. Audits and logs are treated a bit differently, and I'm not aware of a way to hide certain log entries the same way you would audits, because there aren't really any "codes” to them as there are in audits.

     

    In my Gateway 9.2.00, for some reason I cannot seem to get the "Processing request for <ServiceName>” item, but it's my lab Gateway for reproducing customer issues so of course it gets a bit too customized after a while and I need to reset it before it's valid. However, with that said, I did notice the following as my SSG logs were set to a severity of "ALL” when I began testing:

     

    2018-08-10T16:49:09.116-0700 FINE    25617 com.l7tech.server.SoapMessageProcessingServlet: HTTP request URI [/echo]

     

    The above is a FINE level request, so your SSG log sink would need to be customized to show at least FINE level or deeper to show that kind of log entry. So if you find yourself running into those kind of issues where you need to know which service it went to, you can temporarily make that change too so that you can then determine the service the requests were directed to.

     

    Can you please confirm what you mean by "PID”? I know there is a thread number before each log entry after the date and log level (such as "25617” from the example above), is that what you're referring to? If that's what you were referring to, that won't actually relate to a service but rather the thread itself, so there's no way to actually map that to a service name as they are not related.



  • 8.  Re: ssg log-entries without reference to affected policy

    Broadcom Employee
    Posted Aug 23, 2018 10:41 AM

    Hi,

    Did the answers on this thread answered your question? If it did please mark it as the right answer.
    When your question is not answered or you still have additional questions please let us know.

    With Kind Regards
    Dirk