Troubleshooting Guide

Transcription

1 Tioli Access Manager for e-business Version Troubleshooting Guide GC

2

3 Tioli Access Manager for e-business Version Troubleshooting Guide GC

4 Note Before using this information and the product it supports, read the information in Appendix E, Notices, on page 169. Edition notice This edition applies to ersion 6, release 1, modification 1 of IBM Tioli Access Manager (product number 5724-C87) and to all subsequent releases and modifications until otherwise indicated in new editions. All rights resered. Copyright IBM Corporation 2002, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this publication ii Intended audience ii Publications ii IBM Tioli Access Manager for e-business library ii Related products and publications ix Accessing terminology online x Accessing publications online x Ordering publications x Accessibility xi Tioli technical training xi Tioli user groups xi Support information xi Conentions used in this publication xii Typeface conentions xii Operating system-dependent ariables and paths xii Part 1. Introduction Chapter 1. Introduction to problem determination Aoiding potential problems Problem resolution Product short names Sericeability enhancements Chapter 2. Tioli Common Directory.. 5 Location of the Tioli Common Directory properties file Common directories used by Tioli Access Manager 5 Configuration setting used by Tioli Access Manager 6 Chapter 3. Messages Message types Message format Message identifiers Chapter 4. Tioli XML Log Viewer Installing the Tioli XML Log Viewer Running the Tioli XML Log Viewer Part 2. Deployment Chapter 5. Installation and initial configuration Log files Installation wizard log files Natie installation log files Natie configuration log files Installation wizard problems Tioli Directory Serer installation wizard problems Insufficient disk space for temporary files Cannot launch the installation wizard Installation wizard failed Remoing the ibmjcaproider.jar file Operating system problems Multiple network interfaces Initial configuration problems Inalid LDAP management domain location DN causes error Timing out during configuration Recoering an LDAP serer Upgrade common problems Cannot create users or groups after upgrade.. 22 Chapter 6. Verifying the deployment.. 23 System types in a deployment Base systems Web security systems Distributed session management systems Checking installed software Verifying Global Security Kit Verifying user registries Tioli Directory Serer Microsoft Actie Directory Lotus Domino Serer Verifying base systems Verifying the policy serer Verifying the authorization serer Verifying the runtime Verifying Web security systems Verifying WebSEAL Verifying Plug-in for Web Serers Chapter 7. Validating and maintaining policy databases Displaying all database contents Displaying summary reports Repairing a damaged policy database Replacing a damaged policy database Part 3. Logging Chapter 8. Diagnostics ersus auditing 37 Diagnostic eents Auditing eents Chapter 9. Routing files Location of routing files Routing file entries Chapter 10. Jaa properties files Location of Jaa properties files Application-specific logging of Jaa applications.. 43 Configuring message eents with the Jaa properties file Message loggers and file handlers Copyright IBM Corp. 2002, 2010 iii

6 When PDJLog.properties is used Console handler and console message logging.. 45 Tailoring message logging in Web Portal Manager Configuring trace eents with the Jaa properties file Trace loggers and file handlers Enabling trace in a Runtime for Jaa enironment Enabling trace in Web Portal Manager Chapter 11. Message eent logging.. 49 Seerity of message eents FATAL messages ERROR messages WARNING messages NOTICE messages NOTICE_VERBOSE messages Location of message logs Location with Tioli Common Directory Location without Tioli Common Directory Names of message logs Names of runtime logs Names of serer logs Format of messages in logs Messages in text format Messages in XML log format Enironment ariables Displaying and not displaying enironment ariables in the log Routing files for message eents C runtime routing file Policy serer pdmgrd_routing file Authorization serer pdacld_routing file Policy proxy serer pdmgrproxyd_routing file.. 58 WebSEAL routing file Understanding message routing files C runtime routing file on Windows Policy serer routing file on UNIX WebSEAL routing file on UNIX Limiting the size of message logs Estimating the size of message logs Changing the location of log files Logging all messages the same way Using GOESTO statements Changing the message format in log files Sending messages to multiple places in different formats Chapter 12. Trace eent logging Mechanisms for controlling trace logging Routing file examples Trace logging in Tioli XML log format Trace logging to multiple files Tracing a particular component Determining maximum size of a trace log Enabling trace Using the trace commands Listing aailable trace components Enabling trace Showing enabled trace components Changing the name and location of trace files.. 71 Format of trace entry in logs Trace logging for session management Aailable trace components Part 4. Problems with base systems 77 Chapter 13. Common Tioli Access Manager problems Enironment information messages in the serer log file at startup Unable to configure the policy serer Unable to communicate with user registry Configuration fails with LDAP serer Configuration fails with Domino serer Unable to create new user Unable to authenticate user Insufficient disk space Windows disk space Linux and UNIX disk space Unexpected access to resources ACL commands POP commands Authorization rule commands Processes terminate abruptly on Intel 64-bit processor Chapter 14. Tioli Access Manager user registries LDAP common problems LDAP does not start after creating suffix Insufficient priileges to perform operations.. 86 Tioli Directory Serer common problems Jaa error during installation Passwords not encrypted Location of error logs Tioli Directory Serer error log warnings Setting up SSL Actie Directory common problems Receiing HPDRG0100E for Actie Directory operations Receiing HPDRG0101E The user password iolates the Actie Directory user password policies Global Security Kit common problems Error when importing a PKCS12 formatted file 89 Part 5. Problems with Web security systems Chapter 15. Desktop single sign-on.. 93 Basic SPNEGO troubleshooting Linux and UNIX workflow Windows workflow Kerberos initialization failing Unable to initialize Kerberos libraries Unable to obtain initial credentials i Troubleshooting Guide

