WAS V7.pdf

7/21/2019 WAS V7.pdf

http://slidepdf.com/reader/full/was-v7pdf 1/593

IBM WebSphere ApplicationServer V7 Administration onWindows (Course code WA370 / VA370)

Student Exercises

ERC 1.0

WebSphere Education

5.3

over

Front cover

7/21/2019 WAS V7.pdf


Student Exercises

April 2009 edition

The information contained in this document has not been submitted to any formal IBM test and is distributed on an “as is” basis withoutany warranty either express or implied. The use of this information or the implementation of any of these techniques is a customerresponsibility and depends on the customer’s ability to evaluate and integrate them into the customer’s operational environment. Whileeach item may have been reviewed by IBM for accuracy in a specific situation, there is no guarantee that the same or similar results willresult elsewhere. Customers attempting to adapt these techniques to their own environments do so at their own risk.

© Copyright International Business Machines Corporation 2009. All rights reserved.

This document may not be reproduced in whole or in part without the prior written permission of IBM.

Note to U.S. Government Users — Documentation related to restricted rights — Use, duplication or disclosure is subject to restrictionsset forth in GSA ADP Schedule Contract with IBM Corp.

Trademarks

IBM® is a registered trademark of International Business Machines Corporation.

The following are trademarks of International Business Machines Corporation in the United

States, or other countries, or both:

VMware® and the VMware “boxes” logo and design, Virtual SMP and VMotion areregistered trademarks or trademarks (the “Marks”) of VMware, Inc. in the United States

and/or other jurisdictions.

Adobe is either a registered trademark or a trademark of Adobe Systems Incorporated inthe United States, and/or other countries.

Intel is a trademark or registered trademark of Intel Corporation or its subsidiaries in the

United States and other countries.

Java and all Java-based trademarks and logos are trademarks of Sun Microsystems, Inc.

in the United States, other countries, or both.

Linux® is a registered trademark of Linus Torvalds in the United States, other countries, or

both.Microsoft, Windows, Windows NT and Windows Vista are trademarks of Microsoft

Corporation in the United States, other countries, or both.

UNIX® is a registered trademark of The Open Group in the United States and othercountries.

Other company, product, or service names may be trademarks or service marks of others.

AIX® Balance® CICS®

Cloudscape® DataPower® DB2® developerWorks® Domino® e-business on demand®

Express™ HACMP™ IMS™

Informix® iSeries® Lotus®

OS/400® Passport Advantage® RACF®

Rational® Tivoli® WebSphere®

z/OS® zSeries® 400®

7/21/2019 WAS V7.pdf


Student Exercises

5.3

OC

Course materials may not be reproduced in whole or in part

without the prior written permission of IBM.

© Copyright IBM Corp. 2009 Contents iii

Contents

Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Exercises description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

Exercise 1. Installing WebSphere Application Server . . . . . . . . . . . . . . . . . . . . . . . 1-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-4Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-61

Exercise 2. Installing IBM HTTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21

Exercise 3. WebSphere Information Center installation (optional) . . . . . . . . . . . . 3-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2

Exercise 4. Exploring the WebSphere Application Server administrative console 4-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-36

Exercise 5. Assembling an application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-4Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-35

Exercise 6. Installing an application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2

Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-34

Exercise 7. Problem determination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-2Part 1: Working with log files of the application server . . . . . . . . . . . . . . . . . . . . . . . . . 7-2Part 2: Using the Log Analyzer for viewing service and JVM logs . . . . . . . . . . . . . . . . 7-8Part 3: Enabling tracing on an application server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-18Part 4: Work with the Guided Troubleshooting component of IBM Support Assistant 7-23Part 5: Work with a collector in the IBM Support Assistant. . . . . . . . . . . . . . . . . . . . . 7-32Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-42Appendix: Installing the IBM Support Assistant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-43

Exercise 8. Using wsadmin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-69

Exercise 9. Creating a federated cell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-56

7/21/2019 WAS V7.pdf


Student Exercises



iv WebSphere Application Server V7 Administration © Copyright IBM Corp. 2009

Exercise 10. Clustering and workload management . . . . . . . . . . . . . . . . . . . . . . . .10-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-2Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-31

Exercise 11. Configuring the service integration bus . . . . . . . . . . . . . . . . . . . . . . .11-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3Part 1: Applications used in this exercise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-3

Part 2: The messaging environment created in the exercise . . . . . . . . . . . . . . . . . . . 11-4Part 3: Setting up the service integration bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-6Part 4: Configuring the JMS resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-23Part 5: Installing the messaging applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-27Part 6: Testing the applications and exploring messaging engine policies . . . . . . . . 11-33Part 7: (Optional) Configure the scalability messaging engine policy . . . . . . . . . . . . 11-45Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-56

Exercise 12. Configuring WebSphere security, including fine-grained administrativeaccess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12-1

Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-17

Exercise 13. Configuring application security . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-2Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13-20

Exercise 14. Configuring SSL for WebSphere . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-33

Exercise 15. Auditing (optional) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15-26

Exercise 16. Using the performance monitoring tools . . . . . . . . . . . . . . . . . . . . . .16-1Exercise instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-3Exercise review and wrap-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16-17

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Trademarks v

5.3

MK Trademarks

The reader should recognize that the following terms, which appear in the content of this

training document, are official trademarks of IBM or other companies:

IBM® is a registered trademark of International Business Machines Corporation.

The following are trademarks of International Business Machines Corporation in the UnitedStates, or other countries, or both:

VMware® and the VMware “boxes” logo and design, Virtual SMP and VMotion are

registered trademarks or trademarks (the “Marks”) of VMware, Inc. in the United Statesand/or other jurisdictions.

Adobe is either a registered trademark or a trademark of Adobe Systems Incorporated in

the United States, and/or other countries.

Intel is a trademark or registered trademark of Intel Corporation or its subsidiaries in theUnited States and other countries.

Java and all Java-based trademarks and logos are trademarks of Sun Microsystems, Inc.in the United States, other countries, or both.

Linux® is a registered trademark of Linus Torvalds in the United States, other countries, or

both.

Microsoft, Windows, Windows NT and Windows Vista are trademarks of MicrosoftCorporation in the United States, other countries, or both.

UNIX® is a registered trademark of The Open Group in the United States and other

countries.

Other company, product, or service names may be trademarks or service marks of others.

AIX® Balance® CICS®

Cloudscape® DataPower® DB2®

developerWorks® Domino® e-business on demand®

Express™ HACMP™ IMS™

Informix® iSeries® Lotus®

OS/400® Passport Advantage® RACF®

Rational® Tivoli® WebSphere®

z/OS® zSeries® 400®

7/21/2019 WAS V7.pdf


Student Exercises



vi WebSphere Application Server V7 Administration © Copyright IBM Corp. 2009

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercises description vii

5.3

ef Exercises description

This course includes the following exercises:

•Exercise 1. Installing WebSphere Application Server

•Exercise 2. Installing IBM HTTP Server

•Exercise 3. WebSphere Information Center installation (optional)

•Exercise 4. Exploring the WebSphere Application Server

administrative console

•Exercise 5. Assembling an application

•Exercise 6. Installing the Trade application

•Exercise 7. Problem determination (optional)

•Exercise 8. Using wsadmin

•Exercise 9. Creating a federated cell

•Exercise 10. Clustering and workload management

•Exercise 11. Configuring the service integration bus

•Exercise 12. Enabling WebSphere administrative security, includingfine-grained administrative access

•Exercise 13. Configuring application security

•Exercise 14. Configuring SSL for WebSphere

•Exercise 15. Auditing (optional) •Exercise 16. Using the performance monitoring tools (optional)

In the exercise instructions you will see each step prefixed by a line.

You may wish to check off each step as you complete it to keep trackof your progress.

Most exercises include required sections which should always be

completed. These may be required before performing later exercises.Some exercises may also include optional sections that you may wish

to perform if you have sufficient time and want an additional challenge.

This course includes two versions of the course exercises, “with hints”and “without hints”.

The standard “Exercise instructions” section provides high-level

instructions for the tasks you should perform. You need to apply theknowledge you gained in the unit presentation to perform the exercise.

The “Exercise instructions with hints” provide more detailed

instructions and hints to help you perform the exercise steps.

7/21/2019 WAS V7.pdf


Student Exercises



viii WebSphere Application Server V7 Administration © Copyright IBM Corp. 2009

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 1. Installing WebSphere Application Server 1-1

5.2

Xempty Exercise 1.Installing WebSphere ApplicationServer

What this exercise is about

In this exercise, you will install WebSphere Application Server NetworkDeployment V7. In V7, the installation of WebSphere Application

Server Network Deployment is a two-step process. The first step usesthe installation wizard to install a set of shared product binaries. The

second step uses the Profile Management Tool to create anapplication server profile.

After installation, you test the product to ensure the WebSphereApplication Server was installed successfully. You also create an

application server profile, profile1.

What you should be able to do

At the end of the lab, you should be able to:

• Install WebSphere Application Server

• Create an initial profile

• Back up the configuration

• Explore the installed directory structure and files

• Locate important configuration and log files

• Verify the installation

Introduction

In this exercise you install WebSphere Application Server Network

Deployment V7.

WebSphere Application Server relies on TCP/IP networking, so youmust have TCP/IP correctly configured, and it is important that the

machine host name remains unchanged.

The lab machine should be configured appropriately. Make sure youknow the host name of the machine because you need it in the

exercises.

A Windows administrator user ID has been created for you. Youshould use this ID to log in to Windows and to configure services and

database access.

7/21/2019 WAS V7.pdf


Student Exercises



1-2 WebSphere Application Server V7 Administration © Copyright IBM Corp. 2009

• User ID: administrator

• Password: web1sphere

Note: Microsoft Windows passwords are case-sensitive.

Linux

A Linux administrator user ID has been created for you. You should use this ID to log in toLinux.

• User ID: root


Information

The exercise screen captures are Windows-centric; however, the majority of the

instructions are applicable across all WebSphere-compatible platforms. There will be

references in places to added appendixes noted by the [Appendix] marker. Refer to your

platform’s appendix for appropriate information.

The standard classroom lab computers have a host name of was7hostXX (where XX is

01, 02, and so forth). If you are performing the labs on a computer with a different host

name, substitute that name where appropriate.

Open a command-prompt window and use the hostname command to determine the hostname.

Table 1: Exercise user ID and password variables<variable> Value

<os_userid>administrator (Windows) root (Linux)

<was_userid> wasadmin

<master_password> web1sphere

<db2_userid> db2admin (Windows) db2inst1 (Linux)

<db2_password>web1sphere (Windows) was1edu (Linux)

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty On Windows, most paths are listed as appropriate variables. When a

<variable> is found, use the table below to determine the correct value for

this variable.

Linux

On Linux, most paths are listed as appropriate variables. When a <variable> is found, use

the table below to determine the correct value for this variable.

Table 2: Windows exercise variables

<variable> Value

<os_userid> administrator

<was_userid> wasadmin<master_password> web1sphere

<db2_userid> db2admin

<db2_password> web1sphere

<software_dir> C:\software

<software_cds> C:\software_cds

<was_root> C:\Program Files\IBM\WebSphere\AppServer

<profile_root> C:\Program Files\IBM\WebSphere\AppServer\profiles

<ihs_root> C:\Program Files\IBM\HTTPServer

<plugin_root> C:\Program Files\IBM\HTTPServer\Plugins

<db2_root> C:\Program Files\IBM\SQLLIB

Table 3: Linux exercise variables<variable> Value

<os_userid> root

<was_userid> wasadmin

<master_password> web1sphere

<db2_userid> db2admin

<db2_password> was1edu

<software_dir> /usr/software

<software_cds> /usr/software_cds

<was_root> /opt/IBM/WebSphere/AppServer

<profile_root> /opt/IBM/WebSphere/AppServer/profiles

<ihs_root> /opt/IBM/HTTPServer

<plugin_root> /opt/IBM/HTTPServer/Plugins

<db2_root> /opt/ibm/db2/V9.5

7/21/2019 WAS V7.pdf


Student Exercises




Exercise instructions

Logging in

__ 1. When you boot up your machine, you are prompted for a user ID and password. Atthis prompt, enter:



Be sure to use lowercase, for the Windows login fields are case-sensitive.

If you are already logged in, but not as administrator, then log off your current ID andlog in as: administrator

__ a. Press Ctrl-Alt-Delete for the Windows Security window.

Note

Note: If you are using a VMware image, press Ctrl-Alt-Insert instead of Ctrl-Alt-Delete.

__ b. Click the Log Off... button. Are you sure you want to log off? Click Log Off .

__ c. At the login window, type administrator and web1sphere into the correct

fields.

Linux

To log into the Linux machine, use the following:

• User ID: root


Install WebSphere Application Server Network Deployment V7

The WebSphere Application Server Network Deployment V7 installation files have already

been downloaded and extracted into a software directory on your machine (see your

platform appropriate [Appendix] for the directory path).

Install the WebSphere Application Server Network Deployment V7.

__ 2. Start the WebSphere Application Server Launchpad.

__ a. Start Windows Explorer (right-click My Computer > Explore or right-click Start

> Explore).

__ b. Navigate to <software_cds>\WAS7\.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Run (double-click) launchpad.exe.

Linux

In a terminal window, navigate to <software_cds>/WAS7/ and invoke ./launchpad.sh

__ 3. The Launchpad is displayed. On the Welcome panel there are links that launch the

installer programs for all of the installable components.

__ 4. Click Launch the installation wizard for WebSphere Application Server

Network Deployment to launch the installation wizard.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. The Welcome panel appears. The Welcome panel identifies the location ofadditional information, including information centers and support sites. Click

Next to continue the installation.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. On the Software License Agreement panel, click I accept both the IBM and the

non-IBM terms to accept the license agreement, and click Next.

__ c. The installation wizard will check system prerequisites. When the check iscomplete, the System Prerequisites Check panel will appear.

If the check detects any incorrect prerequisites, a warning page is displayed. If

the check detects an existing installation of WebSphere Application Server, youare given the opportunity to add features to the existing copy, install a new copy,

or perform an upgrade of a trial installation to a full product.

7/21/2019 WAS V7.pdf


Student Exercises




The lab system should meet the prerequisites and should not have any versionof WebSphere Application Server already installed. Click Next to continue the

installation.

Information

If the lab system does not meet the prerequisites, check with your instructor beforecontinuing with the installation.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. The Optional Features Installation panel allows you to choose if you want thesample applications installed. Additionally, you may install non-English language

packages for the administrative console and for the application runtimeenvironment.

For this course, in order to save disk space, do not select any options. Click Next

to continue.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. On the following Installation Directory panel, you can change the installationdirectory for WebSphere Application Server. Note the default installation

directory location: C:\Program Files\IBM\WebSphere\AppServer. Do not change this directory location. Click Next.

In UNIX-based systems, the directory structures will be different. Refer to the appropriate

[Appendix] for the appropriate directory structures. The install wizard gives the

appropriate default values for these directories.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. The WebSphere Application Server Environments panel appears. From thispanel you can select which type of profile to create during the installation

process.

For this lab, from the list of environments, select None. You will use the ProfileManagement Tool, at the end of the installation process, to create an application

server profile. The Profile Management Tool provides greater control over theoptions used during profile creation. Click Next to continue.

__ g. A warning message will appear indicating that “WebSphere Application Serverversion 7.0 requires at least one profile to be functional.” Click Yes

to proceed with the installation without creating a profile. You will create a profileat the end of the installation.

__ h. The Repository for Centralized Installation Managers panel appears. From this

panel you can choose to create a repository for centralized installation

7/21/2019 WAS V7.pdf


7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. Review the product to be installed and summary information shown on theInstallation Summary panel. Click Next to start the installation. The installation

can take several minutes to complete.

There is an additional step that can be helpful on UNIX platforms. There is the possibility tocheck for permissions. Leave the default and click Next. When a second summary screen

comes up verifying that you do in fact have the appropriate permissions, click Next again.

7/21/2019 WAS V7.pdf


Student Exercises




__ 5. Following the installation, the Installation Results panel appears. A profile needs tobe created in order for WebSphere Application Server to be functional. Make sure

the Create a new WebSphere Application Server profile using the Profile

Management Tool box is checked. Click Finish.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. On the Welcome panel for the Profile Management Tool, click Launch Profile

Management Tool to continue.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. The Profiles list panel appears. Since you did not create a profile duringinstallation, the list is empty. To begin creating a profile, click Create.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

Profiles allow you to create multiple runtime environments on a system without installing

the product again by creating profiles. When using the Profile Management Tool, there areseveral types of profiles that can created:

• Application serverAn application server environment runs your enterprise applications. Anapplication server is managed from its own administrative console and functions

independently from all other application servers. A new instance of a stand-alonenode with a single application server is created. Stand-alone nodes have only

one application server.

• Management

A management profile provides the server and services for managing multiple

application server environments. The administrative agent manages applicationservers on the same machine. The Network Deployment edition also includes a

deployment manager for tightly coupled management and a job manager forloosely coupled management of topologies distributed over multiple machines.

Each instance of the deployment manager defines a unique cell.

• Custom profile A custom profile contains an empty node, which does not contain an

administrative console or servers. The typical use for a custom profile is tofederate its node to a deployment manager. After federating the node, use the

deployment manager to create a server or a cluster of servers within the node.

• Cell

A cell creates two profiles: a management profile with a deployment managerand an application server profile. The application server is federated to the cell ofthe deployment manager.

• Secure proxy (configuration-only)A secure proxy profile is for use with a DMZ secure proxy server. You cannot

start the secure proxy server on the Network Deployment installation. Thisconfiguration-only profile is intended only to be used to configure the profile

using the administrative console. After you configure the profile, you can export

the profile configuration and then import it into the secure proxy profile in yourDMZ.

In this exercise, create a stand-alone application server profile called profile1.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Select the Application server profile option and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. The Profile Creation Options panel allows you to choose a profile creationprocess to meet your needs. There are two options:

- Typical profile creation

The typical profile option creates a profile that uses default configurationsettings.

- Advanced profile creation

Through the advanced profile creation you are allowed to specify your ownvalues for settings or accept default values.

For this lab, click Advanced profile creation, as this will allow you to specify

your own values for settings. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. The Optional Application Deployment panel specifies what applications shouldbe deployed during profile creation.

For this lab, you want to deploy the administrative console and the default

application. Make sure both applications are checked, and click Next.

Information

In most cases, the administrative console will be required (in some productionenvironments, administrators use only wsadmin and therefore do not install the

administrative console). For these labs, the default application will be used for

demonstrative purposes.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. On the Profile Name and Location panel, provide a unique name and location fora profile.

- Change the Profile name from AppSrv01 to profile1

- Change the Profile directory from <profile_root>\Appsrv01 to <profile_root>\profile1

- Verify that Create the server using the development template isunchecked.

- Click Next.

__ g. The Node and Host Names panel allows you to set the node name, server name,

and host name. Default values will be filled in based on the detected host name

for your server.

Information

The form of the host name used (short or long) is not important, as both will work. What is

important is that you are consistent when creating profiles. When ensuring that port

7/21/2019 WAS V7.pdf


Student Exercises




numbers are unique, WebSphere considers was7host01 and was7host01.ibm.com to bedifferent machines and will therefore not ensure that each has unique ports.

Windows

For this course, the host name should be the machine short name (something similar to was7hostXX, where XX is a number such as 01, 02, 03). The node name will then begenerated as <short name>Node01 (that is, was7hostXXNode01).

Open a command-prompt window and use the hostname command to determine the host

name. Check with your instructor if you are unsure what the correct names should be.

On UNIX systems, the host name may be the long name (was7host01.ibm.com). Acceptwhatever the default is. Make sure that you are consistent in later exercises.Ma

Ensure that the Node name and Host name are correct (they should be based on the

short form of the host name and not localhost — for example, was7host01Node01). For

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Server name, keep the default name (short name for Windows and long name onUNIX). Click Next.

__ h. The Administrative Security panel specifies whether to use initial administrative

security. If selected, this panel specifies an initial administrative user ID and

password to be used for activities such as console access.

- Ensure that Enable administrative security is checked.

- For User name, enter: wasadmin

- For Password, enter: web1sphere

- For Confirm password, enter: web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




- Click Next to continue.

Information

A feature in WebSphere Application Server V7 includes the ability to turn on administrative

security during the creation of a profile. This requires the generation of a simple file-basedregistry.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. On the Security Certificate (Part 1) window, select Create a new default

personal certificate and click Next.

Note

The Issued to distinguished name and the Issued by distinguished name on the

Security Certificate (Part 2) panel will have a common name (cn) that is one of the followingvalues:

• IP address — such as 192.168.192.128

• Fully qualified domain name (FQDN) — such as was7host01.localdomain or was7host01.ibm.com

7/21/2019 WAS V7.pdf


Student Exercises




__ j. On the Security Certificate (Part 2) panel, accept the defaults. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ k. The Port Values Assignment panel provides the ability to specify which ports areto be used by the application server. Accept the defaults and click Next.

Information

The Profile Management Tool makes an effort to ensure that unique and unused ports are

recommended. But there are times when the administrator might need to manually setappropriate ports. Ports can also be reset after profile creation.

7/21/2019 WAS V7.pdf


Student Exercises




__ l. The Windows Service Definition panel appears next. This panel allows you tochoose a Windows service to run the application server. For this lab, the

application server will not be run as a Window service.

- Deselect the Run the application server process as a Windows service

box.

- Click Next.

Linux

There is a similar panel for the Linux install, which offers to run the application server

process as a Linux service. Accept the default to not run as a service, and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ m. The Web Server Definition panel appears next. This panel allows you to chooseto create a Web server definition within the cell or application server. For this lab,

the Web server will be added as a separate set.

- Ensure the Create a Web server definition box is not checked.

- Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ n. The Profile Creation Summary panel should be reviewed to verify theconfiguration values that will be used to create the profile. To create the profile,

click Create.

Creating the profile will take several minutes to complete.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ o. Once the profile creation successfully completes, the Profile Creation Completepanel appears. Ensure that the Launch the First steps console box is checked,

and click Finish.

7/21/2019 WAS V7.pdf


Student Exercises




__ p. The new profile will be shown in the profiles list. Close the Profile ManagementTool. Click File, and then click Exit.

Using the First steps console

The First steps console allows you to access the WebSphere Information Center (at the

IBM Web site), start or stop the server, and launch various tools. You can also migrateprevious WebSphere Application Server versions to WebSphere Application Server V7.

The First steps console that appears is associated with the application server profile,

profile1, which was just created. Each profile has its own First steps console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 1. To confirm that your server is installed and that it can start properly, click

Installation verification from the First steps console.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. The installation verification test tool runs and displays messages to indicate theverification status. Use the scroll bar to view all messages. At the bottom of the

message list, you should see the messages: IVTL0070I: The installation Verification Tool verification succeeded. IVTL0080I: The installation verification is complete.

__ b. Close the First steps output - Installation verification output window.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. From the First steps console click Administrative console. The administrativeconsole will be launched for profile1.

__ d. A certificate error window will appear. Click Continue to this website (not

recommended) to continue to the administrative console login window.

Information

Depending on the operating system and browser you are using, the security alert window

or certificate error window will look slightly different. For specific instructions to correct thecertificate error, see the optional section at the end of this lab.

On Linux, select Accept this certificate permanently and click OK. Then click OK again

to accept any additional warnings.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. Log in to the administrative console.

- For the User ID enter: wasadmin

- For the Password enter: web1sphere

- Click Log in.

Information

The user ID wasadmin was created during the profile creation process. It does not exist in

the operating system registry or some LDAP registry, but instead exists in a file-basedregistry within the application server configuration. Now that the profile is completely

created, the security can be reconfigured to use any desired registry.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. The main page for the WebSphere administrative console appears.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Verify that the DefaultApplication has been installed and is running.

__ a. Using the administrative console navigation tree, click Applications >

Application Types > WebSphere enterprise applications.

The application status for the DefaultApplication should appear as a green arrowto indicate that the application is running. If you place your cursor over the arrow,

a pop-up window should display Started.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Open another browser window and type in the following URL:

http://localhost:9080/snoop

This executes a servlet called snoop, which comes with the DefaultApplicationand brings up a page with information about the runtime environment of the

server. This page provides further confirmation that the application server is operatingcorrectly.

__ c. Close the snoop browser.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Close the administrative console by clicking Logout. The administrativeconsole will be examined more in later exercises. Close the browser.

__ 4. Exit from the First steps console.

__ 5. Exit from the Launchpad and click OK, when the confirmation to close message

appears.

