IBM BPM Advanced 8.5.5 - Where's the Failed Event Manager ?

Clue, it's in the Deployment Environment

Easy when you know how :-)

Aide Memoire - F5 - Configuration Guide for BIG-IP Local Traffic Management

It's here: -

Configuration Guide for BIG-IP Local Traffic Management

Configuration Guide for BIG-IP Local Traffic Management [PDF]

<snip>

The BIG-IP® local traffic management system is specifically designed to manage your local network traffic. Local traffic management refers to the process of managing network traffic that comes into or goes out of a local area network (LAN), including an intranet.

This configuration guide applies to the set of local traffic management products that are part of the BIG-IP system family of products.

A commonly-used feature of the BIG-IP system is its ability to intercept and redirect incoming network traffic, for the purpose of intelligently tuning the load on network servers. However, tuning server load is not the only type of local traffic management. The BIG-IP system includes a variety of features that perform functions such as inspecting and transforming header and content data, managing SSL certificate-based authentication, and compressing HTTP responses. In so doing, the BIG-IP system not only directs traffic to the appropriate server resource, but also enhances network security and frees up server resources by performing tasks that web servers typically perform.

</snip>

VMware Fusion - Stuck on "GRUB loading stage2"

I had this error: -

GRUB loading stage2

whilst attempting to boot a F5 BIG-IP Virtual Edition VM

No matter how many times I rebooted, the error kept popping up :-(

I'm using VMware Fusion 8.1.1 on OS X 10.11.6.

This thread: -

Running BIGIP-11.3.0.39 on Oracle VirtualBox under Mac OS 10.9.2

helped, specifically this: -

Did you enable COM port? What Hypervisor version do you have?

Yes, enabling COM Port helped. Thanks

Once I added a virtual Serial Port: -

it just worked :-)

MQJCA1011 and the story of the missing IBM MQ JMS Provider permissions

We saw this problem earlier this week: -

Failed to load the WebSphere MQ native JNI library: 'mqjbnd'.

The JVM attempted to load the platform native library 'mqjbnd', which was mapped to the filename: 'libmqjbnd.a'.

When attempting to load the library, the JVM reported the error message:

'mqjbnd (Not found in java.library.path)'

in the context of a failing WebSphere Application Server (WAS) to IBM MQ (MQ) configuration.

We found this, whilst trying to debug this: -

com.ibm.mq.connector.DetailedResourceAdapterInternalException: MQJCA1011: Failed to allocate a JMS connection. An internal error caused an attempt to allocate a connection to fail. See the linked exception for details of the failure.

We're using JMS Activation Specifications, JMS Queues and, most importantly, a JMS MQ Provider.

This latter has a native MQ library configured: -

ra=AdminConfig.getid("/Cell/"+cellID+"/ServerCluster/"+clusterName+"/ J2CResourceAdapter:WebSphere MQ Resource Adapter/")

AdminTask.manageWMQ(ra, '[-nativePath /opt/mqm/java/lib64/ - disableWMQ false ]')

AdminConfig.save()

AdminNodeManagement.syncActiveNodes()

When I checked, the user under which WAS runs, wasadmin, does NOT appear to have the permission to access the MQ native library path: -

/opt/mqm/java/lib64/

as per this example: -

whoami

wasadmin

ls -al /opt/mqm/java/lib64/

ls: 0653-345 /opt/mqm/java/lib64/.: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/..: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/bin: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/doc: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/http: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/jre64: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/lib: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/lib64: Permission denied.
ls: 0653-345 /opt/mqm/java/lib64/original.jre64.IT13492: Permission denied.
total 0

We compared / contrasted this against a working system, where wasadmin WAS able to access the Java path.

Thus it feels like the wasadmin user no longer has the permission to access the MQ native libraries, which are owned by mqm.

This may have changed as a result of a MQ patching / maintenance process.

Once the MQ administrator changed the permissions for the /opt/mqm/java directory to: -

dr-xr-xr-x

things started working again ….

Disable desktop notifications for a site

I was getting slightly cross ( hey, I'm British, what can I say? ) with Firefox 47's insistence on asking me whether I REALLY wanted notifications from a site, each and every time I opened or refreshed a page on that site.

This had the answer: -

Disable desktop notifications for a site

<snip>

You can reset this to the default (or outright disallow it) on a per-site basis by right-clicking somewhere in a blank spot of the site (or pressing Ctrl-I on Windows or Cmd-I on Mac) and then selecting "View Page Info" from the opening menu. This opens a window with a "Permissions" tab. I that, scroll down to the very bottom until you see "Show Notifications" as the third-to-last entry. Either reset that to the default, or just select "Block".

Additionally, the notifications are currently a labs feature in Google Music, so you can also disable them by going into the Google Music Labs preferences and disabling them.

</snip>

I changed it from Use Default to Block 

Job done :-)

IBM Integration Bus - The names, they are a-changin'

So I still struggle to remember that, with IBM Integration Bus 9, the naming conventions inherited from WebSphere Message Broker ( and it's precedents ) have CHANGED.