7 Web security serer not starting Authentication method not configured No match to principal in key table Unable to authenticate Ticket not yet alid Cannot acquire credentials Wrong principal in request Encryption type not permitted Key ersion is incorrect Cannot authenticate using NTLM Cannot complete authentication Algorithm to resole host names Useful Kerberos procedures Validating keys in key tables Listing caches, principals, and serice principals 103 Listing keys in key tables Listing tickets in credential caches Chapter 16. WebSEAL serers WebSEAL trace components pdweb.debug component pdweb.snoop component WebSEAL fails to start when configured to use Hardware Cryptographic deices Unable to customize response when using basic authentication WebSEAL not responding on ports 80 or Multiple log ins with e-community e-community SSO Master Authentication Serer configured with EAI Verifying junctioned, third-party Web serer WebSEAL performance is degraded when downloading files WebSEAL does not start after being configured to use PKCS # DPWWA0305E inconsistent message seerity Error when creating an LTPA junction Chapter 17. Web serer plug-ins Setting cache controls for Web serers Plug-in for Edge Serer Tailoring message logging an Edge Serer enironment Tailoring trace logging in an Edge Serer enironment Part 6. Collecting troubleshooting data Chapter 18. Gathering initial diagnostic information Installation directories Tioli Access Manager Shared Session Management WebSEAL Plug-in for Web Serers Plug-in for Edge Serer Locating diagnostic utilities Gathering ersion information Tioli Access Manager IBM Global Security Kit User registries Gathering system information Chapter 19. Collecting troubleshooting data General information to collect Collecting trace information Collecting trace information by serer Collecting the policy serer trace file Collecting the policy proxy serer trace file Collecting the WebSEAL trace files Collecting the authorization serer trace file Collecting the C-language trace file Collecting the Jaa-language trace files Collecting the message files Submitting your gathered data to IBM Appendix A. Sericeability commands 125 Reading syntax statements Sericeability and problem determination commands serer list serer task trace Sericeability and problem determination utilities 129 pdbackup pdjsericeleel pdsericeleel pdersion pdwebpi pdwpi-ersion Appendix B. User registry differences 141 General concerns LDAP concerns Sun Jaa System Directory Serer concerns Microsoft Actie Directory Application Mode (ADAM) concerns URAF concerns Lotus Domino Serer concerns Microsoft Actie Directory Serer concerns Length of names Appendix C. AutoTrace AutoTrace features AutoTrace files Files installed during installation Files not installed during installation Initializing the Windows AutoTrace serice Initializing the AutoTrace control program Verifying the initialization Displaying channel information Displaying configuration information Displaying product information Collecting trace data Trace file format and example Reading trace data Trace file example Creating a trace ID file Contents

8 Technique Technique Known problems Useful AutoTrace commands atctl commands atrpt commands atdb commands Appendix D. Support information Searching knowledge bases Searching information centers Searching the Internet Obtaining fixes Registering with IBM Software Support Receiing weekly software updates Contacting IBM Software Support Determining the business impact Describing problems and gathering information 166 Submitting problems Appendix E. Notices Trademarks Glossary Index i Troubleshooting Guide