Create a backup of profile1 using command line tools

Before continuing, create a backup of profile1 using the backupConfig command. The

backupConfig command is a utility to back up the configuration of your profile to a file. Youcan later restore this configuration if needed. When the backupConfig command runs, it

first stops the application server before creating the backup file.

__ 1. Run the backupConfig command.

__ a. Open a command-prompt window.

__ b. Change to the <profile_root>\profile1\bin directory.

__ c. Create the backup by entering the following command: backupConfig

Enter ./backupConfig.sh in the <profile_root>/profile1/bin directory.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. :As the backup process starts, you are challenged for a user ID and password.

- For User Identity, enter: wasadmin

- For User Password, enter: web1sphere

- Click OK.

Information

This security challenge is due to the fact that administrative security was enabled duringthe creation of the profile. As such, all administrative functions, including backups,

administrative console access, and wsadmin scripts, require authentication.

During the rest of the labs, enter the administrative user ID and password when prompted.The lab instructions do not always indicate this step.

__ e. Once the backup has completed, a message indicating the number of files

successfully backed up.

7/21/2019 WAS V7.pdf


Student Exercises




Information

By default, all servers on the node are stopped before the backup is made to prevent

partially synchronized information from being saved. The -nostop option can be used with

the backupConfig command to prevent the servers from being stopped before backing up

the configuration.

__ 2. The command creates a backup file called WebSphereConfig_ <date>.zip using

the current date and places the compressed file in the

<profile_root>\profile1\bin directory.

To distinguish between multiple backups, modify the name using something more

descriptive, such as the name of the profile.

__ a. Copy the backup file to another directory to safe keeping. Enter the followingcommand:

copy WebSphereConfig_<YYYY-MM-DD>.zip

<software_dir>\backups\backup_profile1.zip

On UNIX enter the following command:

cp WebSphereConfig_<YYYY-MM-DD>.zip

<software_dir>/backups/backup_profile1.zip

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

If you need to restore the configuration directory structure at a later time, you can use the

restoreConfig command. You will need to specify the name of the backup file.

The command restores the entire <profile_root>/<profilename>/config directory.

__ 3. Verify the application server has stopped by entering the following command:

serverStatus server1

7/21/2019 WAS V7.pdf


Student Exercises




Verify the application server has stopped by entering the following command:

./serverStatus.sh server1

Information

You can also run the serverStatus command with the -all option to give more detailson all application servers on the node.

Explore the WebSphere Application Server directory structure

Now that WebSphere Application Server is installed, look through the directory structureand review what you installed.

__ 1. Explore the WebSphere Application Server profile1 directory.

__ a. Using Windows Explorer, navigate to the directory <profile_root>\profile1.

__ 2. Review the subdirectories and their contents:

• bin — programs, scripts, and DLLs

• config — configuration files

• configuration — configuration settings

• consolepreferences —

• etc — dummy key ring, keytab files, plug-in keys

• firststeps — firststeps utility

• installableApps — applications that may be installed

• installedApps — applications installed in WebSphere Application Server

• installedConnectors — installed resource adapters

• installedFilters —

• logs — trace and log files

• properties — configuration property files used by WebSphere

• temp — temporary area for files created during JSP processing

• tranlog —

• wstemp — temporary area for events

Check installation log files

A number of log files are created during the installation and profile creation process. It is

useful to check these files to verify that the installation completed successfully.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 1. Change to the logs directory under the WebSphere Application Server installationdirectory.

__ a. Using WordPad, open log.txt located in the directory <was_root>\logs\install. This file records installation status messages.

On UNIX platforms, use an appropriate text editor instead of WordPad or Notepad.

Depending on your specific installation, some possibilities include gedit, vi, or emacs.

__ 2. Change to the manageprofiles directory under the WebSphere Application Server

logs directory.

__ a. Using WordPad, open profile1_create.log in the directory <was_root>\logs\manageprofiles. This log records creation events that

occurred when creating the profile, profile1. __ b. Look for the log message “INSTCONFSUCCESS: Success: Profile profile1

now exits.” to verify that profile1 was created successfully.

__ 3. Change to the logs directory under the WebSphere Application Server profile,

profile1, installation directory.

__ a. Navigate to the directory <profile_root>\profile1\logs.

__ b. Using WordPad, open backupConfig.log. This log records events that occur

when creating a backup of the configuration directory structure.

__ c. Using WordPad, open ivtClient.log. This logs results from the installationverification command.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Using WordPad, open AboutThisProfile.txt. This file logs information aboutthe profile, including the <profile_root>, the profile name, the node and host

names, and a number of the ports with which the profile was configured.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Start the WebSphere Application Server

Verify the installation by starting the WebSphere Application Server in profile1 and looking

at the log files.

__ 1. The log file, startServer.log, records the startup messages from the server. Thislog file is located in the WebSphere Application Server profile1 installation directory

<profile_root>\profile1\logs\server1. __ a. Navigate to the directory <profile_root>\profile1\logs\server1.

__ b. Open startServer.log using WordPad and examine the contents of the file.

7/21/2019 WAS V7.pdf


Student Exercises




Information

A tail utility can also be very helpful when looking at log files (tail is not part of the standard

Windows distribution). The tail utility makes it easier to monitor what is being activelywritten to a text-based log file.

The tail utility can be obtained from: http://sources.redhat.com/cygwin/

__ 2. Enter: tail startServer.log

This command will show the last few lines of the file startServer.log, where you willsee the startup messages from the server.

You can also use tail -f startServer.log which will continuously update your

panel when new messages are added to the file.

__ 3. To exit the tail utility, press Ctrl-C. This approach is more convenient than using a text editor; as text editors only show the

messages written to the file at a point in time, whereas the tail -f command displays thefile contents continuously as new entries are added..

__ 4. Delete all the log files in the directory <profile_root>\profile1\logs\server1.

When the server is started, new log files will be created. This step ensures that newlog files will be produced.

__ 5. If it is not already started, start the WebSphere Application Server in profile1.

__ a. In a command window, change to the <profile_root>\profile1\bin directoryand enter the command:

startServer server1

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

Enter the following command:

./startServer.sh server1

__ b. Verify the application server has started by entering the following command:

serverStatus server1 -username wasadmin -password web1sphere


./serverStatus.sh server1 -username wasadmin -password

web1sphere

Information

You can also run the serverStatus command with the -all option to provide more

details on all application servers on the node.

7/21/2019 WAS V7.pdf


Student Exercises




__ 6. After successful startup of the server, review the startServer.log file for successful

start messages.

__ a. Using Windows Explorer, navigate to the directory

<profile_root>\profile1\logs\server1.

__ b. Open startServer.log using WordPad and examine the contents of the file.

Look for the message “Server server1 open for e-business”, which

indicates the server is ready.

__ 7. Open the SystemErr.log file using Notepad. This log contains the standard output

from the Java virtual machine (JVM) running the application server. This file will

have numerous messages, but should not include any error messages if the server

has started correctly.

__ 8. Open the SystemOut.log file using Notepad. This log contains the standard output

from the Java virtual machine (JVM) running the application server. This file will

contain more detailed messages, indicating the steps performed during startup of

the server. Steps documented in the log include security initialization, messaging initialization,

registering resources in the JNDI namespace, EJB initialization, Web module

initialization, and HTTP transport initialization. The log also contains messages from

application System.out print line code.

Information

You may want to refer to the messages in the SystemOut.log or SystemErr.log again as

you use the server and perform more functions. It might be a good idea to keep a tail -f

on these files for the duration of the labs.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 9. Stop the WebSphere Application Server, profile1. You can provide the user nameand password on the command line or through the dialog box when prompted.

__ a. In a command window, change to the <profile_root>\profile1\bin directory

and enter the command:

stopServer server1


./stopServer.sh server1

__ b. Verify the application server has stopped by entering the following command:

serverStatus server1


./serverStatus.sh server1 -username wasadmin -password

web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




Correct the Web site security certificate error (optional)

When you first open the administrative console following installation, you may receive a

Web site security certificate error window. You can simply select the option to continue to

the Web site. However, to prevent an error window from appearing each time you access

the administrative console, you can install the Web site certificate.

The following steps will guide you through the process of correcting the Web site securitycertificate error for Internet Explorer V7.

If you are running on a UNIX operating system, there may be similar issues depending onthe browser being used. Feel free to skip the rest of this lab or attempt to resolve the issues

on your environment.

__ 1. If you have not already done so, click Continue to this website (notrecommended) from the Web site security certificate error window.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. The URL is shown in red, indicating a security certificate error. From the browserwindow, click Certificate Error.

__ 3. The Certificate Invalid window is shown, indicating that the security certificatepresented by the Web site has errors. Click View certificates, to begin the process

to correct the error.

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. The Certificate window appears. The certificate information indicates that the CAroot certificate cannot be verified up to a trusted certification authority. Click the

Certification Path tab to view.

Note

The Issued to and the Issued by certificate information will be one of the following values:


• Fully qualified domain name (FQDN) — such as was7host01.localdomain

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 5. From the Certification path, select the certificate that is in error. It will appear with ared error icon. Click View Certificate.

7/21/2019 WAS V7.pdf


Student Exercises




__ 6. The certificate information indicates that this CA root certificate is not trusted. Toenable trust, install this certificate in the Trusted Root Certification Authorities store.

Click Install Certificate.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 7. The Certificate Import Wizard Welcome window appears. Click Next.

__ 8. Accept the default to automatically select the certificate store based on the type ofcertificate. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ 9. When the certificate import has completed, click Finish.

__ 10. The Security Warning window appears. Note the IP address or fully qualified domainname (FQDN) that is shown (the example displays an IP address):

_______________________________.

__ 11. Click Yes to continue the certificate installation.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 12. A message window will appear to indicate that the import was successful. Click OK.

__ 13. Close any open certificate windows by clicking OK.

__ 14. From the browser window, click Certificate Error again.

__ 15. The Certificate Invalid window opens. Click View certificates.

__ 16. From the General tab of the Certificate window, notice that the CertificateInformation icon no longer has a red error icon associated with it.

7/21/2019 WAS V7.pdf


Student Exercises




__ 17. Click the Certification Path tab. The first certificate listed in the certification path nolonger has a red error icon associated with it.

__ 18. Click OK to close the Certificate window.

__ 19. Once the certificate has been installed, change the URL for the administrativeconsole using the IP address or fully qualified domain name that you noted earlier.

The certificate error message should now be resolved.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Exercise review and wrap-up

The first part of the exercise looked at the installation of WebSphere Application Server V7.The Profile Management Tool was also used to create an application server profile called

profile1.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 2. Installing IBM HTTP Server 2-1

5.2

Xempty Exercise 2. Installing IBM HTTP Server


In this lab exercise, you install the IBM HTTP Server and its plug-ins.

After installation, you start the product to ensure the IBM HTTP Serverwas installed successfully.



• Install IBM HTTP Server

• Verify and test the installation

• Examine the installed directories and files

• Map the default application to use the Web server

• Regenerate the plug-in configuration file

Introduction

A Windows administrator user ID has been created for you. Use this ID

to log in to Windows and to configure services and database access.



Linux

To log into the Linux machine, use the following:

• User ID: root


Information

Microsoft Windows passwords are case-sensitive.

7/21/2019 WAS V7.pdf


Student Exercises





Install IBM HTTP Server

Install the IBM HTTP Server and its plug-ins.

__ 1. Start the WebSphere Application Server Launchpad.

__ a. Navigate to <software_cds>\WAS7-supplemental_1\.

__ b. Double-click launchpad.exe to start the launchpad.

In a terminal window, navigate to <software_cds>/WAS7-supplemental_1/ and invoke ./launchpad.sh.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. On the Welcome panel click Launch the installation wizard for IBM HTTP Server to install IBM HTTP Server.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. The Welcome to IBM HTTP Server 7.0 panel for the installation appears. Click

Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click I accept both the IBM and the non-IBM terms to accept the licenseagreement. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. The installation process checks to ensure that system prerequisites are satisfied.When the check is complete, the System Prerequisites Check panel appears.

Verify that the message “Passed: Your operating system completed the

prerequisites check successfully.” appears on the panel. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. The installation location panel appears. Note the default installation directorylocation, but do not change it. Click Next.

In UNIX-based systems, the directory structures will be different. Refer to the appropriate

[Appendix] for the appropriate directory structures. The install wizard gives theappropriate default values for these directories.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. The Port Values Assignment panel identifies the port values used by the HTTPserver. Accept the default ports of 80 and 8008. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. The Windows Service Definition panel appears. In the lab, you want to specifythat the IBM HTTP Server is run as a Windows service.

This panel will not be there for UNIX systems. Continue to the next step.

- Ensure both check boxes are selected:

• Run IBM HTTP Server as a Window Service

• Run IBM HTTP Administration as a Windows Service

- Ensure that Administrator is entered for User name and enter web1spherefor Password. Ensure Automatic is selected as the startup type. You may

need to use the scroll bar to see Startup type. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ g. On the HTTP Administration Server Authentication panel, a user ID andpassword can be configured for the HTTP Server administration server. This ID

is used later to allow the WebSphere cell to administratively control the HTTPServer.

- Enter ihsadmin for the user ID.

- Enter web1sphere for the passwords.

- Click Next.

This next window only appears on UNIX systems. It allows you to create a local operating

system user ID that will be used to own the plug-in configuration files. This helps alleviatethe necessity of running the IBM HTTP Server administrative server as root.

1. Create a user ID to be used to run the IBM HTTP Server administration server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty 2. Select both Setup IBM HTTP administration server to administer IBM HTTP

Server and Create a unique user ID and group for IBM HTTP Server

administration. Enter ihs for both the User ID and Group. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ h. The IBM HTTP Server Plug-in for IBM WebSphere Application Server panelappears next. This panel allows the WebSphere plug-in to be installed silently

after the HTTP Server installation. In order to do this, the Web server definition and application server host nameneed to be specified.

- For Web server definition, enter webserverXX (where XX represents thenumber used in your host name, such as 01, 02, 03). Open acommand-prompt window and use the hostname command to determine the

number for the host name.

- For Host name accept the default. This should be in the form of was7hostXX

(where XX represents the number used in your machine short name, such as

01, 02, 03). On some systems, this may also have the DNS suffix, forexample, was7host01.ibm.com.

- Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. The Installation summary panel appears. Review the summary for correctness.Click Next to begin the installation.

The installation takes several minutes to complete.

7/21/2019 WAS V7.pdf


Student Exercises




__ j. Once the installation is complete, a panel appears indicating the installation wassuccessful. Click Finish to exit the installation wizard.

__ 3. Click Exit from the launchpad and click OK, when the confirmation to close

message appears.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Web server administration server

__ 1. Start the IBM HTTP Server and the IBM HTTP administration server.

In a UNIX environment, processes have to be checked and started using terminal

commands.

__ a. From a command line enter: ps -ef | grep httpd

__ b. If no httpd processes are running from the <ihs_root>, navigate to <ihs_root>/bin and execute: ./apachectl start

__ c. Start the administrative server using the ./adminctl start command.

__ a. Click Start > Settings > Control Panel.

__ b. Double-click Administrative Tools.

__ c. Double-click Services.

__ d. Look for the IBM HTTP Administration 7.0 and IBM HTTP Server 7.0 services.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. Right-click IBM HTTP Administration 7.0 and click Start.

__ f. Right-click IBM HTTP Server 7.0 and click Start.

__ g. Verify that both are running. The status for these should be Started.

__ 2. Check the status of the IBM HTTP Server using a browser.

__ a. Open a browser and enter the following URL: http://localhost

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. If the IBM HTTP Server is up and running, the default IBM HTTP Server windowwill appear.

7/21/2019 WAS V7.pdf


Student Exercises




Explore the IBM HTTP Server directory structure

Now that IBM HTTP Server is installed, look through the directory structure and review

what you installed.

__ 1. Explore the IBM HTTP Server directory.

__ a. Open Windows Explorer.

__ b. Navigate to the directory <ihs_root>\

__ 2. Review some of the subdirectories and their contents:

• bin — programs, scripts, and DLLs

• conf — configuration files

• logs — trace, error and log files

• Plugins — config, logs, properties, uninstall

• properties — messages, versions

Check installation log files A number of log files are created during the installation process. It is useful to check these

files to verify that the installation completed successfully.

__ 1. Change to the installation logs directory under the IBM HTTP Server installationdirectory.

__ a. Navigate to the directory <ihs_root>\logs\install

__ b. Using Notepad, open log.txt. This file records installation status messages.

On UNIX platforms, use an appropriate text editor instead of WordPad or Notepad.Depending on your specific installation, some possibilities include gedit, vi, or emacs.

__ c. Look for the log message “INSTCONFSUCCESS” at the end of the log to verify thatthe installation was successful.

__ 2. Change to the Plugins directory under the IBM HTTP Server directory.

__ a. Navigate to the directory <ihs_root>\Plugins\logs\install

__ b. Using Notepad, open log.txt. This log records WebSphere Application Server

plug-ins installation status messages.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Look for the log message “INSTCONFSUCCESS” to verify that the installation of theplug-ins was successful.

Review configuration and error files

Although there will be no further configuration required for this lab exercise, further

configuration of the IBM HTTP Server and administration server is possible through

configuration files located in the conf directory.

__ 1. Change to the configuration directory under the IBM HTTP Server installation

directory. __ a. Navigate to the directory <ihs_root>\conf.

__ b. Using Notepad, open httpd.conf. This file contains configuration data for the

IBM HTTP Server.

__ c. Scroll to the bottom of this file and notice the last two lines. They define themodule that will be loaded as the WebSphere plug-in and define the path to the

plugin-cfg.xml file.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Close the file when you are finished with your review.

__ e. Notice httpd.conf.default. This file contains the original configurationparameters. It can be copied, if you need to restore or use the original

configuration parameters.

__ f. Using Notepad, open admin.conf. This file contains configuration data for theadministration server. Close the file when you are finished with your review.

__ g. Notice admin.conf.default. This file contains the original configurationparameters. It can be copied, if you need to restore or use the original

administrative configuration parameters.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises




5.2


This exercise looked at the installation for IBM HTTP Server and the WebSphere plug-ins.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 3. WebSphere Information Center installation (optional) 3-1

5.2

Xempty Exercise 3. WebSphere Information Centerinstallation (optional)


In this exercise, you install the WebSphere Application Server

Information Center Help System.



• Install the WebSphere Information Center

• Navigate from the Welcome page

• Search for a topic in the Help Center

Introduction

In this optional exercise, you install the Help System. The IBM

WebSphere Help System is a viewer for displaying product or

application information developed as Eclipse documentation

plug-ins. The system provides a graphical user interface forbrowsing and searching online documentation.

If you have installed an IBM product whose documentation is

provided in the form of Eclipse plug-ins, the Help System is

probably already installed, in which case you do not need to do

this task. To confirm, search your file system for a directory

called eclipse\plugins.

The Help System compressed file has already been

downloaded and has been stored in the software directory.

Requirements

To perform this exercise, you must have the compressed

version of the Help System on the machine.

7/21/2019 WAS V7.pdf


Student Exercises





Install the Help System

Begin by extracting the contents of the file that has been downloaded. This file contains theEclipse-based framework for running the Help System. The contents of the help system are

called plug-ins. Those will be installed in a few steps.

Information

The Help System can be installed on any system; it does not require WebSphere to be on

the same system. Even though the latest version of the information center is availableonline, it is often useful to have a local copy installed for times when network access is

limited.

__ 1. Using Windows Explorer, navigate to <software_cds>\HelpSystem and examinethe contents of this folder. Look for the file IBM_Help_301_Win.zip.

Linux

Navigate to <software_cds>/HelpSystem and look for IBM_Help_301_Linux_Intel.zip.

Information

This file was downloaded from the following IBM WebSphere Web site:

http://www.alphaworks.ibm.com/tech/iehs/download

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. Extract the contents of the file IBM_Help_301_Win.zip to the <software_cds>\HelpSystem directory.

Expand the appropriate compressed file to <software_cds>/HelpSystem. For example,

on Linux use: unzip IBM_Help_301_Linux_Intel.zip

.

__ a. Right-click and select Extract All.

The Windows extraction wizard will open.

__ b. From the welcome pane, click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. You will be prompted for a destination to extract the files to. Enter directory <software_cds>\HelpSystem and click Next.

__ d. Click Finish when the extraction is complete.

__ 3. Explore the <software_cds>\HelpSystem directory.

__ a. Change to the <software_cds>\HelpSystem\IBM_Help_301_Win\ibm_help

directory. There should be several .bat files along with an eclipse subdirectory.

Explore the <software_cds>/HelpSystem/ibm_help directory.

Start the Help System

The Help System uses a browser to view its contents; however, network access is not

required since all the files will be loaded from your local machine. __ 1. Start the Help System.

Navigate to the ibm_help directory. Execute the following command to ensure that thescripts are executable:

chmod +x *.sh

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Run the ./help_start.sh script. You should have gotten an error saying basically java:command not found. That is because there is no system JRE available at this time.

__ a. Using a command-prompt window, navigate to the

HelpSystem\IBM_Help_301_Win\ibm_help directory.

__ b. Run the help_start.bat script (an error is expected).

__ c. You should have gotten an error saying basically that 'java' is not arecognized command. That is because there is no system JRE available at this

time.

__ d. Using your favorite text editor, edit the help_start.bat (or help_start.sh onUNIX systems).

Information

Instead of editing the scripts to explicitly point to a specific java, you could also install a

system JRE or add an existing JRE to your path.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. Modify the first line to add a fully qualified path to the WebSphere ApplicationServer provided JRE. So, instead of the line starting with java, it would start

with: <was_root>\java\bin\java

__ f. Save and exit the file.

Since java may not be on the system path, change the reference to java in the second

line of the script to a fully qualified path. Replace java

with: <was_root>

/java/bin/java

__ g. Make this change to the help_end script as well.

__ h. Execute the help_start script again.

Depending on your UNIX configuration, the Help System might still not start. The issue isthat the help_start.sh script attempts to bring up a Mozilla browser. If Mozilla is not

available, it attempts to bring up a Konqueror browser (available on SUSE). If neitherbrowser is available, the Help System returns an error message indicating that acompatible browser is not available.

To get around this issue, there are a number of possible solutions. Three suggestedsolutions are described below. For these labs, the first solution is suggested.

• Edit the preferences.ini file for the Help System to specify your system’s

browser. The file is found in the following directory:

ibm_help/eclipse/plugins/org.eclipse.help.base_3.0.1

The name of the field to change is called custom_browser_path. Assuming thatyour browser is Firefox, the update line should look like this:

custom_browser_path=firefox %1

With that change made, the help_start script will now use Firefox instead of

Mozilla or Konqueror as the browser of choice.

• Create a symlink for Mozilla to your browser. Assuming your system has

Firefox and it exists in /usr/bin, issue the following command:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty ln -s /usr/bin/firefox /usr/bin/mozilla

After the symlink is created, the help_start system will work properly. Note :depending on your specific browser, additional symlinks may be needed.

• Instead of using the help_start script, run the IC_start script. This starts the

help system on a well known port, but does not attempt to bring up a browser.You can then bring up your own browser and point it to:

http://<machine>:8888/help/index.jsp

The advantage of this approach is that it is not specific to a particular browser. Itcan also be accessed from any system on your network (while maintaining only a

single copy). The disadvantage is that there are a few features that are notsupported with the IC_start, such as the bookmarks.

__ 2. The Help System automatically appears. The Help System contains all static HTML

files and will work with most browsers, including Internet Explorer, Firefox, andNetscape Communicator.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. The Help System Welcome page is displayed.

Information

In order to use the Help System, the start script needs to be run first. Just having the URLis not sufficient.

__ 4. Explore the documentation. You can use the browser’s Back button to return to the

previously visited pages.

Searching the Help System

The Help System includes a search facility that can be used. You can also find out moreinformation about the search facility.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 1. On the left is a navigation frame containing a hierarchical view of topics. In the leftpane double-click Viewing information in the help system to expand this folder

and view the available topics.

A number of topics are listed. Select Searching in the Help System.

__ 2. Select the other options in the left pane to get more information on using the Help

System.

On the right is the main frame showing the selected document.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Execute a search.

__ a. Enter bookmarks in the Search field and click GO.

Information

The first search will cause the contents to be indexed.

__ b. Click the first search result entry to read the article.

__ 4. To return to the table of contents after running a search, click the Contents tab at

the bottom left of the navigation pane.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Stopping the Help System

When closing the Help System browser, the Help System process continues to run in the

background. You must stop the Help System processes when you install documentationplug-ins or update the Help System with new plug-ins.