Here's a useful crib: -

Name changes in IBM Integration Bus Version 9.0

F5 BIG-IP Local Traffic Manager ( LTM ) - Scripting It, Baby

Following on from my earlier posts: -

F5 Load Balancing - My first few forays

F5 BIG-IP - More learning, more tinkering, more blogging

I've made yet more headway with this fascinating product.

I'd referenced this excellent post: -

Deploying F5 BIG-IP Virtual Edition on VMware Fusion

which, in part, included the necessary F5 commands, using the tmsh utility, to set up a pair of network interfaces, some IP addresses and a default route: -

<snip>

tmsh create net vlan external interfaces add { 1.1 { untagged } }

tmsh create net vlan internal interfaces add { 1.2 { untagged } }

tmsh create net self 10.128.10.240 address 10.128.10.240/24 vlan external

tmsh create net self 10.128.20.240 address 10.128.20.240/24 vlan internal

tmsh create net route Default_Gateway network 0.0.0.0/0 gw 10.128.10.2

tmsh save sys config

</snip>

However, I wanted to go further - I wanted to script the configuration of the necessary components: -

HTTPS Health Monitor

Node

Virtual Server

to allow the F5 to do its job of (a) monitoring a downstream instance of IBM HTTP Server and (b) allow me to have IHS listening on port 8443 whilst the F5 receives traffic on port 443.

This is my IHS configuration, for the record: -

/opt/IBM/HTTPServer/bin/apachectl -DDUMP_SSL_CONFIG -f /opt/IBM/HTTPServer/conf/httpd.conf

SSL configuration:
Default server
Server name: bpm856.uk.ibm.com:8080
SSL enabled: NO

SSL server defined at: /opt/IBM/HTTPServer/conf/httpd.conf:852
Server name: bpm856.uk.ibm.com:8443
SSL enabled: YES
FIPS enabled: 0
Keyfile: /opt/IBM/HTTPServer/ssl/keystore.kdb
Protocols enabled: TLSv10,TLSv11,TLSv12
Ciphers for SSLV2: (protocol disabled)
Ciphers for SSLV3: (protocol disabled)
Ciphers for TLSv10: (defaults) TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
Ciphers for TLSv11: (defaults) TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
Ciphers for TLSv12: (defaults) TLS_RSA_WITH_AES_128_GCM_SHA256(9C),TLS_RSA_WITH_AES_256_GCM_SHA384(9D),TLS_RSA_WITH_AES_128_CBC_SHA256(3C),TLS_RSA_WITH_AES_256_CBC_SHA256(3D),TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)

Syntax OK

and this is what I did on the F5 LTM: -

Create a HTTPS Monitor

This is the component that monitors the downstream IHS, so needs to "know" the HTTPS ciphers being used and the port. Note that, in Unix-land, port 8443 is "known" as pcsync-https ( just check /etc/services ) which is an alias for port 8443.

The Monitor also needs to send a well-formed HTTP/1.1 request, and wait for a proper HTTP response code e.g. 200 OK.

tmsh create ltm monitor https davehttps { cipherlist DEFAULT:+SHA:+3DES:+kEDH compatibility enabled defaults-from https destination *:pcsync-https interval 5 recv 200 send "GET /index.html HTTP/1.1\\r\\nHost: bpm856.uk.ibm.com\\r\\nConnection: Close\\r\\n\\r\\n" time-until-up 0 timeout 16 }

Create a Node

The node ( we typically have more than one ) refers to the downstream IHS box, specifically in terms of it's IP address or hostname

tmsh create ltm node bpm856.uk.ibm.com { address 192.168.153.200 }

Create a Pool

This is where the Monitor and the Node are brought together

tmsh create ltm pool bpm856.uk.ibm.com_ihs members add { bpm856.uk.ibm.com:pcsync-https { monitor davehttps }}

Create a Virtual Server

This represents the service that the LTM offers to the client, which is where the magic "mapping" between the IHS port of 8443 and the exposed port of 443 happens

tmsh create ltm virtual IHS destination 10.128.10.123:https ip-protocol tcp mask 255.255.255.255 pool bpm856.uk.ibm.com_ihs profiles add { clientssl { context clientside } http{} serverssl{context serverside } tcp{} } source 0.0.0.0/0 source-address-translation { type automap } vlans add { external internal } vlans-enabled 

Save the Configuration

I think this is implicit, but it never hurts to do it :-)

tmsh save sys config

Having run all of that, which takes about 5 seconds, I have a nice network map: -

an active pool: -

a working node: -

and a happy virtual server: -

More importantly, I can hit IHS directly: -

*AND* via the LTM: -

Note that, in the latter case, the connection is on port 443, which the browser automatically hides :-)

So I've still got some SSL certificate stuff to do, especially if I want to have the F5 use Mutual Authentication ( aka Client Authentication ) to the IHS box, but that's for another day ….

Update - 8 September 2016 - a smart F5 guru did advise me NOT to use the same IP address for BOTH the external interface AND the Virtual Server. Therefore, I've updated this post to show the external interface listen on 10.128.10.240 but the Virtual Server listen on 10.128.10.123, as per this example: -

https://10.128.10.123