9 About this publication Intended audience Publications The IBM Tioli Access Manager for e-business: Troubleshooting Guide proides a comprehensie set of procedures and reference information for troubleshooting Tioli Access Manager. IBM Tioli Access Manager for e-business proides an access control management solution to centralize network and application security policy for e-business applications. This guide is for system administrators and field support personnel responsible for troubleshooting a Tioli Access Manager enironment. Readers should be familiar with the following: PC and UNIX operating systems Database architecture and concepts Security management Internet protocols, including HTTP, TCP/IP, File Transfer Protocol (FTP), and Telnet Lightweight Directory Access Protocol (LDAP) and directory serices A supported user registry Authentication and authorization Secure Sockets Layer (SSL) protocol, key exchange (public and priate), digital signatures, cryptographic algorithms, and certificate authorities. This section lists publications in the IBM Tioli Access Manager for e-business library and related documents. The section also describes how to access Tioli publications online and how to order Tioli publications. IBM Tioli Access Manager for e-business library The following documents are in the Tioli Access Manager for e-business library: IBM Tioli Access Manager for e-business: Quick Start Guide, GI Proides steps that summarize major installation and configuration tasks. IBM Tioli Access Manager for e-business: Release Notes, GC Proides information about installing and getting started, system requirements, and known installation and configuration problems. IBM Tioli Access Manager for e-business: Installation Guide, GC Explains how to install and configure Tioli Access Manager for e-business. IBM Tioli Access Manager for e-business: Upgrade Guide, SC Upgrade from ersion 5.0, 6.0, or 6.1 to ersion IBM Tioli Access Manager for e-business: Administration Guide, SC Describes the concepts and procedures for using Tioli Access Manager. Proides instructions for performing tasks from the Web Portal Manager interface and by using the pdadmin utility. Copyright IBM Corp. 2002, 2010 ii

10 IBM Tioli Access Manager for e-business: WebSEAL Administration Guide, SC Proides background material, administratie procedures, and reference information for using WebSEAL to manage the resources of your secure Web domain. IBM Tioli Access Manager for e-business: Plug-in for Edge Serer Administration Guide, SC Proides instructions for integrating Tioli Access Manager with the IBM WebSphere Edge Serer application. IBM Tioli Access Manager for e-business: Plug-in for Web Serers Administration Guide, SC Proides procedures and reference information for securing your Web domain using a Web serer plug-in. IBM Tioli Access Manager for e-business: Shared Session Management Administration Guide, SC Proides deployment considerations and operational instructions for the session management serer. IBM Global Security Kit: Secure Sockets Layer Introduction and ikeyman User's Guide, SC Proides information for enabling SSL communication in the Tioli Access Manager enironment. IBM Tioli Access Manager for e-business: Auditing Guide, SC Proides information about configuring and managing audit eents using the natie Tioli Access Manager approach and the Common Auditing and Reporting Serice. You can also find information about installing and configuring the Common Auditing and Reporting Serice. Use this serice for generating and iewing operational reports. IBM Tioli Access Manager for e-business: Command Reference, SC Proides reference information about the commands, utilities, and scripts that are proided with Tioli Access Manager. IBM Tioli Access Manager for e-business: Administration C API Deeloper Reference, SC Proides reference information about using the C language implementation of the administration API to enable an application to perform Tioli Access Manager administration tasks. IBM Tioli Access Manager for e-business: Administration Jaa Classes Deeloper Reference, SC Proides reference information about using the Jaa language implementation of the administration API to enable an application to perform Tioli Access Manager administration tasks. IBM Tioli Access Manager for e-business: Authorization C API Deeloper Reference, SC Proides reference information about using the C language implementation of the authorization API to enable an application to use Tioli Access Manager security. IBM Tioli Access Manager for e-business: Authorization Jaa Classes Deeloper Reference, SC Proides reference information about using the Jaa language implementation of the authorization API to enable an application to use Tioli Access Manager security. iii Troubleshooting Guide

11 IBM Tioli Access Manager for e-business: Web Security Deeloper Reference, SC Proides programming and reference information for deeloping authentication modules. IBM Tioli Access Manager for e-business: Troubleshooting Guide, GC Proides problem determination information. IBM Tioli Access Manager for e-business: Error Message Reference, GI Proides explanations and recommended actions for the messages and return code. IBM Tioli Access Manager for e-business: Performance Tuning Guide, SC Proides performance tuning information for an enironment consisting of Tioli Access Manager with the IBM Tioli Directory Serer as the user registry. Related products and publications This section lists the IBM products that are related to and included with a Tioli Access Manager solution. IBM Global Security Kit Tioli Access Manager proides data encryption through the use of the Global Security Kit (GSKit), ersion 7.0. GSKit is included on the IBM Tioli Access Manager Base CD for your particular platform, as well as on the IBM Tioli Access Manager Web Security CDs, the IBM Tioli Access Manager Shared Session Management CDs, and the IBM Tioli Access Manager Directory Serer CDs. The GSKit package proides the ikeyman key management utility, gsk7ikm, which creates key databases, public-priate key pairs, and certificate requests. The IBM Global Security Kit: Secure Sockets Layer Introduction and ikeyman User's Guide is aailable on the Tioli Information Center Web site in the same section as the Tioli Access Manager product documentation. IBM Tioli Directory Serer IBM Tioli Directory Serer, ersion 6.1, is included on the IBM Tioli Access Manager Directory Serer set of CDs for the required operating system. You can find additional information about Tioli Directory Serer at: IBM Tioli Directory Integrator IBM Tioli Directory Integrator, ersion 6.1.1, is included on the IBM Tioli Directory Integrator CD for the required operating system. You can find additional information about IBM Tioli Directory Integrator at: IBM DB2 Uniersal Database IBM DB2 Uniersal Database Enterprise Serer Edition, ersion 9.1, is proided on the IBM Tioli Access Manager Directory Serer set of CDs and is installed with the Tioli Directory Serer software. DB2 is required when using Tioli Directory Serer or z/os LDAP serers as the user registry for Tioli Access Manager. For z/os LDAP serers, you must separately purchase DB2. You can find additional information about DB2 at: About this publication ix