__ 1. Stop the Help System.

__ a. Using Windows Explorer, open the ibm_help folder.

__ b. Execute the help_end.bat script.

Navigate to the ibm_help directory and run the ./help_end.sh script.

Installing and using documentation plug-ins

The Help System works with any information that has been packaged as an Eclipsedocumentation plug-in, including IBM product documentation plug-ins. IBM documentation

plug-ins are easily identified because they use a common directory-naming convention(com.ibm.xxx.doc).

Information

The Network Deployment plug-in has already been downloaded for the class. The plug-ins

can be downloaded from the following location by clicking the link that lists the plug-in of

interest: http://www.ibm.com/software/webservers/appserv/library/

__ 2. The plug-ins you will work with have already been downloaded to the lab image.

Navigate to the <software_cds>\HelpSystem directory.

__ 3. Extract the plug-in files from:

7/21/2019 WAS V7.pdf


Student Exercises




• com.ibm.websphere.nd.doc.zip

• com.ibm.websphere.ihs.doc.zip

• com.ibm.websphere.edge.doc.zip

Navigate to the <software_cds>\HelpSystem directory. Expand the compressed files to

the <software_cds>/HelpSystem/ibm_help/eclipse/plugins directory.

unzip <filename.zip> -d ibm_help/eclipse/plugins.

__ a. Right-click com.ibm.websphere.nd.doc.zip and select Extract All.

The Windows extraction wizard opens and prompts you for the location to extract

the files to.

__ b. When prompted to select a destination, enter the directory

<software_cds>\HelpSystem\IBM_Help_301_Win\ibm_help\eclipse\plugins and click Next.

__ c. When the extraction is complete, click Finish.

__ d. Repeat the above steps and extract the contents of:

• com.ibm.websphere.ihs.doc.zip

• com.ibm.websphere.edge.doc.zip

__ e. The extracted files added to the plugins directory include:

• com.ibm.business.doc

• com.ibm.etools.ejbbatchdeploy.doc_3.1.2

• com.ibm.etools.wrd.freeform.doc_3.1.2

• com.ibm.websphere.edge.doc_7.0.0

• com.ibm.websphere.help.glossarydoc_6.2.0

• com.ibm.websphere.home.doc_1.0.0

• com.ibm.websphere.ihs.doc_7.0.0

• com.ibm.websphere.installation.factory.doc_7.0.0

• com.ibm.websphere.installation.nd.doc_7.0.0

• com.ibm.websphere.migration.nd.doc_7.0.0

• com.ibm.websphere.nd.doc_7.0.0

• com.ibm.websphere.pmc.nd.doc_7.0.0

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty • com.ibm.websphere.wim.doc

__ 4. Start the WebSphere Help System.

__ a. Double-click the help_start.bat file in the ibm_help folder.

Navigate to the ibm_help directory and run the ./help_start.sh script.

7/21/2019 WAS V7.pdf


Student Exercises




Notice in the navigation frame the documentation is available for bothWebSphere Application Server Network Deployment and IBM HTTP Server.

__ 5. Click Network Deployment (Distributed platforms and Windows), Version 7.0

and view the details of the table of contents.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. Search the Help System.

Information

The first search creates an index, and will therefore take a bit of time. Future searches do

not require additional indexing..

__ a. In the search area enter install log file and hit return or click GO. A list ofsearch results are displayed. Select the first entry from the Search Results.

7/21/2019 WAS V7.pdf


Student Exercises




__ 7. In order to see where in the hierarchy this particular page lies, click the Show in

Table of Contents button in the top right section of the page.

Information

Going to the Table of Contents view can often be very helpful. If the search result yielded

an approximate answer, browsing the documents in the same general area can helpnarrow things down to a more desirable outcome.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 8. Bookmark this page for later use.

__ a. Click the Bookmark Document button in the top right section of the page.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Select the Bookmarks tab at the bottom of the Contents pane. This returns alisting of your bookmarks.

__ 9. Click the Contents button and continue to explore the information center

documentation plug-ins.

Information

When more than one plug-in is loaded into the help system, it is possible to narrow thesearch area down to specific plug-ins or areas of plug-ins. This can be done by clicking the

Search scope link and following the instructions on the subsequent screens.

__ 10. Stop the Help System.

__ a. Using Windows Explorer, open the ibm_help folder and run the help_end.bat script.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

Navigate to the ibm_help directory and run the ./help_end.sh script.

Information

It is also possible to run the help system as a remote information center. This means that

the Help System is installed and maintained on a single local system. Then any browser onyour intranet can remotely access the Help System through the URL:

http://<hostname>:8888/help/index.jsp

To start the Help System as a local information center, run the IC_start script. Like the help_start and help_end scripts, you may need to modify the IC scripts to explicitly

point to java.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises




Exercise review and wrap-up

This exercise installed the offline Help System documentation and demonstrated some

navigation techniques.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 4. Exploring the WebSphere Application Server 4-1

5.2

Xempty Exercise 4. Exploring the WebSphere ApplicationServer administrative console


In this exercise, you explore WebSphere Application Server V7 using

the administrative console. You examine the configuration structure,and navigate within the WebSphere administrative console, which is

used to perform server configuration, to gain knowledge and becomefamiliar with what is available.


At the end of the exercise, you should be able to:

• Verify that WebSphere Application Server has started

• Launch the administrative console

• Explore the navigation and functions of the administrative console

• Use the administrative console to examine configuration

information, resources, and properties

Introduction

In this exercise, you explore the WebSphere Application Server V7

configuration. Exploration includes starting the server and browsingthrough some of the configuration files. You will also start and navigate

around the WebSphere administrative console.

The application server should already be installed and tested, and youshould be able to successfully start the server.

The application server runs as a single JVM including all shared

services and the containers to run applications.The WebSphere administrative console provides a graphical view of

the configuration and includes forms and wizards to make it easier to

perform configuration tasks.

7/21/2019 WAS V7.pdf


Student Exercises




Requirements

To perform this exercise, you must have a working server andWebSphere administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Exercise instructions

Start the server

Before you can configure the application server environment, you must start all therequired processes. For this exercise you use profile1 on server1.

__ 1. Determine how many JVMs are running on your system.

Execute the command ps -ef | grep java to show the running Java processes.

__ a. Bring up the Task Manager by pressing Ctrl-Alt-Delete.

__ b. Select the Processes tab and you see all the processes which are currently

running. Sort the process list by name. __ c. Take note of how many java.exe programs are running. There should be none,

unless you left the server running in an earlier exercise.

__ d. Click the Mem Usage column heading to sort by memory usage. This ensuresthe larger processes (such as JVMs) are listed at the top.

__ e. Minimize the Task Manager until later, when you look at it again after you start

your server.

__ 2. Start the server.

__ a. In a command-prompt window, navigate to <profile_root>\profile1\bin. __ b. Enter the startServer server1 command to start the server.

Navigate to <profile_root>/profile1/bin and enter: ./startServer.sh server1

7/21/2019 WAS V7.pdf


Student Exercises




__ c. After a successful startup of the server you should see the message “Serverserver1 open for e-business”, which indicates the server is ready.

Information

If you have problems starting the server, look at the startServer.log in the

<profile_root>\profile1\logs\server1 directory.

__ 3. Restore the Task Manager window and you see that some additional processeshave been started. One of those is a JVM (java.exe) for the application server,

server1.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

You can verify that the Java process is associated with the application server by comparing

process IDs. To add the process ID column to the Task Manager window, Click View >

Select Columns... and select PID (Process Identifier). Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




Explore configuration files

Examine some of the configuration files for the WebSphere Application Server.

__ 1. Explore the configuration directory structure and view some of the configuration

files.

__ a. Navigate to <profile_root>\profile1\config

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. A few important files contained in the config directory are:

• <cell> is the cell name • <node> is the node name

• <server> is the server name

- Cell-wide resources config\cells\<cell>\resources.xml

- Node-specific resources config\cells\<cell>\nodes\<node>\resources.xml

- Server-specific resources such as JDBC and JMS providers config\cells\<cell>\nodes\<node>\servers\<server>\resources.xml

- Global security settings config\cells\<cell>\security.xml

- Virtual hosts config\cells\<cell>\virtualhosts.xml

- Applications and endpoints for a node config\cells\<cell>\nodes\<node>\serverindex.xml

- Configuration of a server config\cells\<cell>\nodes\<node>\servers\<server>\server.xml

Information

You should not edit these XML files manually; instead you should use the administrative

console or wsadmin command line tool to make configuration changes that affect thesefiles.

__ 2. Examine the Simple Object Access Protocol (SOAP) client configuration file

<profile_root> \profile1\properties\soap.client.props.

__ a. Navigate to: <profile_root>\profile1\properties

__ b. Open soap.client.props in an editor.

This file contains security configuration information used by clients such as wsadminto authenticate with the security service. Important parameters are:

• loginUserid and loginPassword — the ID and password must bespecified using these parameters if loginSource=properties

7/21/2019 WAS V7.pdf


Student Exercises




• loginSource — specifies how the authentication information is obtained.The default is prompt, which means the user is prompted for a user ID

and password.

__ 3. Close any editor windows still open.

Start the administrative consoleThe administrative console is the graphical user interface for managing WebSphereApplication Server configuration settings for servers, applications, and other resources.

The administrative console is a browser-based Web application that uses HTML andJavaScript.

Information

In a federated cell you always use the administrative console connected to the deploymentmanager so that changes are synchronized across the cell. In a stand-alone application

server, you connect directly to the administrative console on the server.

__ 1. Open the administrative console.

__ a. In a Windows environment: Start > Programs > IBM WebSphere > Application

Server Network Deployment V7.0 > Profiles > profile1 > Administrative

console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Another option is to open a browser and specify the address:

http://localhost:9060/ibm/console

Although some versions of UNIX provide a shortcut to the console, entering the URL into a

browser is the most consistent.

The administrative console should open:

__ 2. Enter wasadmin for the User ID and web1sphere for the Password. Click Log in.

7/21/2019 WAS V7.pdf


Student Exercises




Information

If security is enabled, as it is on your machine at the moment, you must log in using a valid

user ID and password. If administrative security was disabled, the user ID you enter herewould not matter, as it is just used to track configuration changes.

A workspace is saved for each user, which includes unsaved configuration changes andnavigation preferences.

The administrative console displays in three frames:

• Banner — this area is the top of the administrative console. It shows a welcome

message for the user ID you logged into the administrative console. It displays

links for logging out of the administrative console and accessing product

information.

• Navigation tree — this area is the left frame of the administrative console. Itdisplays the types of information you can configure. There are 13 areas:

• Guided activities • Security • Troubleshooting • Servers • Environment • Service integration • Applications • System administration • UDDI • Services • Users and groups

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty There is also a Welcome link, which takes you back to the main work area home

page.

• Work area — this area is the right frame of the administrative console. It displays

the pages to create or change configuration information.

The home page displayed in the work area shows the product version installed.

Explore the navigation tree

The administrative console navigation tree lists the tasks available in the administrativeconsole. Tasks are grouped into organizational nodes that represent categories of tasks.

__ 1. View the categories of tasks in the navigation tree. When you click a task in the

navigation tree, a page is displayed in the work area containing one or moremodules for completing the task.

Use the View drop-down list at the top of the navigation tree to modify the lists oftasks according to your preferences.

__ 2. Click the View drop-down list in the navigation tree.

You can organize the tasks as follows:

• Resources • Monitoring and tuning

7/21/2019 WAS V7.pdf


Student Exercises




- All tasks — this shows all tasks in the administrative console.

- My tasks — this shows only the tasks that you have added to the view. Thislist is initially empty, but provides a link to the My Tasks module.

- WebSphere Application Server — this shows only the tasks for this

particular product, WebSphere Application Server.

__ 3. Using My tasks allows you to create and edit a list of tasks to view in the navigationtree. My tasks is especially useful to customize the navigation to show only the tasksyou use most often.

__ a. Select My tasks from the drop-down list in View.

__ b. There are no tasks currently selected. Click Add tasks to add a task to the view.

__ c. The work area shows the tasks that you can select to customize the My tasks

view in the navigation tree.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Check the boxes for Servers, Applications, and Resources. Click Apply.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. After applying your selections, your customized task list is displayed in thenavigation tree.

__ f. Continue to explore and customize the My tasks view and add additional tasks.

__ g. When completed, click Deselect All to remove all tasks. Click Apply.

__ h. Select All tasks from the View drop-down list.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Explore guided activities

In this part of the exercise, you look at the guided activities for WebSphere Application

Server V7. Guided activities lead you through common administrative tasks that requireyou to visit multiple administrative console pages.

__ 1. In the administrative console navigation tree, expand Guided Activities.

In the stand-alone environment the guided activities include:

- Connecting to a database

- Routing requests through a Web server to an application server

Information

In the federated environment the guided activities include:

- Connecting to a database

- Routing requests through a Web server to an application server- Configuring a cluster and making applications highly available

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Click Connecting to a database to view the first activity.

The work area has information about the activity to help you perform this tasksuccessfully. It contains an introduction to the task, details other tasks to do

before and after performing this task, as well as hints and tips to help you avoidand recover from problems and other tasks.

__ b. Continue to explore the details for connecting to a database or select anotherguided activity to explore.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Explore server settings

In this part of the exercise, you look at some of the settings that can be configured using

the administrative console, beginning with servers.

__ 1. In the administrative console navigation tree, expand Servers and Server Types.

In the stand-alone environment the only server types are:

- WebSphere application servers - WebSphere MQ servers

- Web servers

Information

In the federated environment you can also manage:

- Generic servers

- Proxy servers

- Version 5 JMS servers - Clusters

- Cluster topology

- Generic server clusters

- Core groups

__ 2. Click WebSphere application servers.

In the work area a table listing the application servers will be displayed. You should

have one server, server1.

This page is known as a collection page because it displays a collection of objects.The page has two options for controlling the amount of information displayed, Filter

and Preferences.

7/21/2019 WAS V7.pdf


Student Exercises




Information

For some other collection pages, an additional option, Scope, is presented. An example of

scope will be shown later.

__ 3. Click the Filter icon.

The filter feature allows you to use wildcards to match only the objects you want towork with if there are many objects of the same type. You can select a table columnand specify the text to match.

Information

This option rarely needs to be used unless there are a lot of items.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 4. Click server1.

The configuration of server1 is displayed. This page is known as a details page.Notice there are two tabbed pages:

- Runtime Runtime lists the current information used by the running server.

- Configuration Configuration lists the saved settings that are used when the server is nextstarted.

Some basic configuration settings are shown under General Properties, includingthe Classloader policy and the Class loading mode.

7/21/2019 WAS V7.pdf


Student Exercises




For a description of any of the settings click More information about this page inthe Help box.

__ 5. Under Server Infrastructure click to expand Java and Process Management.

Click Process definition.

Use this page to view or change settings for a process definition. This page provides

command-line information for starting or initializing a process.Note that the Working directory entry starts with a $, such as

${USER_INSTALL_ROOT}. These are called WebSphere variables. They allow forsubstitutions to the absolute paths using symbolic names. You explore these later in

this exercise.

__ 6. Click Java Virtual Machine under Additional Properties.

The advanced JVM settings for server1 are displayed. Scroll down and examine thesettings. Use the Help box to get default values for these settings.

- What is the value of Maximum heap size? _______________

- Is Debug Mode enabled? _______________

- Is the JIT (Just-In-Time compiler) enabled? _______________

__ 7. Click Cancel to return to the Process Definition page.

__ 8. Click Process Logs under Additional Properties.

The process log settings for server1 are displayed. These are the native stdout andstderr log files for the JVM process.

Note

These are different from the SystemOut.log and SystemErr.log files, which capture mostoutput from the JVM, and support log file rotation to prevent the files from growing too

large.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 9. At the top of the page, notice there is a breadcrumb trail showing the pages youhave visited.

__ 10. Click server1 from the breadcrumb trail to return to the server1 configuration page.

7/21/2019 WAS V7.pdf


Student Exercises




__ 11. Under Communications expand Ports. The TCP/IP ports used by server1 arelisted.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 12. Click the Details link to get additional information on these ports.

7/21/2019 WAS V7.pdf


Student Exercises




__ 13. Click SOAP_CONNECTOR_ADDRESS to configure the port.

The host and port associated with the SOAP listener are displayed under the Portcolumn. This is used by SOAP clients, such as the wsadmin command, to connect

to the server to perform administration tasks. For a single server installation thedefault SOAP port is 8880.

__ 14. Click server1 in the breadcrumb trail to return to the server1 details page.

__ 15. Under Server Infrastructure, expand Administration. Click Server Components.

The internal components of server1 are listed. The resources that you canadminister are Name Server and Application Server.

__ 16. Click Name Server.

The name service settings for the application server are displayed.

__ 17. Click server1 in the breadcrumb trail to return to the server1 details page.

__ 18. Click the Runtime tab.

The properties of the currently running instance of server1 are displayed:

- Process ID (PID). Record your process ID: _________

- Cell name

- Node name

- State (which should be: Started)

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 19. Restore the Task Manager window, and verify that the process ID shown matchesthe PID for the java.exe process in the Processes list.

Issue ps -ef | grep <PID> from a terminal command prompt.

7/21/2019 WAS V7.pdf


Student Exercises




Information

If the process ID is not shown, click View from the menu and click PID (Process

Identifier). Click OK. The PID column will be shown.

__ 20. Minimize Task Manager when you have completed your review.

Examine application settings

__ 1. In the administrative console navigation tree, expand Applications and then

expand Application Types.

There are three application types:

- WebSphere enterprise applications

- Business-level applications

- Assets

__ 2. Click WebSphere enterprise applications.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty A collection page lists the applications in the configuration and their status. If youmove the mouse cursor over a status icon and click, a window opens and displays

the status.

The applications installed by default include:

- DefaultApplication — includes the snoop servlet

- ivtApp — installation verification test

- query — for information on Enterprise JavaBeans

- If the sample applications were installed, they would also be listed here.

At the moment you only have one server, but potentially the list could include

applications installed on multiple servers on the same computer or in a networkdeployment cell.

Information

Tasks that can be performed on an application include:

__ 3. Click DefaultApplication

This page shows the general properties of the application with links to a number of

additional properties pages such as Details, Web Module, and Enterprise JavaBean

Properties. It also shows a References page.

• Start • Rollout Update • Stop • Remove File • Install • Export

• Uninstall • Export DDL • Update • Export File

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. Under Modules, click Manage Modules.

You should see one Web module, Default Web Application; one EJB module,Increment EJB module; and the servers that they are associated with.

__ 5. Click the Default Web Application module.

A detail page shows the general properties associated with the deployment of the

Web module. __ 6. Click Manage Modules in the breadcrumb trail and select the Increment EJB

module.

A detail page shows the general properties associated with the deployment of theEJB module.

Examine environment settings

__ 1. In the administrative console’s navigation tree, expand Environment. The

Environment options:- Virtual Hosts

- Update global Web server plug-in configuration

- WebSphere Variables

- Shared Libraries

- Replication Domains

- Naming

__ 2. Click Virtual Hosts.

In the work area a collection page lists the virtual hosts defined for the cell.

__ 3. Click default_host.

A details page shows the details for the virtual host. You can only directly changethe virtual host name. Under Additional Properties you find links to other properties

pages.

__ 4. Click Host Aliases under Additional Properties.

The host name and port combinations associated with this virtual host are displayed.For default_host the default values are:

• *:9080 (any host on the internal HTTP transport port)

• *:80 (any host on the external HTTP transport port) • *:9443 (any host on the internal SSL transport port)

• *:5060 (any host on the SIP transport port)

• *:5061 (any host on the SIP transport port)

• *:443 (any host on the external SSL transport port).

In some cases you may need to define additional virtual hosts or modifydefault_host to support additional host-port combinations.

__ 5. Click default_host in the breadcrumb trail to return to the default_host page.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. Click MIME Types under Additional Properties.

The MIME types associated with this virtual host are listed.

__ 7. Click Virtual Hosts in the breadcrumb trail to return to the Virtual Hosts page.

__ 8. Click admin_host and then click Host Aliases.

__ 9. Examine the admin_host virtual host and write down the port numbers associated

with this virtual host: _________________________

Note

The browser should be accessing the administrative console on one of the ports

associated with the admin_host virtual host.

__ 10. In the administrative console’s navigation tree, click WebSphere variables.

In the work area a WebSphere variables collection page is displayed. This pageincludes the scope feature, because variables can be defined for a cell, node, or

server. A drop-down list of all available scopes is provided to narrow the list ofvariables based on scope.

__ 11. From the scope drop-down list, select scope Cell=<cellname> . How many variablesare defined for the cell? _______

__ 12. From the scope drop-down list, select scope Node=<nodename> . How many

variables are defined for the node? ________

If there are more than the maximum rows (20 by default), a Next button is displayed

to allow you to see the additional entries.

7/21/2019 WAS V7.pdf


Student Exercises




Notice that many variable values include references to other variables, for example,${USER_INSTALL_ROOT}.

__ 13. From the scope drop-down list, select scope Node=<nodename> ,

Server=<servername> . How many variables are defined for the server? ________

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Examine resource settings

__ 1. In the administrative console navigation tree, expand Resources. The resources

options are:

- Schedulers

- Object pool managers

- JMS - JDBC

- Resource adapters

- Asynchronous beans

- Cache instances

- Mail

- URL

- Resource environment.

__ 2. Expand JDBC; click JDBC providers.

A collection page lists the JDBC providers in the configuration. In a later exerciseyou configure a JDBC driver and data source for an application.

__ 3. Expand JMS and click JMS providers. Click an instance of Default messaging

provider.

A details page shows some basic properties of the internal JMS provider. UnderAdditional Properties there are links for:

- Connection factories (for configuring a JMS connection factory)

- Queue connection factories

- Topic connection factories

- Queues - Topics

- Activation specifications.

These settings can be defined at the cell, node, or server level so there is a scope

selection option available.

A collection page lists queue connection factories (if there are any defined). A queueconnection factory is used to create connections to the associated JMS provider of

JMS queue destinations, for point-to-point messaging.

A collection page lists topic connection factories (if there are any defined). A topic

connection factory is used to create connections to the associated JMS provider ofJMS topic destinations, for publish/subscribe messaging.

Information

In future lab exercises you modify settings for some of the object types you have already

explored and for other areas you have not yet explored.

7/21/2019 WAS V7.pdf


Student Exercises




Examine troubleshooting

The Troubleshooting area displays messages about runtime events and configuration

problems. This area automatically refreshes and you can view either the runtime messagesor configurations problems totals.

__ 1. In the administrative console’s navigation tree, expand Troubleshooting.

__ 2. Expand Runtime Messages. You see entries for:

- Runtime error

- Runtime warning - Runtime information

The total number of errors, warnings, and information messages will be displayedwhen you select one of the options. Click Runtime information to view all of the

messages.

__ 3. In the Message column, click one of the messages (if there are any listed) to see themessage detail.

__ 4. In the navigation tree, expand Configuration Validation under Troubleshooting.

You see entries for:

- Configuration error

- Configuration warning

- Configuration information

The total number of errors, warnings, and information messages will be displayedwhen you select one of the options. Click Configuration error to view all of the error

messages. If you do not have any error messages, click the Configuration

information messages. __ 5. If you have a configuration problem, click the link to it. The problem detail is

displayed.

On the next window you should see general properties information about theconfiguration problem.

__ 6. Click the Back button to return to the Configuration Validation list and view other

problems, if any exist.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Modify the administrative console session timeout

When you are working with the administrative console, the session will expire if it has been

idle for more than 30 minutes. In order to continue working, you will have to log in again.Many administrators find the default session idle duration too short. You can change the

session idle duration to a time that works best for you. The session idle duration timecannot be modified from the administrative console. The timeout must be modified by

executing a script.

Information

The administrative console session expiration script that you will use in this exercise can be

found in the information center by searching for “changing the console sessionexpiration”.

__ 1. Open the sample administrative console session expiration script. __ a. Navigate to <software_dir>\wsadmin\.

__ b. Open timeout.jacl using a text editor.

__ 2. Modify the timeout expiration fields.

__ a. The invalidationTimeout field must be modified with the time that you want tospecify for the session idle duration timeout. There are two locations where this

field is specified in the script. Both instances must be changed.

__ b. Replace <timeout_value> with 120 for both instances of the invalidTimeoutparameter.

__ c. Save the file.

__ 3. Run the script to change the session expiration.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. From the command line run the timeout.jacl script using wsadmin from the <profile_root>\profile1\bin directory: wsadmin -f <software_dir>\wsadmin\timeout.jacl -username

wasadmin -password web1sphere

In a command window, navigate to <profile_root>/profile1/bin and execute thefollowing command:

./wsadmin.sh -f <software_dir>/wsadmin/timeout.jacl -username wasadmin

-password web1sphere

__ b. The session expiration timeout is now set for 120 minutes.

Information

The timeout session expiration must be set for each profile administrative console. Later in

the class you will be creating additional profiles. You will have to rerun the timeout script foreach profile that you want to change the session timeout.

Note

The wsadmin tool can be used to run scripts. You will learn more about wsadmin later in the

course.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Log out of the administrative console

When you are working in the administrative console, a work area is saved which includes

all configuration changes you make in the session. When you log out you have the optionto save or discard these changes. If you just close the browser, the session work area will

be preserved. The next time you log in you have the option to recover the work area fromthe previous session.

Information

Any configuration changes that you want to keep must be saved to the masterconfiguration; otherwise the new settings are not used.

__ 1. Click Logout at the top of the page in the taskbar.

__ 2. If you have not made any changes to resources, you are returned to the login page.

If changes were made, the Save page is displayed. Click Discard so that you do notoverwrite the configuration.

The Discard WorkSpace Changes page appears asking you to confirm the discard.Click Yes and the login page is displayed.

__ 3. Close the browser.

You now generally know your way around the WebSphere administrative console.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises





This exercise examined many of the features of the administrative console. You looked atthe properties of servers, applications, environment settings, and resources.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 5. Assembling an application 5-1

5.2

Xempty Exercise 5. Assembling an application


This exercise covers the steps necessary to assemble the EnterpriseJavaBeans (EJB) Java archive (.jar) files, the Web archive (.war) files,

and auxiliary files that combine an enterprise application into anenterprise archive (EAR) file that can be deployed to a Java EE 5

compliant application server. The assembly and deploy tool is used tocomplete this exercise.



• Navigate the Assembly and Deploy tool

• Import and examine enterprise application components

• Define the following application-scoped resources:

- Data source

- Authentication alias

• Export an enhanced EAR file that is ready for deployment

Introduction

In this exercise, you perform the role of the application assembler.

Assume that the development groups have created and tested theapplication in their test environment. Those responsible for bean

development have provided you with the .jar files that contain the codefor the Enterprise JavaBeans. The developers responsible for the

presentation design have given you the .war files that contain theHTML pages, JSPs, and servlets. It is now your task to take these

pieces and assemble them into an EAR file that can be installed in theWebSphere Application Server.

7/21/2019 WAS V7.pdf


Student Exercises




You will be using files provided by the application developers. The

application is made up of:

• One EJB module .jar file that contains the session beans anddeployment descriptors

• One Web module .war file that contains the servlets, JSPs, andpresentation (HTML and graphics) files along with a deployment

descriptor

In some cases, you might also be given a resource adapter archivemodule .rar or utility JAR files. For this exercise, however, there are no

resource adapter archive modules or utility JAR files to be installed.

Requirements

To complete this exercise, you need the Rational assembly and deploy

tool installed on your machine. This tool will be used to complete theexercise. You also need the following files, located in

<software_dir>\Assemble:

• TradeWeb.war

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty • TradeEJB.jar

As the assembly and deploy tool is currently only available for Windows and Linux, this

exercise cannot be completed in other operating systems.

7/21/2019 WAS V7.pdf


Student Exercises





Start the assembly and deploy tool

__ 1. Click Start > Programs > IBM Software Delivery Platform > IBM Rational

Application Developer 7.5 > IBM Rational Application Developer in Windows.

Linux

Start the assembly and deploy by navigating to /opt/IBM/SDP and invoking: ./eclipse &

The assembly and deploy tool starts by asking you which directory to use for itsworkspace. Once you establish a workspace, you continue to use it for the project.

Each project should have its own separate workspace.

__ 2. Enter <software_dir>\Assemble\TradeApp and click OK.

Linux

In the Workspace input area type /usr/software/Assemble/TradeApp

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty After a few moments the Welcome screen for the assembly and deploy tool opens.From the Welcome screen you can get an overview of the product or find out what is

new in this release by selecting the icons.

__ 3. Close the Welcome view inside of the assembly and deploy tool by clicking the X to

the right of its title, or simply click the Workbench icon. Do not close the assemblyand deploy tool.

__ 4. You should be in the Java EE perspective to begin assembling the application. This

is the default perspective and is indicated by the title of the workbench.

__ 5. The Enterprise Explorer view shows all the modules currently loaded in theworkspace (none at this time). The modules are categorized by the function they

perform. As you add modules, they will appear under their corresponding folders.

The empty area on the upper middle part of the window is where the different editorsopen and display the contents of the selected items on the other views. This area is

called the editor pane.

Below the editor pane is a multipurpose pane, containing several views. One of theviews in the multipurpose pane is the Problems view, which should be in the

foreground of the multipurpose pane. It contains any outstanding errors that need to

7/21/2019 WAS V7.pdf


Student Exercises




be resolved. This space is shared with several other views represented by the tabsat the top of the pane. You will get to use some of them in this exercise.

Create a new enterprise application project

__ 1. Create a new enterprise application project named TradeApplication.

__ a. Select the File > New > Enterprise Application Project. __ b. Name the project: TradeApplication

Information

Since this is a new workspace, there are no servers defined. An installed server needs tobe defined in the workspace so its runtime libraries will be added to new projects created in

the workspace. Also the selected Target Runtime defines where applications will bedeployed to, when asking assembly and deploy to run an application on a server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Click the New button to the right of Target Runtime to define a new server.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Select IBM > WebSphere Application Server v7.0. Click Next.

__ e. Click Browse for the Installation directory.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. Navigate to the <was_root> folder and click OK.

__ g. Click Finish.

7/21/2019 WAS V7.pdf


Student Exercises




__ h. Make sure that the Project name is still set to TradeApplication. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. Check Generate Deployment Descriptor. Click Finish.

__ j. The TradeApplication project is now found in the Enterprise Explorer.

7/21/2019 WAS V7.pdf


Student Exercises




Import the Trade application modules

In your case you have been given a set of modules, .war and .jar files, by development.

These modules need to be assembled into a running application.

Information

Handing over individual application modules is the most common way to receiveapplication components, especially when more than one development team is involved,each team being responsible for one or more modules. Another way to hand over an

application for deployment is to receive an enterprise application’s EAR file.

Add the Trade EJB module

You now define the EJB module that is used by the application. The EJB .jar file for this

application has been given to you by the application developer, and it is namedTradeEJB.jar. The JAR file contains the deployed code for the Enterprise JavaBeans. This

JAR file was created using IBM Rational Application Developer.

__ 1. From the menu, select File > Import.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. From the Import dialog select EJB JAR file and click Next.

__ 3. In the Import dialog click Browse and navigate to <software_dir> \Assemble,

select TradeEJB.jar, and click Open.

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. Ensure Add project to an EAR is checked and TradeApplication is showing in theEAR Project Name drop-down list.

Information

Notice that the Target runtime for the TradeApplication is set to WebSphere Application

Server v7.0. This value was inherited from the enterprise application, as all modules in an

application run under the same server runtime.

__ 5. Click Finish to add the EJB JAR to the application. This may take some time tobuild.

__ 6. Note that there are many warnings that appear on the Problems view.

These are caused by code or by declaring variables that are never used. You may just ignore them, or if you prefer, you may hide these entries using the Preferences

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty dialog. From the menu, select Window > Preferences. Expand Java > Compiler

and select Errors/Warnings.

Change the following setting from warning to ignore:

• Potential programming problems:

- Serializable class without serialVersionUID

• Unnecessary code: - Local variable is never read

- Unused imports

- Unused local or private member

• Generic types:

- Unchecked generic type operation

- Usage of a raw type

7/21/2019 WAS V7.pdf


Student Exercises




- Unused local or private member

__ a. Click Apply. Click Yes to rebuild the workspace. Click OK.

__ 7. The TradeEJB.jar file has been added to the application. Expand the module toreveal the details of its contents.

Information

Double-clicking a module (the second entry) on the Enterprise Explorer view opens its

deployment descriptor (if one has been created) in a specialized editor. Deployment

descriptor editors have tabs along the bottom of the pane to give you access to the various

sections of the file. Using these editors makes working with deployment descriptors much

easier.

If you change anything on a deployment descriptor, or any other file, you will see an

asterisk on the tab where its name is displayed along the top of the editor pane. This

indicates that the file has been altered and needs to be saved. Do not save any changes

you make, and close the EJB deployment descriptor in the editor.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Add the Web module

Next you add the Web module used by the application. The file for the Web module was

assembled by the presentation developer using IBM Rational Application Developer. AWeb module consists of the JSPs, HTML pages, and servlets contained within the .war file.

__ 1. From the menu, select File > Import.

__ 2. In the Import dialog select WAR file and click Next.

__ 3. In the Import dialog click Browse, navigate to <software_dir> \Assemble, andselect TradeWeb.war. Click Open.

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. Ensure Add project to an EAR is checked and TradeApplication is showing in theEAR Project Name drop-down list.

__ a. Click Finish to add the TradeWeb module to the TradeApplication enterprise

application.

__ b. Click No in the dialog that asks if you wish to change to the Web perspective.

__ c. Verify that the Web module has been added in the Enterprise Explorer.

__ d. At this point there may be errors showing on the Problems view.

If there are errors in the TradeWeb module after importing the WAR file, they arelikely to be unresolved references. It is always a good practice to resolve all

errors and to investigate any warnings you may see in the Problems view.

The next step will resolve the existing errors. __ 5. The TradeWeb module needs to know that some of the classes it refers to are

defined in other modules, namely, the TradeEJB modules. This module should

already have been added to the TradeWeb module’s Java EE moduledependencies.

__ a. In the Enterprise Explorer view select TradeWeb, and from its context menu

(right-click to get the context menu) select Properties.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Select Java EE Module Dependencies. Verify that in Available dependentJARs, Allow both is selected and TradeEJB.jar is checked. Click Apply.

TradeEJB.jar can now be seen in the list of libraries under TradeWeb > Java

Resources > Libraries > EAR Libraries.

Note

If this still does not clear the errors, perform step b above, first unchecking and then

rechecking TradeEJB.jar; and click Apply. This seems to force a new validation in thetooling. The errors now should no longer appear in the Problems view.

__ 6. Change the context root of the Web module to: Trade/web

__ a. The properties dialog for TradeWeb should still be open. Select Web Project

Settings.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Change the Context Root by typing: Trade/web

Ensure that you type the context root correctly, as it is case-sensitive. Click OK.

__ c. You have now added the Web and EJB modules to the TradeApplication. You

can see these modules in the Enterprise Explorer by expanding

TradeApplication > TradeApplication > Modules.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Add a test server

Earlier you specified that the target runtime environment is WebSphere Application Server

V7. Now you add a WebSphere Application Server V7 that can be used to test theapplication if one does not already exist.

__ 1. Right-click in the empty Servers view; then select New > Server from the pop-up

menu.

__ 2. In the Define a New Server dialog accept the default options. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




Linux

Click Add next to Server runtime environment. In the subsequent WebSphere Runtime dialog specify: Name: WebSphere Application Server V7.0 Installation directory: /opt/IBM/WebSphere/Appserver

Click Finish.

__ 3. Type the password web1sphere in the WebSphere Server Settings dialog. Click

Finish.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 4. WebSphere Application Server v7.0 should now appear in the Servers view.

Information

Creating the WebSphere Application Server v7.0 in the Servers view allows you to test

your application on an existing instance of the WebSphere runtime directly from theassembly and deploy workbench. You can easily install enterprise applications from the

context menu by right-clicking WebSphere Application Server v7.0 and selecting Add

and Remove Projects from the pop-up menu.

You are not going to run through a test at this stage, as there is some additional

configuration of the environment that still needs to be performed, and you will be testing theTradeApplication in a later exercise.

7/21/2019 WAS V7.pdf


Student Exercises




Configure WebSphere data sources

You can define certain resources that are included with the application in the WebSphereApplication Server Deployment editor. Any resources defined on this page are defined atthe application scope. This approach is valuable in a development or test environment, butis not considered a good approach when releasing applications into a productionenvironment.

Although the steps that follow create application scoped resources, they will not be used in

the labs that follow. This section is here to merely demonstrate how these resources couldbe added.

Information

In order to work with application scoped resources in the WebSphere administrativeconsole, you need to select the application containing the resources and then under

Resources select Application scoped resources.

In this section you define a JDBC provider and the data source required by the Trade

application. Both of these resources are defined at the application scope and visible only tothe TradeApplication.

__ 1. Open the Server Deployment view.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Right-click TradeApplication; then select Java EE > Open WebSphere

Application Server Deployment.

__ 2. Remove the existing Derby JDBC provider, as it is not used by the application.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Select Derby JDBC Provider (XA) in the JDBC provider list and click Remove.The JDBC provider list will now be empty. Deleting the provider also deletes the

data sources that use it.

__ 3. Create a new J2C authentication data entry.

__ a. Scroll to the bottom of the editor page and expand Authentication. Click Add.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Add a new alias with the following properties:

Add a new alias with the following properties:

__ c. Click OK.

__ d. You now see that the TradeApp authentication alias is added to the JAASauthentication list.

__ 4. Create a JDBC provider for DB2.

Table 4: J2C authentication data

Field name Value

Alias TradeApp

User ID db2admin

Password web1sphere

Description Authentication for Trade Application

Table 5: UNIX J2C authentication data

Field name Value

Alias TradeApp

User ID db2inst

Password was1edu

Description Authentication for Trade Application

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Scroll to the top of the editor; then click Add next to the JDBC provider list.

__ b. In the Create JDBC Provider window, select IBM DB2 as the Database type.

Select DB2 Universal JDBC Driver Provider (XA) as the JDBC provider type.

__ c. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. In the next window specify Trade for the name of the provider.

__ e. Click Finish.

__ f. Verify that Trade has been added to the JDBC provider list.

__ 5. Next create the data source.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Click Add to create a data source.

__ b. In the Create Data Source window select DB2 Universal JDBC Driver Provider

(XA) as the JDBC provider. Make sure that the Version 5.0 data source optionis selected. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. On the next page enter the properties of the data source. Enter the followinginformation in the fields as provided. Leave default values for all other fields.

.

Table 6: Data Source data

Field name Value

Name Trade

JNDI name jdbc/tradeds

Description Trade Datasource

Component-managed authentication aliasFrom the drop-down list

select: TradeApp

Use this data source in container-managed

persistence (CMP)Checked

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Click Next.

__ e. Set the following fields according to the table below:

The settings for UNIX:

__ f. Click Finish.

Table 7: Data source database details

Field name Value

databaseName TRADE

driverType 4

serverName dbhost

portNumber 50000

Field name Value

databaseName TRADE

driverType 4

serverName dbhostportNumber 50001

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. Save your changes. From the main menu select File > Save (or press Ctrl-S). Closethe WebSphere Application Server Deployment editor.

Information

These resource settings are saved within the EAR file in files under the

META-INF\ibmconfig folder. These files are not part of the Java EE 5 specification but arerecognized by WebSphere Application Server V7. The enterprise archive containing thesefiles is called an enhanced EAR file.

7/21/2019 WAS V7.pdf


Student Exercises




Export the enterprise archive (EAR) file

Save the file in the <profile_root>\profile1\installableApps directory.

__ 1. Export the TradeApplication EAR file.

__ a. In the Enterprise Explorer view on the upper left pane, right-click

TradeApplication > Export > EAR file.

__ b. In the Export dialog, click Browse and navigate to the folder

<profile_root>\profile1\installableApps.

__ c. In the Destination field, change the name of the EAR file to:enhancedTradeApplication.ear

__ d. Uncheck Optimize for a specific server runtime.

__ e. Click Save.

__ 2. Click Finish to export the EAR file.

__ 3. Verify that the EAR file was saved successfully. __ 4. Exit assembly and deploy.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2


In this exercise, the assembly and deploy Toolkit was opened and used to assemble themodules for the Trade Application Case Study application into an enterprise archive. You

will test the application in a later exercise.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 6. Installing an application 6-1

5.2

Xempty Exercise 6. Installing an application


This exercise covers the tasks used to install two WebSphereenterprise applications in WebSphere Application Server, using the

administrative console. The TradeApplication and the QuoteWSapplications, both packaged as enhanced EAR files, are installed on

the server.



• Install an application using the administrative console

• Test the application using a Web browser

Introduction

In this exercise, you install the TradeApplication enterprise archive(EAR) file that was assembled using the assembly and deploy tool.

The EAR file contains all the application modules, and also contains

the definition of other resources required by the application.The second application, contained in the QuoteWS.ear file, also

contains application scoped resources that will be used duringinstallation.

The applications are tested by accessing them from a Web browser.

Requirements

To perform this exercise, you must have WebSphere Application

Server installed on the machine and a working application server withan administrative console. In addition, you will need a Web browserand DB2 installed, and the Trade application case study databases

created and populated.

You also need the TradeApplication.ear and the QuoteWS.ear files.

7/21/2019 WAS V7.pdf


Student Exercises





Start the server and the administrative console

Use the WebSphere Application Server administrative console to install the Tradeapplication. Since the administrative console is a system application running on the server,

the server has to be up and running before the console is started. __ 1. Start WebSphere Application Server if it is not already running.

__ a. The server can be started from the <was_root>/bin directory. When using the<was_root> directory, the profile name must also be specified. In a

command-prompt window, navigate to <was_root>\bin.

__ b. Enter the startServer server1 -profileName profile1 command.

__ c. The server has started when a message similar to the following appears:

Server server1 open for e-business; process id is 2136

Note that the process id is a unique number, which represents the serverprocess that is running on the system.

Information

The server can be started without the use of the profile name if you issue the startServer

server1 command from the <profile_root>\<profile_name>\bin directory.

Navigate to the <was_root>/bin directory and enter the ./startServer.sh server1-profileName profile1 command.

The server can be started without the use of the profile name if you issue the

./startServer.sh server1 command from the <profile_root>/<profile_name>/bindirectory.

Also verify that DB2 has started on your system. This can be done by simply executing the

following command in a terminal window:

ps -ef | grep db2inst1

If there are no DB2 processes, make sure to manually start DB2 at this point (and again ifyou system restarts). Execute the following commands in a terminal window:

su - db2inst1

db2start

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. Open the WebSphere administrative console.

__ a. In a Web browser, specify the address http://localhost:9060/ibm/console At this point, if you see a security alert or warning from the Web browser, click

OK or the link to continue to the Web site.

__ b. Enter wasadmin for the user ID and web1sphere for the password, and clickLogin.

Create J2C authentication aliases

Most system resources need to be able to authenticate to some kind of authentication

registry. In the case of data sources you need to be able to authenticate to the databaseserver, which in this case is set up to use the local OS user registry.

__ 1. Create a new authentication alias named TradeApp.

__ a. From the WebSphere administrative console, expand Security and click Global

security.

__ b. Under Authentication on the right, expand Java Authentication and

Authorization Service.

__ c. Click J2C authentication data.

__ d. Click New.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. In the General Properties area, enter the following values:

In the General Properties area, enter the following values:

Table 8: J2C details

Field Value

Alias TradeApp

User ID db2admin

Password web1sphere

Description For Trade data sources

Table 9: UNIX J2C details

Field Value

Alias TradeApp

User ID db2inst1

Password was1edu

Description For Trade data sources

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. Click OK. Note that the alias was created but the name is not exactly as you defined. The

wizard adds the node name in front of the alias name you entered.

__ g. Click the Save link to save your changes.

__ 2. Edit the hosts file on your machine to map dbhost to the machine where thedatabase server is running; in this case 127.0.0.1. The hosts file can be found in

the \Windows\system32\drivers\etc folder.

In UNIX, edit /etc/hosts and enter the following values.

127.0.0.1 localhost dbhost quote.trade.com

Linux

On SUSE Linux, it is common to define the host name on a separate line mapped to the IP

address 127.0.0.2. However, this causes problems for the networking that WebSphere

needs to do. Aside from adding the definitions for dbhost and quote.trade.com to 127.0.0.1,you will also need to modify the line starting with 127.0.0.2.

Using a text editor, edit the /etc/hosts file:

7/21/2019 WAS V7.pdf


Student Exercises




__ a. In a command window, find your system IP address for eth0 by entering thefollowing command:

ifconfig

Note

If the IP address changes during the course, the hosts file will need to be updated.

__ b. Edit the /etc/hosts file. Find the line that starts with 127.0.0.2 and comment

it out by adding a # symbol as the first character of the line.

__ c. Add a new line just below the one that was just commented out, and start it withthe system IP address you looked up using ifconfig. The rest of the line should

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty have the host names (long and short versions) that appear on the commentedout line just above.

e

__ 3. While you have the hosts file open, also map quote.trade.com to the same IPaddress; it is used to access the Web service that provides local stock quotes and

7/21/2019 WAS V7.pdf


Student Exercises




also runs on your local server. Also, ensure that the machine name (something like was7hostXX) is mapped to the same IP address.

Linux

Do not add your machine name to the 127.0.0.1 line.

__ 4. Save and close the hosts file.

Create a JDBC provider and data sources for the Trade application

If there are any resources used by the application that are not defined in the EAR file, you

have to define them using the administrative console. In this section, you create the datasources used by the Trade application.

Information

In general, it is considered a best practice to ignore, or remove, application scoped

resources from enhanced EAR files when installing applications in a productionenvironment.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty In this step of the exercise, you create the data source required by the Trade application.You also create the JDBC provider under which the data source exists.

__ 1. Create the Trade data source.

__ a. From the administrative console expand Resources > JDBC > Data sources.

__ b. Select the Node=was7hostXXNode01 scope and click New.

__ c. Enter Trade for the data source name. This name is just a label and can beanything you like. Enter jdbc/tradeds for the JNDI name. This must be the

7/21/2019 WAS V7.pdf


Student Exercises




same name that is used by the application and must be unique in theenvironment. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyNote

If there are any existing JDBC providers, you will see the following screen as Step 2 in the

wizard. Select Create new JDBC provider, and click Next. Otherwise, you will go directlyto Step 2.1 Create new JDBC provider, in the wizard.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Select the values on the table below in the Create new JDBC provider page.

__ e. Keep all remaining defaults and click Next.

Table 10: JDBC details

Field Value

Database type DB2

Provider type DB2 Universal JDBC Driver Provider

Implementation type XA data source

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. On the next page, you define where in the file system the JDBC provider will findthe JDBC drivers. In this case the location is defined as: <db2_root>\java Enter this value in both directory locations fields.

Check the appropriate appendix for the correct value of <db2_root>/java.

Information

The paths pointing to the JDBC drivers are actually entered by the wizard into the

WebSphere environment variables named: DB2UNIVERSAL_JDBC_DRIVER_PATH andDB2UNIVERSAL_JDBC_DRIVER_NATIVEPATH. If these variables had been set before this step,

7/21/2019 WAS V7.pdf


Student Exercises




their values would have prefilled the entry fields. Anything entered here will overwrite theenvironment variables.

__ g. Click Next.

__ h. Now you should be back in the data source definition part of the wizard and

ready to define the database specific properties. Enter the following parameterson the page:

Enter the following parameters for the UNIX data source:

Table 11: Data source details

Field Value

Driver type 4

Database name TRADE

Server name dbhost

Port number 50000

Table 12: UNIX data source details

Field Value

Driver type 4

Database name TRADE

Server name dbhost

Port number 50001

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

__ i. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ j. On the next page, select was7hostXXNode01/TradeApp for the

Component-managed authentication alias, and click Next.

__ k. On the next page, verify all the values entered, and click Finish to create thedata source and JDBC provider.

__ l. Save your changes.

__ 2. Create another data source as described in the previous steps

__ a. Enter Quote for the data source name and jdbc/quoteds for the JNDI name.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. In Step 2 of Create a data source, select the JDBC provider you just createdfrom the drop-down menu. Click Next.

__ c. Enter the following values in Step 3: Enter database specific properties for

the data source, and click Next.

Table 13: Quote Data source details

Field Value

Driver type 4

Database name QUOTE

Server name dbhost

Port number 50000

7/21/2019 WAS V7.pdf


Student Exercises




For UNIX systems:

__ d. Select was7hostXXNode01/TradeApp for the Component-managed

authentication alias, and click Next.

__ e. Click Finish.

__ f. Save your changes. __ 3. Test the data source connections.

__ a. On the Data Sources page, select the check boxes for Quote and Trade, andclick the Test connection button.

__ b. Make sure the connection was successful. Look for the “successful” messages

at the top of the work area.