12 IBM WebSphere Application Serer WebSphere Application Serer, ersion 6.1, is included on the IBM Tioli Access Manager WebSphere Application Serer set of CDs for the required operating system. WebSphere Application Serer enables the support of the following applications: Web Portal Manager interface, which administers Tioli Access Manager. Web Administration Tool, which administers Tioli Directory Serer. Common Auditing and Reporting Serice, which processes and reports on audit eents. Session management serer, which manages shared session in a Web security serer enironment. Attribute Retrieal Serice. You can find additional information about WebSphere Application Serer at: Accessing terminology online The Tioli Software Glossary includes definitions for many of the technical terms related to Tioli software. The Tioli Software Glossary is aailable at the following Tioli software library Web site: The IBM Terminology Web site consolidates the terminology from IBM product libraries in one conenient location. You can access the Terminology Web site at Accessing publications online The documentation CD contains the publications that are in the product library. The format of the publications is PDF, HTML, or both. Refer to the readme file on the CD for instructions on how to access the documentation. The product CD contains the publications that are in the product library. The format of the publications is PDF, HTML, or both. To access the publications using a Web browser, open the infocenter.html file. The file is in the appropriate publications directory on the product CD. IBM posts publications for this and all other Tioli products, as they become aailable and wheneer they are updated, to the Tioli Documentation Central Web site at Note: If you print PDF documents on other than letter-sized paper, set the option in the File Print window that allows Adobe Reader to print letter-sized pages on your local paper. Ordering publications You can order many Tioli publications online at You can also order by telephone by calling one of these numbers: In the United States: x Troubleshooting Guide

13 In Canada: In other countries, contact your software account representatie to order Tioli publications. To locate the telephone number of your local representatie, perform the following steps: 1. Go to 2. Select your country from the list and click Go. 3. Click About this site in the main panel to see an information page that includes the telephone number of your local representatie. Accessibility Tioli technical training Tioli user groups Support information Accessibility features help users with a physical disability, such as restricted mobility or limited ision, to use software products successfully. With this product, you can use assistie technologies to hear and naigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. Visit the IBM Accessibility Center at accessibility/ for more information about IBM's commitment to accessibility. For additional information, see the Accessibility Appendix in IBM Tioli Access Manager for e-business Installation Guide. For Tioli technical training information, refer to the following IBM Tioli Education Web site at Tioli user groups are independent, user-run membership organizations that proide Tioli users with information to assist them in the implementation of Tioli Software solutions. Through these groups, members can share information and learn from the knowledge and experience of other Tioli users. Tioli user groups include the following members and groups: 23,000+ members 144+ groups Access the link for the Tioli Users Group at If you hae a problem with your IBM software, you want to resole it quickly. IBM proides the following ways for you to obtain the support you need: Online Access the Tioli Software Support site at sysmgmt/products/support/index.html?ibmprd=timan. Access the IBM Software Support site at probsub.html. IBM Support Assistant The IBM Support Assistant is a free local software sericeability workbench that helps you resole questions and problems with IBM software About this publication xi