Table 14:

Field Value

Driver type 4

Database name QUOTE

Server name dbhost

Port number 50001

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Install the QuoteWS enterprise application

The QuoteWS application provides local stock quotes and acts as a Web services provider.

The enhancedQuoteWS.ear file is an enhanced EAR file that contains definitions of otherresources required by the application.

The QuoteWS application provides local stock quotes by accessing the requested stock

symbol from the QUOTE database and returning the price of the stock. The QuoteWScomes into play when the user decides that he or she does not want Internet quotes. This

is done through the account preferences of each registered user. It also comes into play ifthe user has requested an Internet quote, but the external Web service is not available. In

that case, after the external Web service fails, the application tries to retrieve the price ofthe same symbol by accessing the local Web service provided by QuoteWS.

Since you are using the resources already defined in the EAR file, installing the

enhancedQuoteWS.ear file is simple and straightforward.

__ 1. Install the enhancedQuoteWS.ear.

__ a. From the administrative console expand Applications and click Newapplication.

__ b. Click New Enterprise Application.

__ c. Select Local file system and click Browse.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Navigate to <software_dir>\EarsAndWars, select the enhancedQuoteWS.ear file, and click Open. Click Next.

__ e. Select Fast Path - Prompt only when additional information is required, andclick Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. On the next page, you can select any additional installation options. Make surethat Process embedded configuration is selected.

Information

If an EAR file is enhanced, the Process embedded configuration check box will be

selected by default. If you want to ignore the application-scoped resources, you will need todeselect the Process embedded configuration option.

__ g. Accept the default values and click the Summary link.

__ h. Click Finish to complete the installation.

__ i. Save the changes.

7/21/2019 WAS V7.pdf


Student Exercises




__ 2. Start the QuoteWS application.

__ a. Expand Applications > Application Types, and select WebSphere enterprise

applications. Verify that the QuoteWS application is listed.

__ b. Select the check box next to QuoteWS and click Start.

__ 3. Verify the application scoped resources.

__ a. After the application starts, click the QuoteWS link.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Under References, click Application scoped resources.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. In addition to the Quote data source that you created earlier in this exercise, youshould also see a data source for an EJB timer service.

__ d. Click Quote to see additional details.

Install the TradeApplication enterprise application

The Trade application is packaged in an enhanced EAR file that contains a definition of the

resources required by the application. However, these resources will not be used wheninstalling the application. It is considered a best practice not to include application scoped

resources when installing applications to the production environment. When installing theTrade application, you will choose to ignore all application scoped resources.

__ 1. Install the TradeApplication.ear. __ a. Expand Applications > New Application, and select New Enterprise

Application.

__ b. In the Preparing for application installation page, select Local file system

and click Browse.

__ c. Navigate to the <software_dir>\EarsAndWars directory, select the

TradeApplication.ear, and click Open. The Local file system field should nowcontain the path of the EAR file.

Note

You can use the EAR file that you created in the previous exercise if you want. However, inthis exercise, you are going to ignore any embedded enhancements in the EAR file.

__ d. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. The next page gives you the option to generate default bindings and mappings.At this time you will not be changing any bindings. Select Detailed - Show me

all installation options and parameters. Click Next.

The server expands the EAR file in memory. Depending on the system, thiscould take a little while.

The next page shows Select installation options. Scroll down the page, and

notice that there are many steps to complete. You can complete each step in turnand click Next to navigate to the next step, or you can jump directly to a step by

clicking its link.

__ f. Select the check box to Precompile JavaServer Pages files and make surethat Process embedded configuration is not selected.

Information

Precompiling JSP pages takes more time to complete, but is a good option to select whentesting. This way you can ensure all JSPs will compile. In production, this is a way to

reduce the response time for the first request of a JSP. Notice that there is also an option todeploy Enterprise JavaBeans. This option regenerates deploy code for the Enterprise

JavaBeans in the enterprise application. The developer already deployed the EnterpriseJavaBeans in IBM Rational Application Developer before it was exported, so this step is not

necessary.

The Process embedded configuration will not be checked by default because the EARfile does not contain any enhancements. If you choose to use the EAR file that was

exported in a previous lab, you will need to uncheck this option.

7/21/2019 WAS V7.pdf


Student Exercises




__ g. Click Next.

__ h. You can now proceed through the various steps by clicking Next, and acceptingthe defaults. Or go directly to the Summary.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. Click the Summary link, and click Finish.

__ j. Save the changes.

Start the Trade application

__ 1. Start the TradeApplication.

__ a. Click Applications > Application Types > WebSphere enterpriseapplications.

__ b. Select the check box next to the TradeApplication.

__ c. Click Start.

Test the enterprise application

Test the application by accessing it via the WebSphere Application Server’s HTTP

transport.

__ 1. Access and log in to the TradeApplication.

__ a. Open a new Web browser, and access the TradeApplication by entering thefollowing address: http://localhost:9080/Trade/web

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Click Login. The Trade login page (login.jsp) is displayed.

__ c. Log in to the application. Enter client for the User and web1sphere for the

password. Click Login.

__ d. The Account information page should be displayed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty From this page you can get a stock quote, update account information, view yourholdings, buy and sell stocks, and view transaction history pages. You can also

log out, and navigate to the Administration and Welcome pages.

Warning

At this time, do not select the option to Broadcast transaction data as the server is notyet configured to perform this function and will fail if attempted.

__ e. Select the information icon, or “circle i” icon at various points in the application toaccess additional information for the purpose of education or troubleshooting.

The information icons appear throughout the application. Selecting an iconshows background information as to how the application performs a particular

function. A pop-up window will appear with information for that icon.

__ f. Close the information window.

7/21/2019 WAS V7.pdf


Student Exercises




__ g. On the Account Information page select IBM from the drop-down list and click

Get Quote.

Information

Depending on which browser is being used, a page refresh may be needed to see theupdate symbol list.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

__ h. Close the quote pop-up window. Feel free to obtain additional quotes.

7/21/2019 WAS V7.pdf


Student Exercises




__ 2. Click the Buy and Sell tab. Feel free to buy and sell stock. Notice that as you buyand sell, your balance changes accordingly and also your holdings reflect your

actions.

__ 3. Select the Holdings tab. The Holdings page shows what stocks are currently inyour portfolio. It also displays your total equity.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 4. Select the Transaction History tab. This page lists all transactions since youregistered.

__ 5. Experiment with all features of the application to verify that all pages and functions

work. You may also log out, register a new user, and verify all functions.

__ 6. Log out of the application.

__ 7. Log out of the administrative console and close the Web browser.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises





The first part of the exercise looked at installing two applications using the administrativeconsole. After installation of the QuoteWS and Trade applications, the applications were

started and tested.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 7. Problem determination 7-1

5.2

Xempty Exercise 7. Problem determination


This lab illustrates how to view and configure log and trace files. In thisexercise you use WebSphere various troubleshooting tools including

Diagnostic Tracing, Log Analyzer, and the IBM Support Assistant.



• Use the administrative console to view log data

• Find and view log files

• Enable tracing on an application server

• Use memory leak and hang detection tools

• Use the IBM Support Assistant

Introduction

In this lab, you locate and view log files for the WebSphere Application

Server. You use a text editor to view the log files and use the LogAnalyzer tool to view logs and trace files. Students also learn how toenable tracing for an application server by using the administrative

console. You also install the IBM Support Assistant and tools providedto diagnose problems.

Requirements

To perform this exercise, you must have a working WebSphereApplication Server server1, administrative console, and a running

Default application and Trade application installed on profile1.

7/21/2019 WAS V7.pdf


Student Exercises





Preface

You can use any text editor to view most log files. Unless the instructions tell you

differently, close the editor window after you examine each file.

Part 1: Working with log files of the application server

__ 1. Verify that server1 is running.

__ a. Navigate to the <profile_root>\profile1\bin folder and execute the serverStatus server1 -username wasadmin -password web1sphere

command.

__ b. If server1 is not running, execute the startServer server1 command to startthe application server.

Use a terminal window:

__ a. Navigate to <profile_root>/profile1/bin

__ b. At the prompt, enter: ./serverStatus.sh server1 -user wasadmin-password web1sphere

__ c. If the server is not running, enter: ./startServer.sh server1.

Information

If the server has already been started, you will be challenged to provide a user ID andpassword when executing serverStatus commands. Enter wasadmin for the user ID and

web1sphere for the password.

__ 2. You can change the location, name, and other settings of log files using the

administrative console.

__ a. Launch the administrative console.

__ b. Click YES to proceed if you get a Security Alert.

__ c. Log in. Enter wasadmin for the user ID and web1sphere for the password.

__ d. In the navigation tree, select Troubleshooting > Logs and trace. In the pane onthe right, click server1.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

You can also reach the configuration area for Logging and Tracing by selecting Servers >

WebSphere application servers > server1. Click Logging and Tracing under theTroubleshooting section.

__ 3. Change the number of historical files and set the maximum size of the log file forSystem.out. The number of historical files grows from zero to the value of the

maximum number of historical files field. The next rollover deletes the oldesthistorical file.

__ a. Select JVM Logs.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. You can view and modify settings from the Logging and Tracing window forSystem.out and System.err logs.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Under General Properties for System.out set the Maximum Size to 3 MB andthe Maximum Number of Historical Log Files to 2.

__ d. Click OK.

__ e. Save the changes to the master configuration.

__ 4. View SystemOut.log and SystemErr.log for server1 using the administrativeconsole.

__ a. Select Troubleshooting > Logging and Tracing > server1 > JVM Logs and

select the Runtime tab.

__ b. Click View to the right of the File Name field for System.out.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. The default is to retrieve 250 lines in one step. You can specify the range of linesto be retrieved at the top of the Logging and Tracing window.

__ d. Retrieve lines 250 to 400 by typing 250-400 and click Refresh.

Information

You can also navigate to the <profile_root>\profile1\logs\server1 folder to view the logsusing a text editor. This is usually preferable since you can use the search features of your

text editor.

__ 5. Configure the IBM service logs using the administrative console. Unlike the JVM

logs, the IBM service logs cannot be viewed within the administrative console. Youhave to use a tool such as the Log Analyzer, which you will work with later in this

exercise.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Select Troubleshooting > Logs and trace > server1 > IBM Service Logs.

__ b. Verify that Enable service log is checked. Notice that you can disable theservice log by clearing the box, but this is not recommend by IBM Support.

Information

To find the value for $(LOG_ROOT), you can look to Environment > WebSphere

Variables. The name of the service log is activity.log, but this can be changed along with its

location in the file system. Maximum file size can be set, and you can enable or disable acorrelation ID.You can use the correlation ID to correlate activity to a particular client

request.You can also use it to correlate activities on multiple application servers, ifapplicable.

__ c. Click OK. __ d. Save changes.

__ e. Log out of the administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




Part 2: Using the Log Analyzer for viewing service and JVM logs

The Log Analyzer can be downloaded and run in the IBM Support Assistant. The Log

Analyzer allows you to import log files, trace logs, and activity logs. A number of views areprovided for log analysis. It also has the ability to combine several log files into a single unit

for analysis.

The log files can be analyzed against a symptom database of known error conditions andmessage text strings. You can use this tool to import the IBM service log and to analyze the

record entries to assist in problem determination.

Look at the analysis results when provided, to try to find where or why problems areoccurring. You can also apply filters to look at specific record types or records that contain

certain values.

__ 1. Open up the IBM Support Assistant and launch the Log Analyzer tool.

__ a. Double-click the ISA shortcut on you desktop and wait for the IBM SupportAssistant to open. If the ISA shortcut is not available, use Windows Explorer to

navigate to C:\Program Files\IBM\IBM Support Assistant\rcp and double-clickrpclauncher.exe.

Linux

Open a terminal window and navigate to /opt/ibm/IBMSupportAssistant/rcp. LaunchISA by entering the following command:

./rcplauncher

__ b. On the Welcome page click the Analyze Problem activity.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Click the Tools tab.

__ d. You will see a catalog of tools that have been downloaded to the ISA. Select

(highlight) Log Analyzer.

__ e. Click the Launch button and wait for the Log Analyzer tool to open.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. When the Log Analyzer opens, you will be prompted to update the symptomcatalog list. Ordinarily you would want to perform this update, but if you do not

have Internet access, and in order to save time, click Cancel.

Warning

If you update the symptom catalog, the new catalog will have to be compiled before youcan use it for the first time. The compiling of the symptom catalog can take 10 to 20

minutes. Therefore, for this exercise Cancel any Update windows that might pop up.

Linux

You may not be prompted to update the symptom catalog list.

The activity.log is a binary file and needs to be converted to text in order for Log Analyzer toimport it. On Windows there is a checkbox that tells Log Analyzer to treat activity.log as atext file. This check box does not seem to be available in Linux.

Workaround for Linux: Convert activity.log to a text file using showlog.sh; then import

it into Log Analyzer.

In a later step you will be asked to import the activity log into Log Analyzer, so perform thefollowing steps now to do the conversion.

• Open a terminal window and enter cd <profile_root>/profile1/bin

• Then type ./showlog.sh ../logs/activity.log > ../logs/activity1.log

• Later when you are asked to import the activity.log file, import activity1.log

instead.

__ 2. Import symptom catalogs.

__ a. In the Log Analyzer under Log Navigator, right-click Symptom Catalogs.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click Import Symptom Catalog....

__ c. Select From Local host.

__ d. Browse for

<software_dir>\Troubleshooting\IBM_WebSphere_Application_Server_Ver

sion_7_0.symptom. Click Open. Note: on UNIX click OK. __ e. Clear the check box for Browse in symptom editor folder.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. Click Finish.

__ g. Wait for the symptom catalog to be imported. This can take a few minutes tocomplete. Monitor the progress of the import in the lower right corner of the Log

Analyzer console.

__ h. The import is complete when this message disappears. Verify that you see an

entry for the catalog under the Symptom Catalogs folder in the Log Navigator.

__ i. Repeat these steps to import the V6.1 symptom catalog

IBM_WebSphere_Application_Server_Version_6_1.symptom .

__ 3. Import server1’s activity log.

__ a. From the Log Analyzer task menu, select File > Import Log....

__ b. Select Import from the local system and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyNote

You may see the following exception.

If so, click Continue several times until you see Import from the local system window.

__ c. Expand the directory until you get to the profile1 log directory:

<profile_root>\profile1\logs.

7/21/2019 WAS V7.pdf


Student Exercises




Linux

Remember to select and add activity1.log instead of activity.log.

__ d. Highlight activity.log and click Add.

__ e. Scroll to the table Logs to be imported into the Log Analyzer.

Linux

The next few steps are not necessary since you already converted the activity.log to textformat earlier in the exercise. Proceed to the step where you click Finish.

__ f. In the Log Type column, click the link for IBM WebSphere Application Server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ g. Make sure the box for activity log is checked. Also check the box for Activity log

is text-formatted.

__ h. Accept the defaults for everything else on the Details tab and click OK.

__ i. Click Finish.

__ j. On the Download Catalog Updates window click Cancel. Ordinarily you would

want to update the symptom catalogs.

__ k. Wait for the activity log to be imported. You should then see the Log Viewpopulated with records from the activity log.

__ 4. Examine the Log View in the Log Analyzer.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Notice each event has a Creation Time, Severity, Message Text, and so on. Theseverity values are 10 (information), 30 (warning), and 50 (error).

Note

The contents of your Log View will be different from what is shown in the screen captureabove, which was created for illustrative purposes.

__ b. Filter the events by severity by clicking the down arrow on the Manage Filtersicon.

__ c. Select Show error log records only.

__ d. Notice that only the events with severity 50 are now displayed in the Log View.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Analyze an event against the symptom catalog by right-clicking any record in theLog View.

__ f. Click Analyze Selection. You can also click Analyze All; however, it usually

takes several minutes for the analysis depending on how many records are listedin the Log View.

__ g. If you are prompted again to update the symptom catalogs, click Cancel.

__ h. When the analysis completes, you will see a message box indicating how many(if any) symptoms were found relating to the log record. Click OK.

__ i. View the results of the analysis in the bottom pane below the Log View. Click anysymptom code and select the Recommendations and actions tab.

__ j. Scroll down on the Recommendations and actions tab and expandRecommendations to see the details.

Information

This short exercise is meant to introduce you to some of the functions of the Log Analyzer.

If you have time, you may explore some of the other features. The tool provides complete

online documentation. To view the documentation, click Help > Help Contents.

7/21/2019 WAS V7.pdf


Student Exercises




__ k. When you are done exploring the Log Analyzer, close it by clicking File > Exit.Click Yes on the Log Message prompt.

__ l. Minimize ISA. You will use it again later in this exercise.

Part 3: Enabling tracing on an application server

Additional logging can be enabled for events in the WebSphere Application Server by usingthe tracing features of WebSphere. Tracing impacts performance and should only beenabled on specific components when necessary. Try to reproduce the problem and dump

the trace data to a log file. Disable tracing when it is no longer needed.

__ 1. Log in to the administrative console.

__ a. Enter wasadmin for the user ID and web1sphere for the password.

__ 2. Configure Diagnostic Trace for server1.

__ a. Select Troubleshooting > Logs and trace > server1 > Diagnostic Trace.

__ b. Under Trace Output select File (the default) to specify you want trace entrieswritten to a log file.

__ c. Set the Maximum File Size to 25 and the Maximum Number of Historical

Files to 2.

__ d. Remember the name and location of the trace trace.log file. The default locationis ${SERVER_LOG_ROOT}/trace.log. Click OK.


__ 3. Change the trace level details. This is configured on a separate panel.

__ a. Select Troubleshooting > Logs and trace > server1 > Change Log DetailLevels and wait until all components are shown in the browser window.

__ b. Select the Runtime tab and wait until all components are visible.

Information

Changes made on the Runtime tab work on actively loaded modules and do not require aserver restart. Changes made on the Configuration tab will not take place until the

application server is restarted.

__ 4. Trace the J2C Connection Manager with a detail level of finer. To change the LogDetail Levels, you have two possibilities:

__ a. Type in the multiple line entry field the following:

*=info: com.ibm.ejs.j2c.ConnectionManager=finer

__ b. Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Or expand com.ibm.ejs.* and then expand com.ibm.ejs.j2c.*. Click

com.ibm.ejs.j2c.ConnectionManager and select Message and Trace Levels

> finer. Click OK.

Information

The option of dynamically expanding the components will only display components that

have been loaded by the application server. If the application server has not accessed thedatabase since its last restart, the ConnectionManager component will not be listed under

the com.ibm.ejs.j2c package.

Information

The connection management architecture for both relational and procedural access toenterprise information systems (EIS) is based on the J2EE Connector Architecture (JCA)

specification. The Connection Manager pools and manages connections within anapplication server. It is capable of managing connections obtained through both resource

adapters defined by the JCA specification and data sources defined by the Java DatabaseConnectivity (JDBC) 2.0 (and later) Extensions specification.

__ 5. Verify the trace output using the HitCount servlet in the DefaultApplication.

7/21/2019 WAS V7.pdf


Student Exercises




The trace settings you just specified will allow you to view when connection managersare utilized. You can see when specific connection managers are accessed and how

long the access lasts. This could be helpful in determining which components accessconnection managers and when such access might be taking too long.

__ a. In a command prompt window navigate to

<profile_root>\profile1\logs\server1.

Information

Use the tail utility to monitor the trace output. If tail is not available on your system, use

Notepad or any ASCII editor as the tool for opening the trace.log file in this directory.

__ b. If tail is available, start it: tail -f trace.log In the trace output find the message:

TRAS0018I: The trace state has changed. The new trace state is*info:com.ibm.ejs.j2c.ConnectionManager=finer.

Leave the tail window open.

__ c. If tail is not available, open the trace.log using Notepad. Verify that you see themessage:

TRAS0018I: The trace state has changed. The new trace state is

*info:com.ibm.ejs.j2c.ConnectionManager=finer.

__ d. In a Web browser specify the following address:

http://localhost:9080/hitcount?selection=SS2

Use the Reload (Refresh) button in the browser a few times. You should only seeinformation in the tail window (or trace.log) about the servlet initialization (only if

the servlet was not already running), but should not see any information aboutJ2C connectivity.

__ e. In the same browser of the HitCount Demonstration select Enterprise Java

Bean (CMP), select Global Namespace, and select Commit. Click Increment.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

The address in the browser should change to the following:

http://localhost/hitcount?selection=EJB&lookup=GBL&trans=CMT

You should also see the following at the bottom of the Web page.

__ f. There should now be a lot of trace information in the trace.log file. Look for thefirst occurrence of the message:

allocateConnection in cm <some hex value> Entry

If this was the first request of HitCount using CMP EJB, you will find the JDBC

driver name getting the connection entry in the trace.

Record the connection manager entry (the hexadecimal value): _____________

7/21/2019 WAS V7.pdf


Student Exercises




__ g. Reload the request in the browser. Look again for the first occurrence of themessage allocateConnection in cm <some hex value> Entry after the

reload time.

Does the connection use the same entry? _____

Compare the timestamp and duration of both connections.

__ h. Trace a request for a different application. In a new Web browser specify theaddress:

http://localhost:9080/ivt/ivtejb

Only a blank screen appears as response in the browser.

Are there any connections shown in the tail window? Why not? _______________________________________________________________

Hint: What kind of Enterprise JavaBeans are used? (Hint: Not Entity Enterprise

JavaBeans) _______________________

__ 6. Test the connection trace using the TradeApplication. __ a. In a new browser window enter the following address:

http://localhost:9080/Trade/web

__ b. Log in as user: client and password: web1sphere

__ c. Does the connection use the same entry as the HitCount application did?

_________ (Hint: Typically, a different application will get a new connection.)

Note

The tests above show that both the Trade application and the HitCount application (when

using Enterprise JavaBeans) utilize the Connection Manager. You also could determinehow long it took for the connections to perform tasks using the timestamp information.

If there was a problem with database access, this information may help pinpoint where the

problem originates.

Information

Use Trace to obtain detailed information about the execution of WebSphere ApplicationServer components, including application servers, clients, and other processes in the

environment. Trace files show the time and sequence of methods called by WebSphereApplication Server base classes, and you can use these files to pinpoint the failure.

Trace output is generated as plain text in either basic, advanced, or log analyzer format as

specified by the user. The basic and advanced formats for trace output are similar to the

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty basic and advanced formats that are available for the JVM message logs. You can also usethe Log Analyzer to view and analyze trace output..

__ d. Close any Web browser windows that may still be open except the administrative

console.

__ e. Close the tail window.

__ 7. Now that you are done working with trace, reset the Trace level to its original setting.

__ a. Select Troubleshooting > Logs and trace > server1 > Change Log Detail

Levels and wait until all components are shown in the browser window.

__ b. Select the Runtime tab and wait until all components are visible.

__ c. In the multiple line entry field, change it back to the following:

*=info

__ d. Click OK. __ 8. (Optional) Import the trace.log into the Log Analyzer and examine its contents.

Follow the steps of the previous part of the lab. You can also import JVM log files

into the Log Analyzer.

Part 4: Work with the Guided Troubleshooting component of IBM

Support Assistant

IBM Support Assistant (ISA) improves your ability to locate IBM support, development, andeducational information through a federated search interface (one search tool which can

search through multiple resources).

The goal is to simplify access to IBM product home pages, product support pages, productforums, and newsgroups through convenient links.

It saves you time when submitting problems to IBM Support by collecting relevantinformation and then electronically creating a Problem Management Report (PMR) from

within IBM Support Assistant.

It also includes a support tool framework allowing for the easy installation of support toolsassociated with different IBM products.

In this part of the exercise you will work with the Guided Troubleshooting component of theIBM Support Assistant.

__ 1. Install the Badapp application.

__ a. In a command prompt window navigate to <profile_root>\profile1\bin.

__ b. Enter the command

wsadmin -lang jython -user wasadmin -password web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




Enter the command:

./wsadmin.sh -lang jython -user wasadmin -password web1sphere

__ c. Wait until you see the prompt wsadmin>, and then enter the following command

on one line. Make sure that you replace the XX with your number in the nodeand cell names. Alternatively, you can go to <software_dir>\Troubleshooting

and copy the command from the file BadAppInstall.txt.

AdminApp.install('C:\software\Troubleshooting\Badapp.ear',

'[-node was7hostXXNode01 -cell was7hostXXNode01Cell -server

server1]')

Linux


AdminApp.install('/usr/software/Troubleshooting/badapp.ear', '[-node

was7host01Node01 -cell was7host01Node01Cell -server server1]')

__ d. Wait until you see the following message.

ADMA5013I: Application BadAppEARProject installed successfully.

__ e. Next, enter the following two commands.

AdminConfig.save()

quit

__ 2. Verify that the application is installed and start it from the administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Log in to the administrative console and click Applications > Application Types

> WebSphere enterprise applications.

__ b. Check the box for BadAppEARProject, and click the Start button.

__ c. Wait for the application to start successfully and its status is started (green

arrow).

__ 3. Run the application.

__ a. From a Web browser enter the Web address:

http://localhost:9080/BadAppWebProject

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Enter a 5 in the Bad Behavior Mode window, and click the Submit button.

__ c. The browser will seem to “hang” for several minutes. You will notice the progress

bar moving very slowly.

__ d. After about 5 minutes you will see the following error message.

Return page for BadApp

Request status:OutOfMemoryException was thrown (was this expected?),

see WAS logs

An OutOfMemoryException has been thrown. If the application was not purposely

written to display the error message, you would see this symptom only if youexamined the server’s JVM logs (SystemErr.log).

__ e. Use Windows Explorer to navigate to <profile_root>\profile1\logs\server1.

__ f. Use Notepad to open the SystemErr.log file. Search for the string:

java.lang.OutOfMemoryError

__ g. Following the OutOfMemoryError you should see a stack trace similar to thefollowing.

SystemErr R java.lang.OutOfMemoryErrorSystemErr R at com.ibm.badapp.BadAppServlet$F(BadAppServlet.java:192)

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty SystemErr R at com.ibm.badapp.BadAppServlet.docMethod(BadAppServlet.java:406)SystemErr R at com.ibm.badapp.BadAppServlet.doPost(BadAppServlet.java:280)SystemErr R at javax.servlet.http.HttpServlet.service(HttpServlet.java:738)SystemErr R at javax.servlet.http.HttpServlet.service(HttpServlet.java:831)

The stack trace may provide you with information to determine what application

caused the out of memory condition.

Information

Also, by default, a server’s JVM is configured so that whenever an OutOfMemoryException

is thrown, a javacore file and a heapdump file will be dumped to the server’s<profile_root> \<profile_name > directory.

If you navigate to <profile_root> \profile1 you will see the following:

heapdump.<time_stamp >.phd

javacore.<time_stamp >.txt

The IBM Support Assistant has different tools that will help you analyze the contents of theheapdump and javacore files.

__ h. Close the Web browser.

Information

In the following steps you will use the IBM Support Assistant’s Guided Troubleshooting

feature. Here are the symptoms you have observed so far.

1) Web browser hangs after clicking the Submit button.

2) Error page suggesting an OutOfMemory exception

3) OutOfMemory exception in the SystemErr.log

4) heapdump and javacore files have been generated

__ 4. Open the IBM Support Assistant and launch the Guided Troubleshooter.

__ a. Double-click the ISA shortcut on you desktop and wait for the IBM SupportAssistant to open. If the ISA shortcut is not available, use Windows Explorer to

navigate to C:\Program Files\IBM\IBM Support Assistant\rcp and double-click

rpclauncher.exe.

7/21/2019 WAS V7.pdf


Student Exercises




Linux

Open the ISA window. If ISA is not running from earlier, open a terminal window and

navigate to /opt/ibm/IBMSupportAssistant/rcp. Launch ISA by entering:

./rcplauncher

__ b. Click Analyze Problem on the IBM Support Assistant Welcome page.

__ c. Select the Guided Troubleshooter tab.

__ d. Select Troubleshoot a problem and click Next.

Note

As you proceed through the guided troubleshooting process, you will be asked a series ofquestions. The instructions provide you with responses that are appropriate for the

symptoms that you may or may not have observed. Notice that there is additional help andtroubleshooting guidance at the bottom of each pane. It is worth taking time to read some

of this information as you perform the following steps.

__ 5. Fill in the new case information.

__ a. Enter BadApp_problem for the Case Name.

__ b. The only required field is Case Name. The other fields in the screen capture arefor illustrative purposes. You may enter information in these fields if you like.

Notice that in the pane below this form there is a description of each field and

examples of what information might be recorded there.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Click Next.

__ 6. Select a product to troubleshoot and begin characterizing the problem.

__ a. Select WebSphere Application Server Troubleshooting and click Next.

__ b. On the next screen select Guide me through identifying my symptom and

failing component and click Next.

__ c. Select The application performs poorly or behaves unexpectedly and click

Next.

__ d. Select My application is slow, or its performance degrades over time and

click Next.

__ e. Select Troubleshoot Java memory problems and click Next.

__ 7. Begin troubleshooting Java memory problems.

__ a. Select Troubleshoot IBM JVMs and click Next.

__ b. Select JVM diagnostic files (heapdump or javacore) were automatically

created by the JVM and click Next.

__ c. Read the information about automatically generated heapdump and javacore

files. If you have not already done so, use Windows Explorer to navigate to

<profile_root>/profile1 and verify that a heapdump and a javacore files wererecently generated. Click Next.

__ d. Select A file containing verbose GC information or heapdump files exist

and click Next.

__ 8. Add the heapdump file to your case.

__ a. Follow the three steps to add the heapdump file. Start by clicking the Add Files button.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Browse to <profile_root>/profile1 and select the heapdump file. If you see anerror message while browsing, click Continue.

__ c. If you see more than one heapdump, select the one with the latest timestamp in

its file name. Click OK.

__ d. Click Next.

__ 9. Verify that you have collected the heapdump file into your case.

__ a. On the right side of the screen, select the Case Manager tab and highlight your

Case Name.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. You should see the heapdump file name.

__ c. Back in the Guided Troubleshooting tab, select I collected the diagnostic data

files, help me analyze them, and click Next.

__ 10. Begin the analysis of the heapdump file.

__ a. Select Analyze a heapdump file and click Next.

__ b. Read the information on the Analyze the Heapdump Diagnostic File page.

__ c. Expand each topic to learn more about MDD4J and heapdumps.

__ d. The next step is to use a tool called Memory Dump Diagnostic for Java (MDD4J)

to analyze the heap dump. If time permits, you can click Next and continue withthe analysis.

Information

The Memory Dump Diagnostic for Java (MDD4J) tool analyzes common formats ofmemory dumps (heapdumps) from the Java virtual machine (JVM) that is running

WebSphere Application Server. The analysis of memory dumps is targeted towardsidentifying regions within the Java heap that might be root causes of memory leaks. The

tool is capable of analyzing very large sized memory dumps obtained from production

7/21/2019 WAS V7.pdf


Student Exercises




environment application servers encountering heap exhaustion, large object requests, orOutOfMemoryErrors.

__ e. At this point, rather than going through the analysis using MDD4J, you will pause

and save your case. Using the MDD4J is beyond the scope of this course.

However, the last several steps have shown you how to navigate through theGuided Troubleshooting feature. Click Pause Case.

__ f. On the prompt to stop the current case, click OK. You will be returned to theGuided Troubleshooting Welcome page.

Part 5: Work with a collector in the IBM Support Assistant.

If you are preparing to engage IBM Support to help you solve a problem, there is certaindiagnostic data relevant to common problems that you must gather from your system and

WebSphere Application Server. ISA has an interactive collector feature that will guide you

through the diagnostic data collection process.

__ 1. Access the collectors in IBM Support Assistant.

__ a. Under the Analyze Problem tab, click the Collect Data tab.

__ b. You will add the collected data the BadApp case. Click the Select button, selectthe BadApp_Problem case, and click OK. BadApp_Problem should now show

in the case window.

__ 2. Select a collector.

__ a. Under Select a Collector expand WebSphere Application Server 7.0.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Expand General and select General Problem.

__ c. Click the Add >> button to the right of the list of collectors.

__ d. Scroll to the right to verify that you see General Problem in the Collector

Queue.

__ e. Select (highlight) the entry in the Collector Queue, and click the Collect All

button.

__ 3. Begin the interactive collection process. In the following steps you will respond torequests for information about your server’s system, for example, installation

locations, output file locations, administrative IDs, and so forth.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Read the description of the General Problem collector in the first User Input prompt and click OK.

__ b. As the collection proceeds, you can view the status in the Collector Status area.

__ c. Click the View Details button to examine the steps in the current collection

process. You can also view the status by selecting the Current Status tab.

__ d. The next User Input prompt provides a link to the MustGather document forGeneral Problem. Click the link if you like, and read the document. Or just click

OK to proceed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. The next User Input prompt requests the path and name of the collection output.Enter<software_dir>\Troubleshooting\BadApp_Problem_Gen_Collector.zip

__ f. Click OK.

__ g. Browse for the installation root <was_root> . Click OK.

Linux

<was_root> is /opt/IBM/WebSphere/AppServer

7/21/2019 WAS V7.pdf


Student Exercises




__ h. Enter the Administrator User Name: wasadmin and Administrator Password: web1sphere Click OK.

__ i. The collector will run for a few minutes; then you will be prompted to enter a trace

string. Enter com.ibm.*=all

__ j. Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ k. On the next prompt you will have an option to restart the server. Select Do not

Restart Server.

__ l. Click OK. The next prompt asks you: Proceed without restarting server. Click

OK.

7/21/2019 WAS V7.pdf


Student Exercises




__ m. Wait a few minutes until you are prompted for additional trace strings. Select No.

__ n. Click OK.

__ o. On the next prompt you will be asked if you wanted to set the number and size of

the trace file. Select No.

__ p. Click OK.

__ q. On the next prompt, click I Have Reproduced the Problem. Ordinarily you

would take this opportunity to reproduce the problem with tracing enabled to

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty gather data specific to the problem you are seeing. But in order to save time,proceed as if you had.

__ r. Click OK on the prompt telling you that the Collector Tool will run and take

several minutes.

__ s. After several minutes you will be prompted with the following InformationalMessage.

__ t. Click OK.

__ u. When prompted to provide feedback to IBM about the IBM Support Assistant,click No.

7/21/2019 WAS V7.pdf


Student Exercises




__ v. At this point you can choose to FTP the collected data to IBM Support. From thedrop-down menu select Do Not FTP the Logs.

__ w. Click OK.

__ x. Wait a few minutes for the collection to complete.

__ y. When the collection is complete, you will see the name of the file where the

results are stored, in this case, BadApp_Problem_Gen_Collector.zip .

__ 4. Examine the results of the collection.

Linux

On Linux, click the BadApp_Problem_Gen_Collector.zip link in the Collector Status

window. An index of files in <software_dir>\Troubleshooting will be displayed in a Web

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty browser. Right-click BadApp_Problem_Gen_Collector.zip and select Open Link in New

Window. Select Open with File Roller and click OK.

__ a. Use Windows Explorer to navigate to <software_dir> \Troubleshooting.

__ b. Locate the file BadApp_Problem_Gen_Collector.zip , right-click it, and click

Open.

__ c. You should see three folders: autopdzip, profile1, and

WAS_General_Problem.

__ d. Open each folder and explore the contents. In the profile1 folder you will see the

log files, properties files, heapdump, javacore, and so forth. In theWAS_General_Problem folder, there are several HTML files containing reports

on the status of the server system. You may like to open these reports and viewtheir content.

__ e. When you are done examining the contents ofBadApp_Problem_Gen_Collector.zip , close it.

__ 5. Shut down the IBM Support Assistant.

__ a. In the IBM Support Assistant Workbench, click Files > Exit.

__ 6. Uninstall the BadApp application. This application was used for illustrative purposes

in this exercise, and will not be used again.

__ a. Log in to the administrative console.

__ b. Click Applications > Application Types > WebSphere Enterprise

applications. __ c. Select the check box for BadAppEARProject.

__ d. Click the Uninstall button. Click OK to confirm the removal of the application.

__ e. Save changes to the master configuration.

__ f. Log out of the administrative console.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises





In this exercise you learned how to examine server log files using the administrativeconsole, and how to use the Log Analyzer to examine the IBM service log (activity.log).

You also learned how to configure diagnostic tracing on specific server components using

the administrative console. You generated trace data by running different applications that

accessed the server component. You examined the trace data to get a betterunderstanding of how the component was behaving.

Next you installed an application, BadApp, which has a built-in memory leak. Running theapplication resulted in an OutOfMemory exception being thrown. You used the Guided

Troubleshooting feature of the IBM Support Assistant to work through a step-by-stepinvestigation of the problem. Finally, you used one of the interactive collectors in the IBM

Support Assistant to gather diagnostic data from your system relevant to a generalproblem.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Appendix: Installing the IBM Support Assistant

In this lab exercise the IBM Support Assistant was already installed on your lab machinesfor your convenience and to save time. Following are instructions for installing IBM Support

Assistant on a Windows machine.

Download and install the IBM Support Assistant __ 1. Download the IBM Support Assistant V4.0.2 from the WebSphere support site using

the following Web address

http://www.ibm.com/software/support/isa/download.html

__ 2. Download ISA V4.0.2 Workbench for Windows ibmsa-v402-wb-win32.zip to atemporary directory.

__ 3. Extract ibmsa-v402-wb-win32.zip to a directory called C:\ISA

__ 4. Install ISA V4.0.2

__ a. Navigate to the ibmsa-v402-wb-win32 folder and double-click setupwin32.exe.

__ b. Click Next on the ISA Welcome page.

__ c. Accept the license agreement and click Next.

__ d. Accept the default install directory and click Next.

__ e. Click Install on the summary page. Wait 2 minutes for the install to completesuccessfully and then click Finish.

__ f. You should now see the IBM Support Assistant Workbench shortcut on the

desktop.

__ 5. Install ISA add-ons for WebSphere Application Server V7.0 and several JVM tools.

__ a. Double-click the IBM Support Assistant shortcut.

__ b. Click Cancel on the Network Connections screen if you see it.

__ c. In the ISA Workbench click Update > Find New > Product Add-ons.

__ d. On the Product Add-ons to Install page, expand WebSphere.

__ e. Scroll to locate WebSphere Application Server V7.0 and check the box beside it.

__ f. Click Next.

__ g. On the Tools Add-ons to Install page, expand JVM-based Tools and check anyof the boxes for the following tools. These tools are of particular interest for

WebSphere Application Server. New versions and additional tools are availableon a regular basis.

• IBM Monitoring and Diagnostic Tools for Java - Dump Analyzer v2.1.0

• IBM Monitoring and Diagnostic Tools for Java - Garbage Collection and

Memory Visualizer v2.1.0

7/21/2019 WAS V7.pdf


Student Exercises




• IBM Pattern Modeling and Analysis Tool for Java Garbage Collectorv2.4.0

• IBM Thread and Monitor Dump Analyzer for Java (Tech Preview) v2.8.0

• Memory Dump Diagnostic for Java (MDD4J) Beta v2.0.0

• ThreadAnalyzer (Tech Preview) v6.0.3

• Log Analyzer

Note

If the exact versions listed above are not available, then download the latest versions.

However, the behavior of the later versions might be different from what is described in thelab exercises.

__ h. Click Next. __ i. Accept the licence agreement and click Next.

__ j. Click Finish.

__ k. On the Results of Operation screen verify that the product add-on and the tool

add-ons installed successfully.

__ l. Click Finish.

__ m. When prompted to restart, click Yes.

__ n. Close the IBM Support Assistant.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 8. Using wsadmin 8-1

5.2

Xempty Exercise 8. Using wsadmin


In this lab exercise, you use the wsadmin. You learn to manipulatewsadmin objects from the command line and from scripts.

You also use the Rational Application Developer assembly and deploy

tool to create, test, and debug wsadmin scripts written in Jython.



• Use wsadmin and scripts to execute administrative commands

• Create a simple script using Jython

• Use the Jython editor and debugger

• Examine wsadmin settings

Introduction

The WebSphere Application Server wsadmin tool provides the ability

to execute scripts for the purpose of making configuration changes inthe application server.

You can use the wsadmin tool to manage a WebSphere ApplicationServer V7 installation. This tool uses the Bean Scripting Framework

(BSF), which supports a variety of scripting languages to configureand control your WebSphere Application Server installation. The

wsadmin tool supports the Jython and Jacl scripting languages. TheJython syntax for the wsadmin tool is the strategic direction for

WebSphere Application Server administrative automation.

The wsadmin shell makes Java objects available throughlanguage-specific interfaces. Scripts use these objects for application

management, configuration, operational control, and forcommunication with MBeans running in the WebSphere server

processes.

Scripting is a nongraphical alternative that you can use to configureand manage the WebSphere Application Server.

7/21/2019 WAS V7.pdf


Student Exercises




Requirements

To perform this exercise, you must have a working WebSphereApplication Server installed on the machine and also Rational

Application Developer assembly and deploy available on the same ora different machine from the server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


The wsadmin tool supports two scripting languages: Jython and Jacl. Rational ApplicationDeveloper assembly and deploy only supports Jython. This exercise covers scripting using

only Jython scripts.

Using wsadmin with JythonWhen running scripts using the -f flag, to run a script contained in a file, wsadmin will runthe appropriate language interpreter based on the file extension of the script being passed.

Jython is used for scripts with a file type of .py and Jacl is used for scripts with a fileextension of jacl.

Even though the wsadmin shell has been improved to the point where in most cases you

do not need to specify the -lang jython command-line option, some options like -profile still require you to specify the language used in the file containing the profile. If

no -lang flag is specified, Jacl is considered the default language. This also applies when

starting the wsadmin shell without passing a file to execute or when using wsadmin with the -c flag to pass and execute a single command.

If Jython is preferred, the following command-line option is used for a one-time switch touse Jython:

wsadmin -lang jython

The UNIX command would be:

./wsadmin.sh -lang jython

Information

To use Jython as the default scripting language, edit the wsadmin.properties file found inthe <profile_root>\profile1\properties directory.

Look for the entry that contains com.ibm.ws.scripting.defaultLang=jacl and set it

equal to jython

This change will be global to this profile. It is also possible to define a property file forindividual users or through an environment variable.

This section of the lab explores wsadmin using Jython commands: starting wsadmin,getting help, and running various commands.

7/21/2019 WAS V7.pdf


Student Exercises




There are solution files in the <software_dir> \wsadmin folder. You can continue with theexercise and enter the commands by hand, or you can run the appropriate script.

Start wsadmin

__ 1. Start WebSphere Application Server.

__ a. Open a command-prompt window and navigate to the <profile_root>\profile1\bin directory.

__ b. Verify the server is running; enter the serverStatus server1 command. Enterthe user ID wasadmin and password web1sphere when challenged.

The UNIX commands to check the server status and start the server are:

./serverStatus.sh server1

./startServer.sh server1

__ c. If the application server is not running, start the server by entering thestartServer server1 command.

__ d. Do not close the command-prompt window. Wait for the server to complete its

startup process.

__ 2. List the command line options for wsadmin.

__ a. Get command line help for wsadmin. From the <profile_root>\profile1\bin

directory, enter: wsadmin -help


./wsadmin.sh -help

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty The resulting output displays a list of command-line options and descriptions ofthose options.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. It is possible to run a single wsadmin command and exit the wsadmin shell. This isnot very efficient since a JVM needs to be created every time a command is run.

Enter following command:

wsadmin -lang jython -c "AdminControl.getPort()"

You will be prompted to log in. Enter user ID wasadmin and password web1sphere


./wsadmin.sh -lang jython -c "AdminControl.getPort()"

Information

Note that depending on whether wsadmin has ever been run on your machine using the

jython flag, you may get a slightly different output from that showing on the previousscreen capture. The first time Jython is loaded by wsadmin, its libraries are loaded prior to

the execution of the script. As each library is loaded, a message appears on the wsadminconsole.

The port that wsadmin is using to connect to the application server is displayed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyWarning

Note that now that you are asking wsadmin to actually connect to a running server and

retrieve some information (the port number), you are challenged for a user name andpassword. These must be valid credentials to the administrative security. Enter wasadmin

and web1sphere to authenticate and continue. Ensure there are no spaces after each

entry, or authentication will fail.

See the next section for alternatives on how to deal with security while using wsadmin.

Dealing with security

In WebSphere Application Server V7 administrative security is enabled by default. Thesesecurity settings affect wsadmin inasmuch as a valid user ID and password must be used

when starting a wsadmin session. Providing this authentication information can be done inseveral ways:

1. Supply user ID and password on the wsadmin command line

2. Supply user ID and password on the pop-up window

3. Save the user ID and password in the property files

Options 1 and 2 require a person to enter the information every time wsadmin is started.This defeats the purpose of using wsadmin to automate configuration changes since a

human must be available. Option three allows you to enter the authentication informationonly once, and then every time wsadmin starts it will authenticate using the information in

the property files.

Next you will enter the authentication information for wsadmin in the soap.client.props fileand also encode the file to mask the password, which is entered initially in clear text.

__ 1. Add the user ID and password to the properties file.

__ a. Edit the soap.client.props file found under the <profile_root>\profile1\properties folder.

__ b. Find the entries:

7/21/2019 WAS V7.pdf


Student Exercises




com.ibm.SOAP.loginUserid=

com.ibm.SOAP.loginPassword=

__ c. To the right of the equals sign, enter wasadmin and web1sphere in the

corresponding fields.

Warning

Realize that this is a potential security problem.

Not only is a password being stored within this file (although it can be encoded), it meansthat any administrator who runs wsadmin will automatically have access to WebSphere

without any authentication.

__ d. Save the file.

Information

If you are connecting to wsadmin using RMI instead of SOAP, the file to edit is:

sas.client.props. This file is in the same folder as the file used for the SOAP connection.

The entries to change are:

com.ibm.CORBA.loginUserid=

com.ibm.CORBA.loginPassword=

__ 2. Execute the same command again:

wsadmin -lang jython -c "AdminControl.getPort()"


./wsadmin.sh -lang jython -c "AdminControl.getPort()"

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty You should not have been prompted for authentication. Having the authenticationinformation in the property file also means that you can now stop the server without

providing a user name and password.

__ 3. If you are uncomfortable with leaving passwords visible in the properties file, a tool isprovided to encode the passwords.

Run the PropFilePasswordEncoder tool on the soap.client.props file.

7/21/2019 WAS V7.pdf


Student Exercises




Information

Note that a side effect of encoding the password is that the tool removes all comments from

the file. If you want to look at comments in the soap.client.props file at a later time, youshould save a backup copy and remove the password before running the encoding utility.

Also note that encoding the password is no substitute for protecting the file system from

unauthorized users.

__ a. From the command window on the <profile_root>\profile1\bin folder,invoke the following command (all in one line, do not type <space>):

PropFilePasswordEncoder ..\properties\soap.client.props <space>

com.ibm.SOAP.loginPassword -Backup


./PropFilePasswordEncoder.sh ../properties/soap.client.props <space>

com.ibm.SOAP.loginPassword -Backup

__ b. Open the file to see the changes.

Invoking wsadmin to run a script in a file

As mentioned previously, running wsadmin multiple times using the -c command-line

option is very inefficient as the Java virtual machine (JVM) hosting wsadmin needs to bestarted and shut down for every command.

It is much more efficient, and faster, to combine multiple commands into a single file which

can be run as a unit. The added benefit of this approach is that scripting logic can beincluded to make decisions and obtain runtime values dynamically.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 1. From a command prompt (not the wsadmin prompt), you can run wsadmin with the -f <filename> option. This option gives you the ability to get wsadmin to load and

run a script file. The command to run a script looks like the following:

wsadmin -f <software_dir>\wsadmin\listJDBCProviders.py


./wsadmin.sh -f <software_dir>/wsadmin/listJDBCProviders.py

In the example above, the listJDBCProviders.py file is a script file that lists all theJDBC providers defined on the server, at all scopes including application scoped

providers in the QuoteWS application.

Run the script now to view all the JDBC providers defined on the server:

7/21/2019 WAS V7.pdf


Student Exercises




__ 2. Open the <software_dir>\wsadmin\listJDBCProviders.py file and examine itscontents to try and understand what the script did. The source code is also shown

below:

A short explanation of the script:

• The pound character “#” indicates the line is a comment.

• The keyword def on line five indicates that the following lines of code are a

subroutine. In Jython indentation defines blocks of code, so every line belongingto the def is indented the same amount of white space. The colon at the end of

the line signifies the beginning of a block of code.

• The script’s first line of execution, on line 14, is the first non-indented line that is

not a def — in this case: AdminConfig.reset(). As you may recall,AdminConfig is one of the administrative objects. The reset() method cancelsout any outstanding configuration changes that have not been saved.

• Next the cell and node are obtained using methods in the AdminControl object.

• The line separator and slash characters change depending on the operatingenvironment, so it is always a good idea to obtain them at run time and not

hardcode them.