14 products. The Support Assistant proides quick access to support-related information and sericeability tools for problem determination. To install the Support Assistant software, go to support/isa. Troubleshooting Guide For more information about resoling problems, see the IBM Tioli Access Manager for e-business Installation Guide. Conentions used in this publication This publication uses seeral conentions for special terms and actions, operating system-dependent commands, and paths. Typeface conentions This publication uses the following typeface conentions: Bold Italic Lowercase commands and mixed case commands that are otherwise difficult to distinguish from surrounding text Interface controls (check boxes, push buttons, radio buttons, spin buttons, fields, folders, icons, list boxes, items inside list boxes, multicolumn lists, containers, menu choices, menu names, tabs, property sheets), labels (such as Tip:, and Operating system considerations:) Keywords and parameters in text Citations (examples: titles of publications, diskettes, and CDs Words defined in text (example: a nonswitched line is called a point-to-point line) Emphasis of words and letters (words as words example: "Use the word that to introduce a restrictie clause."; letters as letters example: "The LUN address must start with the letter L.") New terms in text (except in a definition list): a iew is a frame in a workspace that contains data. Variables and alues you must proide:... where myname represents... Monospace Examples and code examples File names, programming keywords, and other elements that are difficult to distinguish from surrounding text Message text and prompts addressed to the user Text that the user must type Values for arguments or command options Operating system-dependent ariables and paths This publication uses the UNIX conention for specifying enironment ariables and for directory notation. When using the Windows command line, replace $ariable with % ariable% for enironment ariables and replace each forward slash (/) with a backslash (\) in directory paths. The names of enironment ariables are not always the same in the Windows and UNIX enironments. For example, %TEMP% in Windows enironments is equialent to $TMPDIR in UNIX enironments. xii Troubleshooting Guide

15 Note: If you are using the bash shell on a Windows system, you can use the UNIX conentions. About this publication xiii

16 xi Troubleshooting Guide

17 Part 1. Introduction Chapter 1. Introduction to problem determination 3 Aoiding potential problems Problem resolution Product short names Sericeability enhancements Chapter 2. Tioli Common Directory Location of the Tioli Common Directory properties file Common directories used by Tioli Access Manager 5 Configuration setting used by Tioli Access Manager 6 Chapter 3. Messages Message types Message format Message identifiers Chapter 4. Tioli XML Log Viewer Installing the Tioli XML Log Viewer Running the Tioli XML Log Viewer Copyright IBM Corp. 2002,

18 2 Troubleshooting Guide

19 Chapter 1. Introduction to problem determination Aoiding potential problems Problem determination, or troubleshooting, is a process of determining why a product is not functioning in the expected manner. This guide proides information to help you identify and resole problems that you might encounter while using Tioli Access Manager and its prerequisite products. Tioli Access Manager proides an authentication and authorization framework for permitting or restricting access to system resources that are located in a secure domain. You can often preent problems through planning before deploying software. Before installing Tioli Access Manager, reiew the IBM Tioli Access Manager for e-business: Release Notes. This document contains the following information: Supported operating system leels Prerequisite software requirements Required software patches Minimum and recommended memory requirements Disk space requirements Upgrade considerations Known problems, limitations, and recoery procedures Customer support contact information After installing Tioli Access Manager, ensure that you hae a comprehensie backup and system recoery strategy in place. When creating your backup and recoery strategy, include the following information to help aoid the possibility of running into problems: Perform regular periodic backups of Tioli Access Manager by using the pdbackup command. Periodically backup the user registry following the instructions proided by the user registry endor. Maintain information about your enironment, including system topology, IP addresses, host names, and which components are installed on each system. Maintain updated information that describes the key system resources that are being managed by Tioli Access Manager and the security policies that are being applied to them by Tioli Access Manager. Periodically check that all systems running Tioli Access Manager hae sufficient disk space for runtime and problem determination data. As your security policy grows, and the number of users, groups, and protected objects increase, the space requirements for the policy databases, message logs, trace logs, and any auditing information can increase as well. Regularly check for the aailability of fix packs and install them as they become aailable. Information on fix packs and other useful information can be found on the IBM Software Support site at the following Web address: Copyright IBM Corp. 2002,

20 Problem resolution Product short names When problems do occur, use the information in this guide to identify and possibly resole them. If you are unable to correct the problem, gather the releant diagnostic information as described in this guide and then use the information in Chapter 19, Collecting troubleshooting data, on page 119 to get further assistance. To proide consistency with other IBM and Tioli products, components of Tioli Access Manager identify some product-specific information with a unique product identifier. This three-character identifier is used in the following places: As the first three characters of message IDs. (See the IBM Tioli Access Manager for e-business: Error Message Reference for a complete explanation of messages in Tioli Access Manager) To identify the subdirectory that contains the sericeability information when using the Tioli Common Directory AutoTrace (see Appendix C, AutoTrace, on page 149 for details) The product identifiers associated with Tioli Access Manager for e-business are shown in Table 1. Table 1. Product short names in Tioli Access Manager Product identifier HPD DPW AWD AMZ CTG Tioli Access Manager component Tioli Access Manager Tioli Access Manager WebSEAL Tioli Access Manager Plug-in for Edge Serer Tioli Access Manager Plug-in for Web Serers Tioli Access Manager Shared Session Management Sericeability enhancements Note: CTG is a product identifier for multiple Tioli components, not just the Shared Session Management component. Tioli Access Manager supports the following sericeability initiaties: Tioli Common Directory as explained in Chapter 2, Tioli Common Directory, on page 5. Tioli Message Standard as explained in Chapter 3, Messages, on page 9. Tioli XML log format as explained in Chapter 4, Tioli XML Log Viewer, on page Troubleshooting Guide

21 Chapter 2. Tioli Common Directory To proide a consistent mechanism for locating sericeability information, Tioli Access Manager proides the ability to use Tioli Common Directory logging. Tioli Access Manager does not take adantage of the Tioli Common Directory unless you explicitly request this behaior during the installation of the product. By default, sericeability information is stored in the /log subdirectory of the product installation directory. If Tioli Common Directory support is requested, the installation wizard uses the existing Tioli Common Directory as the default location for sericeability information. If no existing Tioli Common Directory is in use, the directory specified during the installation is identified as the Tioli Common Directory and sericeability information for Tioli Access Manager and other Tioli products is stored there. When enabled, all message log file are in this central location. Other types of application log files continue to be located in their installation directories. Products that support Tioli Common Directory store the following types of sericeability-related files in this central location: Logs files First-failure data capture (FFDC) files Sericeability scripts Note: After defining the Tioli Common Directory location, you cannot change it. Location of the Tioli Common Directory properties file If any product on the system uses Tioli Common Directory, the parent directory is defined in the log.properties file. Depending on your operating system, the log.properties file is in one of the following default locations: Linux and UNIX operating systems /etc/ibm/tioli/common/cfg/log.properties Windows operating systems c:\program files\ibm\tioli\common\cfg\log.properties On a Linux or UNIX operating system, this file should hae the 664 permission and should be owned by group tioli. Common directories used by Tioli Access Manager During the configuration of the Tioli Access Manager C runtime or Jaa runtime, the default location is displayed. If Tioli Access Manager is the first Tioli product on this system to use Tioli Common Directory, you can change this location. If another product already defined this location, this location is displayed and you cannot change this location. Copyright IBM Corp. 2002,

22 After enabling Tioli Common Directory, Tioli Access Manager uses the /logs subdirectory to store message and trace logs. Tioli Access Manager does not use the /ffdc or /scripts subdirectories. The logs files can be found at the following default location: common_directory/xxx/logs/ where: common_directory Represents the parent directory for sericeability data. This directory is usually defined by the first Tioli product that uses Tioli Common Directory. The default alues, if Tioli Access Manager is the first Tioli product, is one of the following platform-specific directories: Linux and UNIX operating systems /ar/ibm/tioli/common Windows operating systems c:\program files\ibm\tioli\common\ Note: On a Linux or UNIX operating system, this directory should hae the 771 permissions and be owned by the tioli group. xxx logs Represents the 3-letter identifier to use for the product-specific message log files. Tioli Access Manager uses the following identifiers: HPD The identifier for Tioli Access Manager DPW The identifier for Tioli Access Manager WebSEAL AMZ The identifier for Tioli Access Manager Plug-in for Web Serers AWD The identifier for Tioli Access Manager Plug-in for Edge Serer AOS The identifier for Tioli Access Manager for Operating Systems DRQ The identifier for Tioli Access Manager for Business Integration The subdirectory that is used for Tioli Access Manager message and trace log files. Only one subdirectory, /logs, is defined for these log files. Configuration setting used by Tioli Access Manager When configured for Tioli Common Directory, the tioli_common_dir stanza entry of the pd.conf configuration file would be similar to one of the following entries: Linux and UNIX operating systems [pdrte] tioli_common_dir = ar/ibm/tioli/common/ Windows operating systems [pdrte] tioli_common_dir = c:\program Files\IBM\Tioli\common\ When configured for Tioli Common Directory, the log-file stanza entry of the serer-specific configuration file contains the fully qualified names of the log files. For example, when configured for Tioli Common Directory, the log_file stanza entry for the authorization serer log files would be similar to one of the following entries: 6 Troubleshooting Guide

23 Linux and UNIX operating systems [iacld] log-file = ar/ibm/tioli/common/hpd/logs/msg pdacld_utf8.log Windows operating systems [iacld] log-file = c:\program Files\IBM\Tioli\common\HPD\logs \msg pdacld_utf8.log Chapter 2. Tioli Common Directory 7