1. #

2. # This script lists all defined JDBC providers

3. #

4.5. def showJdbcProviders():

6. providerEntries = AdminConfig.list("JDBCProvider")

7.

8.# split long line of entries into individual entries in

list

9. providerEntryList = providerEntries.split(lf)

10.

11.# print contents of list for provider in

providerEntryList:

12. print providerEntryList

13.14. AdminConfig.reset()

15. cell = AdminControl.getCell()

16. node = AdminControl.getNode()

17. lf = java.lang.System.getProperty("line.separator")

19. slash = java.lang.System.getProperty("file.separator")

19.20. print "System information: Cell=" + cell

21. print "System information: Node=" + node

22.23. showJdbcProviders()

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty • The print command can be used as an informational or debugging aid. It canprint constants and runtime variables easily, as you can see on lines 20 and 21.

• The last line, line 22, showJdbcProvider() calls the subroutine of the same

name. Here the AdminConfig object is used to obtain a list of JDBC providers.The call returns a long string containing all the providers; between each provider

there is an lf character. The split function makes a list of the long string

using the lf character as the separator.

• The next couple of lines iterate through the list and display each entry. Note the

iterator is implemented as a for loop. Also note the change in indentation for theline executing the body of the for loop.

__ 3. If you are comfortable working with Jython scripting, feel free to modify and rerun the

script.

Work with wsadmin administrative objects

In this part of the exercise you work within the wsadmin shell in the interactive mode. Oncethe wsadmin shell starts, you are presented with a command prompt where you can

execute literally any valid command you wish.

If you want to reduce the chances of making errors, you can open the

<software_dir>\wsadmin\class_samples.py script and use it to copy and paste theindividual commands. Otherwise just type the commands.

__ 1. Start a wsadmin command session using the Jython language.

__ a. Verify the directory is <profile_root>\profile1\bin

__ b. Enter:




__ 2. As you may know, there are five wsadmin administrative objects. They are:

• Help

• AdminControl

• AdminConfig

• AdminApp

• AdminTask

Almost all server configuration can be performed through these objects. Use

wsadmin to display the help provided by each of the administrative objects.

7/21/2019 WAS V7.pdf


Student Exercises




Information

The Help object is used to provide general help for the objects AdminApp, AdminConfig,

AdminControl, AdminTask, and Help. It is also the interface to obtain information aboutMBeans (operations, attributes, and particular interface information about MBeans).

__ a. At the wsadmin prompt enter the following command:

Help.help()

__ b. As you can see, the output has not been formatted and is hard to read. Now try

the following command:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty print Help.help()

Using the command print in front of nearly every other command producesformatted output, which is much easier to read.

__ c. Now try to get help for the other administrative objects:

• AdminConfig.help()

• AdminControl.help()

• AdminApp.help()

• AdminTask.help()

__ 3. You can also request specific help on a particular command, or method, of an

administrative object. To display the command groups available for the AdminTaskobject, enter the command:

7/21/2019 WAS V7.pdf


Student Exercises




print AdminTask.help("-commandGroups")

__ 4. Suppose you are interested in the group of commands for configuring a cluster. To

display the commands available to configure a cluster, enter the command:

print AdminTask.help("ClusterConfigCommands")

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 5. Finally, if you want to know more information about the CreateCluster command,enter the command:

print AdminTask.help("createCluster")

__ 6. Use the AdminApp object to list applications and application module information.

Information

The AdminApp object is used to work with application objects. This includes functions suchas installing, uninstalling, listing, and editing.

__ a. At the wsadmin command prompt enter:

print AdminApp.list()

All applications installed on the application server are listed.

7/21/2019 WAS V7.pdf


Student Exercises




Information

The list of installed applications on your machine may be different from the screen capture

above.

__ b. At the wsadmin command prompt, enter:

print AdminApp.listModules("TradeApplication")

A list of the installed Web and EJB Modules for the TradeApplication enterpriseapplication are displayed.

__ 7. Use the AdminControl object to get information about the domain, cell, and host.

Information

The AdminControl object is used to invoke operational commands on “live” running objects.

It supports utility methods for tracing, reconnecting the server, and converting data types.

__ a. At the wsadmin command prompt, enter:

print AdminControl.getCell()

The cell name is displayed.

__ b. At the wsadmin command prompt, enter:

print AdminControl.getNode()

The node name is displayed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. At the wsadmin command prompt, enter:

print AdminControl.getHost()

The node name is displayed.

__ 8. Use the AdminConfig object to modify the static configuration of a data source. Youwill modify the description of the data source in multiple steps using Jython

commands, wsadmin commands, and one variable.

Information

The AdminConfig object manipulates the static configuration data for a WebSphere

Application Server installation for all objects except applications. There are commands tolist, create, remove, display, and modify configuration data.

__ a. Verify the name of the data sources. At the wsadmin command prompt, enter:

print AdminConfig.list("DataSource")

The names of the data sources are displayed.

__ b. At the wsadmin command prompt, enter the following:

datasrc=AdminConfig.getid("/DataSource:Trade/")

• datasrc is a variable name.

• getid is an AdminConfig command that retrieves the configuration ID ofthe Data Source object.

• /DataSource:Trade/ is the hierarchical containment path of the

configuration object, including the actual name of the object.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. To see the result of the previous commands, enter:

print datasrc

__ d. To see the properties for the selected data source held by the datasrc variable,enter:

print AdminConfig.show(datasrc)

__ e. Modify the description of the data source using the command:

print AdminConfig.modify(datasrc, [["description", "Data source

used in the Trade application"]])

• modify is an AdminConfig command that changes the description of the

data source in the configuration ID (which is stored in the variable

datasrc) to the value “Data source used in the Trade application”.

• description is an attribute of server objects.

__ f. Display the attributes of the data source and make sure the change took place:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty print AdminConfig.show(datasrc)

__ g. Save the configuration changes:

AdminConfig.save()

__ 9. Use the AdminTask administrative object to get information about the node andserver.

7/21/2019 WAS V7.pdf


Student Exercises




Information

The AdminTask object is used to run administrative commands. Administrative commands

are discovered dynamically when you start wsadmin.

__ a. At the wsadmin command prompt, enter the following commands to gather

information about the node and server:

nodes=AdminTask.listNodes()

• nodes is a variable name.

• listNodes is an AdminTask command that displays all of the nodes in the

cell.

print AdminTask.listServerTypes(nodes)

• listServerTypes is an AdminTask command that lists server types forthe value of nodes

print AdminTask.listServers()

• listServers is an AdminTask command that lists the servers.

__ 10. Use various commands to get information on the configuration and server.

__ a. At the wsadmin command prompt, enter the following commands:

cell=AdminConfig.list("Cell") print cell

• cell is a variable name.

• list is an AdminConfig command that displays the cell.

cellname=AdminConfig.showAttribute(cell,"name") print cellname

• cellname is a variable name.

• showAttribute is an AdminConfig command that displays all of theattributes of the cell.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty nodes=AdminConfig.list("Node",cell) print nodes

• nodes is a variable name.

• list is an AdminConfig command that displays all of the nodes in the

cell.

nodename=AdminConfig.showAttribute(nodes,"name") print nodename

• nodename is a variable name.

• showAttribute is an AdminConfig command that displays all of theattributes of the nodes in the cell.

print AdminConfig.showall(AdminConfig.list("Node"))

• node is a variable name.

• showall is an AdminConfig command that displays all of the attributes of

the specified configuration object.server=AdminConfig.list("Server") print server

• server is a variable name.

• list is an AdminConfig command that displays the servers in the cell.

AdminTask.showServerInfo(server)

7/21/2019 WAS V7.pdf


Student Exercises




• showServerInfo is an AdminTask command that shows the informationon the server .

Work with applications

Use wsadmin to uninstall the ivtApp application. The application to be uninstalled must firstbe stopped. Once an application is stopped, you can uninstall it.

__ 1. Enter the following commands that will stop the ivtApp application and uninstall the

application.

__ a. This command gets the name of the application manager MBean for theapplications running on the server.

appManager=AdminControl.queryNames("type=ApplicationManager, cell="+cellname+",node="+nodename+",process=server1,*")

print appManager

Note

The variables cellname and nodename were created in the previous step.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. This command gets the application detail and assigns it to a variable.

app=AdminControl.queryNames("type=Application,cell="+cellname+", node="+nodename+",process=server1,J2EEName=ivtApp,*")

print app

__ c. This command gets the application name and assigns it to a variable.

appName=AdminControl.getAttribute(app,"name")print appName

__ d. This command stops the ivtApp.

AdminControl.invoke(appManager,"stopApplication",appName)

__ e. This command uninstalls the ivtApp.

AdminApp.uninstall(appName)

Information

Look for the message indicating the application ivtApp uninstalled successfully.

__ f. Save the configuration to the repository. This command will update the repository

with the information about the uninstalled ivtApp application.

AdminConfig.save()

7/21/2019 WAS V7.pdf


Student Exercises




Information

This sequence of commands is a typical example of what you would put in a generalpurpose Jython script. Once you try the individual commands and debug them, you can put

all the commands in a file called uninstall.py and use it every time you need to uninstall anapplication. You would modify the commands slightly to accept the name of the application

through a command-line parameter to the script.

__ 2. Verify the application has been uninstalled by using the administrative console. __ a. Log in to the administrative console using the user ID wasadmin and password

web1sphere

__ b. Expand Applications and Application Types. Select WebSphere enterprise

applications. The ivtApp application should no longer be listed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

__ 3. Reinstall the ivtApp application and verify that it is running. The ivtApp.ear file can

be found in the <was_root>\installableApps directory.

__ a. Copy the ivtApp.ear file from the <was_root>\installableApps directory to the <profile_root>\profile1\installableApps directory.

__ b. Enter the following command that will install and start the ivtApp application:

AdminApp.install("../installableApps/ivtApp.ear",["-appname

ivtApp"])This command installs the ivtApp.ear and gives it the name ivtApp. The

-appname parameter is an installation option.

Information

Make sure there is a space between -appname and ivtApp when you enter the

command. Look for the message indicating the application ivtApp installed successfully.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

You may or may not see the messages regarding Java EE security. If an EAR file contains

a was.policy file, its contents are displayed when you install the application. This is a wayof letting the administrator know that the file exists and as a reminder to check this file to

make sure that resources granted access are allowed by the security policies of the

organization.

__ c. This command saves the configuration to the repository.

AdminConfig.save()

__ d. This command starts the newly installed application.

AdminControl.invoke(appManager,"startApplication",appName)

__ 4. Verify the application has been installed by using the administrative console.

__ a. Log in to the administrative console, if needed, or refresh the currentadministrative console.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Expand Applications and Application Types. Select WebSphere enterprise

applications. The ivtApp application should be listed and running. If the

application is not shown in the list, you may need to log out of the administrativeconsole and log on again.

Information

You can also obtain the application status using the following wsadmin command:

print AdminControl.completeObjectName("type=Application,name=ivtApp,*")

If the ivtApp application is running, then an MBean is created and will provide output.

Otherwise, the command returns nothing.

__ c. Log out of the administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Exploring the scripting libraries

Many scripting operations are simple and straightforward. However, other operations might

require a bit of investigation, reading, and trial and error, making it difficult for some usersto take full advantage of scripting in their environments. In an effort to help users overcome

the complexity of scripting, a new set of script libraries has been introduced in WebSphereApplication Server V7.

In this part of the lab you take an initial look at the available libraries and explore what they

have to offer.

__ 1. Open Windows Explorer and navigate to the following folder:

<was_root>\scriptLibraries

Linux

Open file browser and navigate to <was_root>/scriptLibraries.

7/21/2019 WAS V7.pdf


Student Exercises




__ 2. Open each of the subfolders and discover the names of the libraries:

Note

The libraries use the administrative objects you looked at in the previous part of this

exercise. All of these libraries are loaded when wsadmin starts and are readily availablefrom the wsadmin command prompt, or to be used from your own scripts. Even though

source code is provided, it is not meant to be modified by the user. Users of the librariescall code in the libraries from their own scripts. You may copy parts of the library code to

other files and modify the copied code to improve it or better suit your needs.

__ 3. You can open the libraries in a text editor and look at the code. You will note that thecode is well documented and exceptions and other errors are handled gracefully by

providing meaningful error messages to the calling scripts. Use a text editor to openthe AdminJDBC script library:

<was_root>\scriptingLibraries\resources\JDBC\V70\AdminJDBC.py

Table 15: Scripting libraries

Directory location Script library

application\V70 AdminApplication AdminBLA

resources\J2C\V70 AdminJ2C

resources\JDBC\V70 AdminJDBC

resources\JMS\V70 AdminJMS

resources\Provider\V70 AdminResources

security\V70 AdminAuthorizations

servers\V70 AdminClusterManagement AdminServerManagement

system\V70 AdminNodeGroupManagement AdminNodeManagement

utilities\V70 AdminLibHelp

AdminUtilities

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty In each library, after the usual copyright and disclaimer statement, there will be a listof procedure examples. The AdminJDBC library has nine example functions:

- Ex1: createJDBCProvider Create a new JDBC provider in your environment. The script returns the configuration ID of the new JDBC provider.

- Ex2: createJDBCProviderUsingTemplate Use a template to create a new JDBC provider.

- Ex3: listJDBCProviderTemplates Display a list of configuration IDs for the JDBC provider templates.

- Ex4: createDataSource Create a new data source in your configuration. The script returns the configuration ID of the new data source.

- Ex5: createDataSourceUsingTemplate Use a teimplate to create a new data source in your configuration. The script returns the configuration ID of the new data source.

- Ex6: listDataSourceTemplates Display a list of configuration IDs for the data source templates.

- Ex7: listJDBCProviders Display a list of configuration IDs for the JDBC providers.

- Ex8: listDataSources Display a list of configuration IDs for the data sources.

- Ex9: help Display AdminJDBC script library online help.

Navigate to Example 7 listJDBCProviders. As you can see with this example and

all the examples in the library, these functions expose operations at a higher level

than those provided by the administrative objects and provide a better abstraction tothe script writer.

Examine the example functions provided by the library. Close the file when you are

done examining it.

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. A similar listing of functions available in a library can be obtained using the help()method. At the wsadmin prompt enter:

print AdminJDBC.help()

__ 5. As with the administrative objects, you can get help on a specific method. Enter:

print AdminJDBC.help("listJDBCProviders")

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. Not only can you use these commands in your own scripts, you can execute thecommands directly. Enter:

print AdminJDBC.listJDBCProviders()

As with any new library system it takes a while to become familiar and comfortablewith the functions available. By combining these library functions with your ownscripting logic in your Jython scripts, you can write scripts to configure your

application servers.

7/21/2019 WAS V7.pdf


Student Exercises




Using IBM Rational Application Developer to code, test, and debugJython scripts

The Rational Application Developer assembly and deploy tool is enhanced with featuresspecifically designed to write and debug Jython scripts.

In this section of the lab you write a simple script to set the value of one of many

WebSphere environment variables: in this case the variable that defines the path to theDB2 Universal JDBC driver.

__ 1. Start Rational Application Developer by clicking Start > Programs > IBM Software

Delivery Platform > IBM Rational Application Developer 7.5 > IBM Rational

Application Developer.

Linux

Start Rational Application Developer by navigating to /opt/IBM/SDP and invoking:

./eclipse &

__ 2. The Rational Application Developer Workspace Launcher window opens. TheWorkspace field identifies the directory to be used for your workspace. As scripts

are usually saved along with other application files, open the same workspace youused for assembling the Trade application.

Make sure the workspace is: <software_dir>\Assemble\TradeApp

Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

You could use any workspace. Some organizations have a workspace dedicated to holding

nothing but scripts.

__ 3. Once Rational Application Developer opens, the Java EE perspective will be in view.

Switch to the Java EE perspective if it is not open.

Note

To get to the Java EE perspective click Window > Open Perspective > Other. Select Java

EE (default) and click OK.

__ 4. Define the runtime environment. __ a. On the bottom pane of the Java EE perspective, click the Servers tab.

__ b. If a server has been previously defined, proceed to the next step (creating afolder to contain your scripts).

__ c. If a server has not been defined previously, continue with the rest of this step.

__ d. Right-click in the empty Servers view to get the context menu. Select New >

Server.

__ e. On the New Server pane, verify that the following fields are populated with thesevalues:

- Server’s host name: localhost

- Select the server type: WebSphere Application Server v7.0

- Server name: WebSphere Application Server v7.0 at localhost - Server runtime environment: click Add

• Name: WebSphere Application Server v7.0

• Installation directory: <was_root>

• Click Finish and the server runtime environment will be parapeted

7/21/2019 WAS V7.pdf


Student Exercises




- Server runtime environment: WebSphere Application Server v7.0

__ f. Click Next.

__ g. On the WebSphere Server Settings pane, accept the defaults:

- WebSphere profile name: profile1

- The following options are selected:

• Automatically determine connection settings

• Run server with resources within the workspace

• Security is enabled on this server

- User ID: wasadmin

- Password: web1sphere - WebSphere server name: server1

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ h. Click Test Connection. The Test Connection window will appear. It shoulddisplay Connection successful.

__ i. Click Finish.

7/21/2019 WAS V7.pdf


Student Exercises




__ 5. Create a folder to contain your scripts, called Scripts.

__ a. From the main menu, click File > New > Other.

__ b. From the list of available project types expand the Jython folder and select Jython Project. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Enter Scripts for the Project name and click Finish.

__ 6. Create a new Jython script file under the Scripts folder.

__ a. Right-click the Scripts folder to open the context menu. Click New > Other.

__ b. From the list of available project types select Jython > Jython Script File. ClickNext.

__ c. Enter setWASEnvVariable.py for the file name. Click Finish.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. The file opens in the Jython source editor on the upper right view of the Java EEperspective.

You also see the file in the workspace structure under the Scripts folder. If the file

is not visible, select the Scripts folder and right-click to open the context menu.Click Refresh. The file should appear in the list. Now you are ready to write the

script.

Creating the script

As you know, the application server uses many of its own environment variables toconsolidate information, such as paths, in one place. Once the environment variable is set,

it is used in many places instead of entering the information contained in the variable manytimes. This reduces maintenance because if the information held in the variable ever

changes, it only needs to be changed in one place. All the users of that information get it byreferencing the environment variable and not the location directly.

One such variable is the one used when accessing DB2 database drivers. The server

needs to know where to find the drivers in order to add this information to its class path.

This script sets the DB2UNIVERSAL_JDBC_DRIVER_PATH environment variable, but itcould be used to change any variable.

__ 1. On the Jython editor view enter the following code, which makes up the “main” of thescript.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

If you are not familiar with the term “main”, it refers to a method, or entry point, in a program

that starts things rolling. In procedural languages what starts a program going is usually thefirst line of code encountered. In C, C++, and Java there is a method actually called main

which is executed after the program is loaded. In Jython the first line executed is not

necessarily the first line of the program or a method called main, but the first unindentedline that has not been designated as a subroutine with the def keyword. Other languagesuse other conventions.

Ask the AdminControl object for the node’s name using the getNode() method.When typing this line of code in the editor, stop typing after entering:

nodeName = Admin

__ 2. Press Ctrl+Space; this key combination invokes command completion. RationalApplication Developer provides you with all logical choices that may complete the

line you are typing. From the list double-click to select AdminControl.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Type a period and again press Ctrl+Space. This time all the methods for theAdminControl object appear on the list.

Continue typing and see how the list narrows as you enter characters. Type get

and now you only see getter methods. Type an N, and select getNode from the list.

You should now have the complete line in the editor:

nodeName = AdminControl.getNode()

__ 4. Enter the rest of the code below using command completion and experimenting to

see when it works and when it does not. Make sure to use the forward slash as youenter the directory path. If you do not want to type all the code, you can copy it from

<software_dir>\wsadmin\setWASEnvVariable.py.

varName = "DB2UNIVERSAL_JDBC_DRIVER_PATH"newVarValue = "<db2_root>/java"

lf=java.lang.System.getProperty("line.separator")

changeEnvValue(varName, newVarValue)

print ("Saving configuration")

AdminConfig.save()

Linux

If you copy and paste from the <software_dir>/wsadmin/setWASEnvVariable.py fileyou must edit the <db2_root>/java path.

__ 5. Note the line of code below:

changeEnvValue(envVarName, envVarValue)

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty This code represents a subroutine call to the method changeEnvValue().

In Jython, subroutines must appear in the program before the code that calls them.This is a Jython interpreter restriction. Write the method now starting at the top of

the file, before the code you wrote in the previous step:

Warning

Be careful when entering the code below to maintain the indentation shown. Indentation

(leading white space) determines blocks of code in Jython. You may use spaces or tabs toachieve the level of indentation desired.

Enter lines, which are shown split below, in one single line using the editor.

If you do not want to type all the code, you can copy it from:

<software_dir>\wsadmin\setWASEnvVariable.py.

Even though the code above seems complex, with a little explanation it will becomeclearer as to how it sets the environment variable:

Line 1: def changeEnvValue(envVarName, envVarValue):

Line 2: print("Setting variable " + varName + " on node " +

nodeName + ", to " + newVarValue)

Line 3: nodeId = AdminConfig.getid("/Node:"+nodeName+"/")

Line 4: varSubstitutions =

AdminConfig.list("VariableSubstitutionEntry",nodeId).split(lf)

Line 5: for varSubst in varSubstitutions:

Line 6: curVarName =

AdminConfig.showAttribute(varSubst,

"symbolicName")

Line 7: print AdminConfig.showall(varSubst, "value")

Line 8: AdminConfig.modify(varSubst,[["value",

newVarValue]]) Line 9: break

7/21/2019 WAS V7.pdf


Student Exercises




- The subroutine is called from the main code, passing it two parameters: thename of the variable to change and the new value to be set for the variable.

- The first line prints an information message indicating the variable name and

the new value for the environment variable. It also prints the name of thenode where the variable will be changed.

- The next line gets the node ID using the node’s name as a parameter to the AdminConfig.getid() method.

- The next line performs two operations. First it gets a list of all variable

substitution entries. These entries are not returned in a true list that can bemanipulated, but instead are returned in a long string containing all the

entries, with a line feed character between each entry. The returned string

must be converted into a true list object. This is accomplished by splitting thestring using the line feed character as the delimiter. The line feed character is

obtained at run time since it changes between operating systems. This wasdone in the main of the script.

- Now that you have a list, you can iterate through the list using a for loop. Inthe loop each value in the list is assigned to the varSubst variable.

- The first line inside the loop uses the showAttribute() method of

AdminConfig to retrieve the actual name of the environment variable, whichis printed on the next line.

- Changing the value is accomplished by using the modify() method of

AdminConfig.

- If the variable was found and changed, the loop is broken by the keyword break

. - If the variable was not found in this iteration the loop continues until all the

environment variable names are looked up.

__ 6. Save the file by pressing Ctrl+s.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

To get the line numbers that appear on the left of the window from the context menu, click

Window > Preferences > General > Editors > Text Editors. Check the box in front of

Show line numbers and click Apply. Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




__ 7. Run the setWASEnvVariable script by selecting Run As > Administrative Script from the script’s context menu.

Note

If you did not complete the previous exercises, your screen capture may look different from

the one above. TradeApplication, TradeEJB, and TradeWeb will not appear in the navigatorwindow.

__ 8. The first time you attempt to run the script you must provide some configurationparameters on the Edit configuration and launch pane.

__ a. From the Scripting runtime drop-down list, select an existing runtime

environment and proceed to the next step.

__ b. If you need to create a runtime environment, click New to create a new scriptingruntime and continue with this step.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Select WebSphere Application Server V7.0 from the runtime environment listand click Next.

__ d. On the WebSphere Runtime pane, enter or browse to: <was_root> . Click

Finish.

__ 9. Complete the script configuration.

__ a. Under Security select the As defined in soap.client.props or

sas.client.props file option. You set the user ID and password in the properties

7/21/2019 WAS V7.pdf


Student Exercises




file earlier in this exercise (if not, choose Specify and enter wasadmin andweb1pshere as the user ID and password).

__ b. Click Apply.

__ c. Feel free to explore the other tabs of the pane to see what is available. For

example, you may pass a command-line parameter under the Arguments tab.

__ d. Click Run. After this initial setup you may just click Run from the toolbar;Rational Application Developer remembers these values.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Rational Application Developer assembly and deploy will attempt to run the scriptin wsadmin. Any errors or output will appear on the Console view on the bottom

right pane of perspective. The Console view will be opened automatically asrequired.

__ f. Make sure the script runs without any errors. There will initially be numerous

packaging messages that appear in red. They can be ignored.