24 8 Troubleshooting Guide

25 Chapter 3. Messages Message types All messages issued by Tioli Access Manager adhere to the Tioli Message Standard. The Tioli Message Standard specifies a standard format for all messages issued by Tioli products. The standard, based on the IBM Message Standard, is intended to proide a consistent and meaningful way for identifying messages across the entire Tioli product set. Messages issued by Tioli Access Manager, along with detailed explanations and suggested actions, can be found in the IBM Tioli Access Manager for e-business: Error Message Reference. Tioli Access Manager is written in both the C and Jaa programming languages. Applications that use the Tioli Access Manager APIs are also written in these programming languages. Tioli Access Manager produces the following types of messages: Runtime messages Messages that are generated by applications, commands, and utilities that use the Tioli Access Manager Runtime component, as well as messages that are generated from the C language-based Tioli Access Manager components, such as WebSEAL. These messages are written to the runtime message logs based on their seerity leels. These messages follow the message standard. Additional information on these messages can be found in the IBM Tioli Access Manager for e-business: Error Message Reference. Tioli Access Manager Runtime for Jaa messages Messages that are generated by applications, commands, and utilities that use the Tioli Access Manager Runtime for Jaa component, as well as messages that are generated from the Jaa language-based Tioli Access Manager components. These messages are written to the Tioli Access Manager Runtime for Jaa message logs. These messages tend to proide exception and stack trace information from the JRE. Serer messages Messages that are generated by the Tioli Access Manager daemons and serers. Messages from the policy serer, authorization serer, WebSEAL serers, and policy proxy serer are written to the serer message logs. These messages follow the message standard. Additional information on these messages can be found in the IBM Tioli Access Manager for e-business: Error Message Reference. Installation and configuration messages Messages that are generated by the InstallShield MultiPlatform installation wizards as well as by the configuration utilities. Some of these messages follow the message standard and hae an associated ID. These messages are written to the log files described in Chapter 5, Installation and initial configuration, on page 15 during installation. WebSEAL HTTP messages WebSEAL proides the capability of logging HTTP messages. This message logging capability is described in the IBM Tioli Access Manager for e-business: Auditing Guide. Copyright IBM Corp. 2002,

26 Message format Message identifiers A message consists of a message identifier (ID) and message text and an error code. The error code is a unique 32-bit alue. The error code is either a decimal or hexadecimal number and indicates that an operation was not successful. All messages that follow the message standard are listed in the IBM Tioli Access Manager for e-business: Error Message Reference. Each of these messages has a detailed explanation and suggested actions. A message ID consists of 10 alphanumeric characters that uniquely identify the message. The message ID consists of the following parts: A 3-character product identifier (see Table 2 for the list of identifiers that are used by Tioli Access Manager) A 2-character component or subsystem identifier A 4-digit serial or message number A 1-character type code indicating the one of the following message seerities: W Warning E Error I Information Table 2. Product identifiers that are used by Tioli Access Manager Product identifier Tioli Access Manager component HPD Tioli Access Manager serers DPW Tioli Access Manager WebSEAL AWD Tioli Access Manager Plug-in for Edge Serer AMZ Tioli Access Manager Plug-in for Web Serers CTG Tioli Access Manager Shared Session Management 10 Troubleshooting Guide

27 Chapter 4. Tioli XML Log Viewer The C-based components of Tioli Access Manager support the generation of message and trace information in a common XML format. This format is known as the Tioli XML log format and is used by a number of Tioli applications. A Jaa-based log iewer is proided that allows these messages and traces to be filtered in a number of ways, including by time window, seerity, thread ID, and component. Information that is produced by different products can be analyzed and conerted into ASCII or HTML that use the Tioli XML Log Viewer. This log iewer is not installed as part of any Tioli Access Manager installation. You must explicitly install the Tioli XML Log Viewer. Note: Jaa language-based Tioli Access Manager components and applications cannot produce messages or traces in the Tioli XML log format. To more easily iew XML output, use the Tioli XML Log Viewer tool that is proided with Tioli Access Manager. The XMLFILE, XMLSTDERR, and XMLSTDOUT format in the routing file are used to produce XML message logs and XML trace logs. Because the InstallShield MultiPlatform installation program and the Tioli XML Log Viewer are both Jaa applications, a JRE must be installed prior to installing and using the iewer. The same JRE that is used by Tioli Access Manager can be used for the Tioli XML Log Viewer. If a different JRE is used, that JRE must be at ersion or later. Installing the Tioli XML Log Viewer The Tioli XML Log Viewer is installed using an InstallShield MultiPlatform installation program. Howeer, the installation program for the iewer is proided as a Jaa archie (JAR) file, and not as an executable file like the other product installation programs. The installation JAR file is located on the operating system-specific IBM Tioli Access Manager Base CD in the /operating_system/xmllogiewer directory. For example, the Tioli XML Log Viewer installation program for Windows operating systems is in the \windows\xmllogiewer directory of the IBM Tioli Access Manager Base for Windows CD, and the Tioli XML Log Viewer installation program for Solaris operating enironments is in the /solaris/xmllogiewer directory of the IBM Tioli Access Manager Base for Solaris CD. To install the iewer, perform the following steps: 1. From a command prompt, naigate to the /xmllogiewer directory. 2. Enter the following command: jaa -cp setup.jar run 3. Naigate through the InstallShield MultiPlatform panels and select a location for the Tioli XML Log Viewer, then proceed to install the iewer. 4. After the installation program completes, you can add the Tioli XML Log Viewer directory to the search path. Copyright IBM Corp. 2002,

28 5. On Linux and UNIX operating systems, you might need to explicitly set execute permissions on the iewer.sh file: chmod +x iewer.sh Running the Tioli XML Log Viewer To run the Tioli XML Log Viewer, use the iewer script and specify the name of one or more XML files. Output is directed to STDOUT in either HTML or text format. The output can be redirected to a file for iewing with a Web browser or text editor. For example, to create an HTML file containing all of the messages from the policy and authorization serers sorted into chronological sequence, enter the following command: iewer msg pdmgrd.xml msg pdacld.xml > msg_19oct2003_report.html To display the messages from the policy serer in text format, do the following: iewer -s text msg pdmgrd.xml Additional information on the Tioli XML Log Viewer, including how to tailor the output and how to uninstall it, can be found in the readme.html file, located in the same directory as the iewer script. This readme file also is proided in the /xmllogiewer directory on the installation media. 12 Troubleshooting Guide

29 Part 2. Deployment Chapter 5. Installation and initial configuration 15 Log files Installation wizard log files Natie installation log files Natie configuration log files Installation wizard problems Tioli Directory Serer installation wizard problems Insufficient disk space for temporary files Cannot launch the installation wizard Installation wizard failed Problems when a local firewall is enabled.. 19 Enabling the Jaa console in a separate window Writing the Jaa console output to a log file 19 Remoing the ibmjcaproider.jar file Operating system problems Multiple network interfaces Initial configuration problems Inalid LDAP management domain location DN causes error Timing out during configuration Recoering an LDAP serer Upgrade common problems Cannot create users or groups after upgrade.. 22 Displaying summary reports Repairing a damaged policy database Replacing a damaged policy database Chapter 6. Verifying the deployment System types in a deployment Base systems Web security systems Distributed session management systems Checking installed software Verifying Global Security Kit Verifying user registries Tioli Directory Serer Verifying the serer Verifying the client Microsoft Actie Directory Verifying the configuration Verifying ersion numbers Confirming connectiity Lotus Domino Serer Verifying the configuration Verifying ersion numbers Confirming connectiity Verifying base systems Verifying the policy serer Verifying the authorization serer Verifying the runtime Verifying Web security systems Verifying WebSEAL Verifying Plug-in for Web Serers Chapter 7. Validating and maintaining policy databases Displaying all database contents Copyright IBM Corp. 2002,

30 14 Troubleshooting Guide

31 Chapter 5. Installation and initial configuration Log files This chapter describes problems that you might encounter while installing or configuring Tioli Access Manager and proides information about how to determine the origin of the problem. After determining what caused the problem, you can use the information that is proided to resole this problem. Before listing some of the common Tioli Access Manager problems that you might encounter during installation or configuration, it is worthwhile to mention that the cause of most common installation and configuration problems is one of the following failures: Failure to install all of the prerequisite and corequisite software that is required. This required software can include: Operating system software Operating system patches Prerequisite software products Prerequisite software product patches Failure to install the correct leel of any of the software aboe Failure to install all of the required software components for any gien type of Tioli Access Manager system Failure to install or configure any of the aboe items properly Failure to adhere to all hardware prerequisites as well as disk space and memory requirements When you install and configure Tioli Access Manager components, log files are created. If you use the installation wizards to install the components, the log file contains both the installation and configuration information. If you natiely install and configure, there are separate log files for installation and configuration. Installation wizard log files Problems encountered after you hae filled in the installation panels, reiewed the configuration options summary page, and clicked Next to begin the installation can usually be diagnosed by reiewing the installation log files created by the installation wizards. These installation log files are written to the temporary directory on the system (typically the /tmp or /ar/tmp directory on Linux and UNIX operating systems, and to the directory defined by the TEMP enironment ariable on Windows operating systems). Table 3 proides the names of the arious installation log files created by the installation wizards. Table 3. Installation log file names for installation wizards Component Policy serer Policy proxy serer Authorization serer Installation wizard log file msg ammgr_install.log msg amproxy_install.log msg amacld_install.log Copyright IBM Corp. 2002,