__ g. There are times when the console seems to disappear, and a different console is

displayed. This is because there are multiple consoles that are viewable. To see

the list and select the console for the script, select the Display SelectedConsole drop-down list, and choose setWASEnvVariable.py.

Using the Jython debugger

Sometimes logic errors will prevent your script from producing the expected results. In

those cases it is very useful to run the script using the Jython source debugger. Using thedebugger, you are able to set breakpoints, examine variable values, cycle through the code

step-by-step and, in most cases, figure out where the problem is.

Sometimes it is useful to run a script through the debugger to figure out how it works. This

is especially true when you are given a script someone else wrote and now you need tomaintain it.

7/21/2019 WAS V7.pdf


Student Exercises




A good way to start is to place a breakpoint at the first executable line of the script.Themarker bar is the dark vertical bar located along the left side margin of the Jython editor

view.

__ 1. From the Jython editor, set a breakpoint on the line containing the code:

nodeName = AdminControl.getNode()

Locate the line in the script, place the mouse pointer so that it is situated on top of

the marker bar and aligned with the line of code where you want to apply thebreakpoint, right-click, and select Toggle Breakpoint (you can also simply

double-click).

__ 2. Select the setWASEnvVariable script on the Enterprise Explorer view. Right-click

to open the context menu. From the context menu, click Debug As >Administrative Script.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 3. Click Yes to switch to the Debug perspective.

7/21/2019 WAS V7.pdf


Student Exercises




__ 4. The Debug perspective is opened. The script is started and then suspended oncethe breakpoint is reached.

Examine the Debug perspective:

• There are five panes; the default views are: Debug, Variables, Source, Outline,and Console. There are other views accessible through tabs on the panes.

• The toolbar on the Debug view controls execution of the script allowing you to

Stop (Terminate), Run to the next breakpoint, Step into subroutine, Step oversubroutine, Return from subroutine. These controls give total control over the

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty execution of the script. There are function keys F5-F8 that are assigned thesesame functions.

• Below the toolbar you see the execution stack. It displays the calling sequencethat executed.

• The Variables view allows you to examine the value of the variables that are in

the scope of the breakpoint, that is, global variables and variables local to the

subroutine you are in. At the moment you cannot change the value of thedisplayed variable.

• Sharing the same pane as the Variables view is the Breakpoints view. Thereyou can control the various breakpoints of the script, enabling and disabling as

necessary.

• The Source view shows the script. From the context menu on this view, youhave access to a useful function: Run to Line. You can place the cursor

anywhere on the source and click Run to Line, and the debugger will executecode to that line. It effectively is a temporary breakpoint.

7/21/2019 WAS V7.pdf


Student Exercises




• The Outline view shows the methods and loops in the script, allowing you toquickly find and jump to areas of interest.

• The Console view displays errors and other messages from the script and

server.

• Feel free to experiment in the different views and discover the details of what isavailable.

__ 5. Press the F6 key, or click the corresponding button on the Debug view’s toolbar tostep over the statement where the debugger is stopped. This advances execution

one statement at a time.

__ 6. Watch the Variables view and look for the newly assigned variable and its value.

__ 7. Step three more lines, watching the Variables view.

Note how the type and value of the selected variable is displayed, in detail, at the

bottom of the view.

__ 8. The next line should be the call to the subroutine:

changeEnvValue(varName, newVarValue)

__ 9. This time press F5, or click the corresponding button on the Debug view’s toolbar to

step into the subroutine.

__ 10. Continue to press F6 to run through the subroutine and its loop. Observe when amatching variable is found from the list of environment variables how the value is

actually changed and how the loop ends when the break statement is executed.

__ 11. After the subroutine ends, control is returned to the main part of the script where a

message is printed and the configuration is saved. __ 12. Advance one more step, and the thread terminates. If you have to run through the

program again, you can relaunch from a terminated thread. From the Debug view,select the terminated thread and right-click to open the context menu. Select

Relaunch.

You now have the basic skills for writing, testing, and debugging Jython scripts. Of coursethere is a lot more to it than this short exercise. Probably the most complex task ahead of

you is to become familiar with what the administrative objects can do. There are many

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty examples and excellent articles in the information center and on the WebSphere DeveloperWeb site.

A good resource to learn about the methods available in the information center are the

pages named:

• Using the AdminConfig object for scripted administration • Commands for the AdminConfig object

These pages exist for all other administrative objects; just substitute their names forAdminConfig and search the information center.

Using console command assist

The Websphere administrative console has the ability to display the command it uses toaffect certain configuration changes.

Information

Not all configuration commands are displayed in this version. As new releases becomeavailable, the number of administrative console actions that display their commands will

increase.

If the Rational Application Developer assembly and deploy tool is running, it cancommunicate with the administrative console and receive these commands so that they

can be inserted into Jython scripts being worked on Rational Application Developerassembly and deploy. This feature effectively gives you the command to reuse in a script,

saving you the time and research to figure it out on your own.

This feature is configured using the console and the command used by the consoleapplication.

In this exercise, set up the administrative console and Rational Application Developer to

communicate with each other.

__ 1. Make sure the server is running and log in to the administrative console.

__ 2. From the main menu on the left expand System administration and select

Console Preferences.

__ 3. On the Console preferences window select both:

• Enable command assistance notifications

7/21/2019 WAS V7.pdf


Student Exercises




• Log command assistance commands

__ 4. Click Apply.

__ 5. Rational Application Developer should still be open from the previous section. If it isnot open, open it to the same workspace on which you were working.

__ a. Make sure you are on the Java EE perspective.

__ b. From the main menu select Window > Show view > Other.

__ c. Expand Server and select WebSphere Administration Command.

__ d. Click OK.

__ e. Make sure the WebSphere Administration Command view is now visible.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. Click the Select Server to Monitor drop-down arrow and click WebSphere

Application Server v7.0 at localhost.

Information

If the server name is not available on the list, switch to the Servers view and make sure theserver is up and running.

__ 6. On the administrative console expand Applications and Application Types. Click

WebSphere enterprise applications.

__ 7. On the far right, under Help, click View administrative scripting command for

last action.

This opens a new browser window where the last few administrative commands canbe seen and also where you can control the behavior of command assistance.

__ 8. Expand Preferences. If not already selected, check both command assistancepreferences:

• Enable command assistance notifications

7/21/2019 WAS V7.pdf


Student Exercises




• Log command assistance commands

Click Apply.

__ 9. From the administrative console perform the following sequence of commands. As

you perform the commands, switch between the Administrative ScriptingCommands browser page, and Rational Application Developer’s WebSphere

Administration Command view to see which commands show up in the windows:

• From the navigation menu, expand Resources and JDBC.

• Click JDBC providers.

• Click DB2 Universal JDBC Driver Provider (XA).

• From the navigation menu, click Data sources.

• Click Trade datasource. • Change the description of the data source to Used by Trade application.

• Click OK.• Save the change.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 10. View the Rational Application Developer WebSphere Administration Command view.

Select a command in the list and right-click to open the context menu. There arethree options available:

- Insert Insert that command at the cursor position of a Jython script open in theJython editor.

- wsadmin Command help Get help on the command.

- Remove Remove the command from the list.

When requesting help, a Web browser view opens in Rational Application Developerand displays the information center page for that command, or administrative object.

__ 11. Feel free to experiment using the console, inserting commands into a Jython script.

__ 12. Exit Rational Application Developer.

Using properties file-based configuration

WebSphere Application Server V7 provides a new set of utilities for working with server

configuration using properties files. You can create a properties file of human readable keyvalue pairs based on your environment, make modifications to that file, and then apply the

updated properties to a server. The objective of this portion of the lab is to provide you witha basic understanding of this new technique for administering your environment.

You will extract the EndPoint resource for server1 that contains the list of port name value

pairs.

__ 1. Using wsadmin, extract the properties for the server1.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Navigate to the bin directory of the profile1: <was_root>\profiles\profile1\bin

__ b. Start wsadmin.




__ c. Properties files can be extracted for a variety of configuration attributes at

different levels: a cell, a node, a server, one container in that server, and others.If you know what type of properties you want to modify, you can extract a

properties file for your server using an object type filter. In this case you are

going to extract the resource type EndPoint for server1 into a properties filecalled endpoint.props. Enter the command:

AdminTask.extractConfigProperties("-propertiesFileName

endpoint.props -configData Server=server1 -filterMechanism

SELECTED_SUBTYPES -selectedSubTypes [EndPoint]")

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. The properties file is located in the current directory, in this case,<profile_root> \profile1\bin. Open the endpoint.props file with a text editor.

__ e. Open the administrative console. From the navigation tree, expand Servers and

Server Types. Click WebSphere application servers.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. From the server list click server1 to open the configuration work area. Under

Communications, click Ports.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ g. Compare the port values from the properties file with the ports listed on theadministrative console. You are going to change the port value for

SIB_MQ_ENDPOINT_ADDRESS. Click server1 from the breadcrumb trail andreturn to the configuration tab for server1. Leave the administrative console

open.

__ 2. Modify the endpoint.props file.

__ a. Locate the port and value pair for SIB_MQ_ENDPOINT_ADDRESS. Change theport value, currently 5558, to 15558

__ b. Save the updated file, but do not close it.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Validate the updated properties file.

__ a. From the wsadmin command line enter:

AdminTask.validateConfigProperties("-propertiesFileName

endpoint.props")

__ b. If the file validation is successful, “true” will be displayed as output.

__ 4. Apply the updated properties file to the configuration.


AdminTask.applyConfigProperties("-propertiesFileName

endpoint.props")

__ b. If the configuration is updated successfully, two single quotes will be displayed

as output.

__ 5. Save the changes.


AdminConfig.save()

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. From the administrative console, click Ports. Notice that the port value for

SIB_MQ_ENDPOINT_ADDRESS has changed to 15558, reflecting the change you

made in the properties file.

7/21/2019 WAS V7.pdf


Student Exercises




__ 7. Change the port value for SIB_MQ_ENDPOINT_ADDRESS back to 5558.

__ a. Modify the properties file and change the port value forSIB_MQ_ENDPOINT_ADDRESS to 5558. Save and close the properties file.

__ b. Validate the updated properties file.

AdminTask.validateConfigProperties("-propertiesFileName

endpoint.props") __ c. Apply the updated properties file to the configuration.

AdminTask.applyConfigProperties("-propertiesFileName

endpoint.props")

__ d. Save the changes.

AdminConfig.save()

__ e. Verify the change by checking the port values from the administrative console.SIB_MQ_ENDPOINT_ADDRESS should now have a port value of 5558.

__ f. Log out of the administrative console.

__ g. Exit wsadmin.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2


In this lab, you learned to manipulate wsadmin objects from the command line using theJython languages.

You experimented with Rational Application Developer to create and step through a

wsadmin script written in Jython.

Finally you set up the WebSphere administrative console to communicate with RationalApplication Developer to pass any administrative commands used by the administrative

console back to Rational Application Developer.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 9. Creating a federated cell 9-1

5.2

Xempty Exercise 9. Creating a federated cell


In this lab exercise, you experience the process of creating aWebSphere cell through the generation of a deployment manager

profile followed by the federation of application server profiles.



• Create a deployment manager profile

• Back up the deployment manager configuration

• Use the deployment manager administrative console

• Federate a node into the deployment manager cell

• Create an additional custom profile

• Create an unmanaged Web server node

• Start and stop the Web server by using the console

• Map an application to the Web server

Introduction

This exercise goes through the process of creating and federating a

cell. The initial steps include creating two additional profiles, the first ofwhich will be a deployment manager profile. Once the deployment

manager profile is created, profile1 is federated into the cell. Then acustom profile is created and federated at the same time.

This exercise not only demonstrates the process of creating a cell, but

it also prepares the lab environment for other important steps includingcreating a node to manage a remote Web server and clustering an

application server.

Required materials

To perform this exercise, you must have the application server named server1 started.

DefaultApplication and TradeApplication must be installed and running on server1.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises




5.2


During this exercise you transition your stand-alone application server environment to a cellenvironment containing two federated nodes and an unmanaged node for a Web server. It

is important as you progress through the exercise that you have a good understanding ofwhat you are creating. A topology of the existing environment will be shown as you begin

each section of the exercise to help you understand how you are about to change theenvironment.

The diagram below illustrates the beginning topology. As you begin the exercise, you have

one stand-alone application server, named server1, contained in a node, namedwas7hostXXNode01.

When you complete the exercise you will end up with a cell, named was7hostXXCell01,

containing the following nodes:

• Deployment manager node, named was7hostXXCellManager01

• A federated node, named was7hostXXNode01, containing a node agent and an

application server, named server1 • A federated node, named was7hostXXNode01, containing only a node agent

• An unmanaged node, named ihsnode, containing an IHS administrativeprocess and a Web server, named webserver01

7/21/2019 WAS V7.pdf


Student Exercises




Create a deployment manager profile using the Profile Management Tool

During this section of the exercise you are going to create a deployment management

profile that defines a cell, named was7hostXXCell01, containing a deployment manager

node, named was7hostXXCellManager01. The existing application server, server1, will

continue to be a stand-alone server contained in the node, was7hostXXNode01.

The Profile Management Tool is a GUI tool for creating WebSphere profiles. Using theprofile wizard, you can create an application server profile, deployment manager profile,

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty custom profile, or cell profile (which creates both a deployment manager and managednode). First create a deployment manager profile.

__ 1. Start the Profile Management Tool. This is the same wizard you used earlier to

create profile1.

__ a. Click Start > Programs > IBM WebSphere > Application Server Network

Deployment V7.0 > Profile Management Tool.

The UNIX command to run the Profile Management Tool is:

<was_root>/bin/ProfileManagement/pmt.sh

Information

It is also possible to create profiles from the command line using the manageprofiles-create script located in the <was_root>\bin directory.

For example:

manageprofiles -create -profileName profile2

-profilePath "<profile_root>\profile2"

-templatePath "<was_root>\profileTemplates\default"

-nodeName was7host01Node02 -cellName was7host01Cell02

-hostName was71host01

7/21/2019 WAS V7.pdf


Student Exercises




__ b. The Welcome panel for the Profile Management Tool appears.

__ c. Click Launch Profile Management Tool.

__ d. The Profiles list panel appears. Click Create.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. Create a deployment manager profile called DmgrProfile.

__ a. From the Environment Selection panel, select Management and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. From the Server Type Selection panel, select Deployment manager. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Select Advanced profile creation to specify your own configuration valuesduring profile creation. Click Next.

__ d. Ensure that the Deploy the administrative console (recommended) checkbox is selected. The administrative console will be necessary for this class. Click

Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. From the Profile Name and Location panel, provide the following name andlocation information:

- Profile name: DmgrProfile

- Profile directory: <profile_root>\DmgrProfile

- Do not select the Make this profile the default option.

__ f. Click Next.

Information

The default profile will initially be the first profile created. It is also possible to change whichprofile is designated as the default with the Profile Management Tool or the manageprofiles

command.

When running commands from the <was_root>\bin directory, commands will be

executed against the runtime defined by the default profile. It is also possible to specify a

particular profile using the -profileName argument.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ g. The Node and Host Names panel allows you to set the node name, server name,and host name. Default values will be filled in based on the detected host name

for your server.

On UNIX systems, the host name may be the long name (was7host01.ibm.com

). Acceptwhatever the default is. Make sure that you are consistent in later exercises.Ma

Ensure that the Node name and Host name are correct (they should be based onthe short form of the host name and not localhost — for example,

was7host01CellManager01). For Server name, keep the default name (short namefor Windows and long name on UNIX). Click Next.

__ h. From the Administrative Security panel, you choose whether to enable

administrative security. Verify that the Enable administrative security optioncheck box is selected. Enter the following information:

- User name: wasadmin

- Password: web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




__ i. Click Next.

__ j. From the Security Certificate (part 1) panel, accept the default selections:

- Create a new default personal certificate

- Create a new root signing certificate

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ k. Click Next.

Note

The Issued to distinguished name and the Issued by distinguished name on theSecurity Certificate (Part 2) panel will have a common name (CN) that can take different

forms depending on your environment:


• Fully qualified domain name (FQDN) — such as was7host01.localdomain or was7host01.ibm.com

7/21/2019 WAS V7.pdf


Student Exercises




__ l. Accept the Security Certificate (part 2) panel defaults. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ m. The Port Values Assignment panel allows you to set any ports for thedeployment manager to prevent conflicts with other profiles. Accept the default

port values (which may be different from the example shown below).

Information

Note the administrative console port for the deployment manager. This will be used later inthis exercise.

Ordinarily, the administrative console port would use port 9060. But since these labs havealready installed a stand-alone application server, the Profile Management Tool avoids

reuse of any ports. It therefore uses port 9061 instead.

__ n. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ o. For this lab, do not run the deployment manager as a Windows service. From theWindows Service Definition panel, deselect the box for Run the deployment

manager process as a Windows service. Click Next.

Depending on which UNIX operating system is being used, there may be a similar window

offering to run the deployment manager as a service. In that case, do not have the processrun as a service and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ p. The Profile Creation Summary panel appears with all of the choices you havemade on previous panels. Verify the summary information with what you entered

previously. Click Create.

7/21/2019 WAS V7.pdf


Student Exercises




The creation of the profile usually take several minutes to complete.

__ q. The profile creation completes and the profile DmgrProfile is created. Notice

that the Launch the First steps console check box is selected. Click Finish

and the First steps console will launch.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 3. The First steps console is associated with the deployment manager profile,DmgrProfile, that was just created. Each profile has its own First steps console.

Click Installation verification from the console.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. The installation verification test tool runs and displays messages to indicateverification status. Use the scroll bar to scroll to the bottom to see all the

messages. The following messages will be displayed if the installationverification was successful:

• IVTL00701: The Installation Verification Tool verification succeeded.

• IVTL00801: The installation verification is complete.

Information

It is possible that there may be several warnings displayed. These may be ignored at this

point.

__ b. Close the First steps output - Installation verification output window. __ c. Click Exit to close the First steps console.

__ d. Click File > Exit to close the Profile Management Tool.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Backup the DmgrProfile configuration

Before continuing, it is a good idea to back up the configuration for the DmgrProfile that

was just created.

__ 1. In a previous lab, the backupConfig command was used to create a backup. There

is another WebSphere tool that makes backups of a profile as well (other than

operating system-level backups). The backupConfig tool backs up only theconfiguration directory of a profile. The command manageprofiles

-backupProfile backs up the configuration directory as well as other metadata.

Information

From the information center: -backupProfile

Performs a file system backup of a profile folder and the profile metadata from the profile

registry file. Any servers using the profile that you want to back up must first be stoppedprior to invoking the manageprofiles command with the -backupProfile option. The

-backupProfile parameter must be used with the -backupFile and -profileNameparameters, for example:

manageprofiles.bat(sh) -backupProfile -profileName <profile_name>

-backupFile <backupFile_name>

__ a. In a command-prompt window, navigate to the <profile_root>\DmgrProfile\bin directory.

The UNIX commands for this step are:

./serverStatus.sh -all

./stopManager.sh

./manageprofiles.sh -backupProfile -profileName DmgrProfile

-backupFile <software_dir>/backups/Dmgr_initial_backup.zip

__ b. Verify the status of the deployment manager process by entering the following

command:

serverStatus -all

Specify the user ID wasadmin and password web1sphere in the dialog box

when you are prompted.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Stop the deployment manager process if it is running by issuing the followingcommand:

stopManager

Specify the user ID wasadmin and password web1sphere in the dialog box

when prompted.

__ d. Once the deployment manager has stopped, issue the following command to

back up the entire profile:

manageprofiles -backupProfile -profileName DmgrProfile

-backupFile <software_dir>\backups\Dmgr_initial_backup.zip

__ 2. Since profile1 will be federated shortly, create a backup for it as well.

The UNIX commands for this step are:

cd <profile_root>/profile1/bin

./stopServer.sh server1

./manageprofiles.sh -backupProfile -profileName profile1 -backupFile

<software_dir>/backups/Profile1_prefederation.zip

__ a. From the <profile_root>\profile1\bin directory, stop server1:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty stopServer server1 -profileName profile1

__ b. Make sure to perform the manageprofiles command from the <profile_root>\profile1\bin directory. Once server1 has stopped, issue the

following command to back up the entire profile:

manageprofiles -backupProfile -profileName profile1 -backupFile

<software_dir>\backups\Profile1_prefederation.zip

__ 3. Start the deployment manager.

__ a. In a command-prompt window navigate to <profile_root>\DmgrProfile\bin

and run the startManager command to start the deployment manager.

Windows

You can also start the deployment manager using the Start menu by clicking Start >

Programs > IBM WebSphere > Application Server Network Deployment V7.0 >

Profiles > DmgrProfile > Start the deployment manager.


./startManager.sh

Federate profile1 into the deployment manager’s cell

During this section of the exercise you are going to federate the application server node,

defined by profile1 and named was7hostXXNode01, into the cell was7hostXXCell01, which

7/21/2019 WAS V7.pdf


Student Exercises




is defined by the deployment manager profile. The federation process will add a nodeagent to the application server node.

__ 1. If you backed up the profile for profile1 in the previous section, the server needs to

be started. Backing up a profile causes the profile server to be stopped.

__ a. Navigate to the <profile_root>\profile1\bin folder and execute theserverStatus server1 command.

__ b. If server1 is not running, start server1.

__ 2. Open the administrative console for the deployment manager.

__ a. Open a Web browser and specify the following address:

http://localhost:9061/ibm/console

Windows

You can also start the deployment manager’s console using the Start menu by clicking

Start > Programs > IBM WebSphere > Application Server Network Deployment V7.0 >

Profiles > DmgrProfile > Administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. If prompted, on the Certificate Error window click Continue to this website (not

recommended) to accept the console’s certificate. You can install the certificate,

as you did in the first exercise, to correct this problem.

Accept any certificates that are offered.

__ c. Log in to administrative console as user ID wasadmin with a password of

web1sphere

__ 3. Federate a node into the cell.

Information

In this lab environment, synchronizing clocks will not be an issue since the cell will be

running on a single machine. But, when federating distributed machines, it is necessary tomake sure that the clocks are within five minutes of each other..

__ a. From the deployment manager administrative console navigation tree, expand

System administration. Click Nodes.

__ b. Click Add Node.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. The Managed node option is selected as default. Keep this setting. A managednode contains a WebSphere application server and a node agent. The

application server runs as part of the network deployment environment. Click

Next.

__ d. Specify your host name was7hostXX (where XX is 01, 02, 03 ...) for the host.

Specify security user names and passwords for both profile1 and the deploymentmanager. The user name and password should be wasadmin and web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Select the options to Include applications and Include buses. Keep allremaining defaults.

__ f. Click OK.

Information

The port number above is the JMX connector port of the node you want to federate to the

cell.

7/21/2019 WAS V7.pdf


Student Exercises




__ g. On the next window do not select the node agent to run as a Windows service.Click OK.

Depending on the version of UNIX, this screen may not appear.

__ h. Verify that the node was added to the cell configuration. The console messageNode was7hostXXNode01 has been successfully federated will be

displayed.

__ i. Click View the available nodes, which is displayed at the end of the messagelist.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 4. Verify the cell configuration.

__ a. Click View the available nodes. Two nodes should be listed, the deploymentmanager (was7hostXXCellManager01) and the was7hostXXNode01 node that

was just added.

__ b. Verify that the node agent on was7hostXXNode01 has started. From System

administration, click Node agents. The status of the node agent is Started.

7/21/2019 WAS V7.pdf


Student Exercises




__ 5. Start the application server and test the snoop servlet.

__ a. From the navigation tree, click Servers > Server Types > WebSphere


__ b. Select server1 and click Start. The status for server1 should now be started.

__ c. Verify the DefaultApplication is running. From the navigation tree, go to

Applications > Application Types > WebSphere enterprise applications. DefaultApplication should be running.

__ d. Open another browser window and enter the following address:


__ e. Verify that the snoop servlet works.

Create a custom profile and federate into the deployment manager’s cell

During this section of the exercise you are going to create a custom profile, profile2, that

defines a node, named was7hostXXNode02. The custom profile will be automaticallyfederated it into the cell, was7hostXXCell01.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty A custom profile is useful because it does not create any application servers on the node; itonly creates the configuration and the node agent. This means that no server1 will be

created on that node. This is very helpful for expanding clusters.

__ 1. Start the Profile Management Tool.



The UNIX command to run the Profile Management Tool is:

<was_root>/bin/ProfileManagement/pmt.sh

__ b. The Welcome window for the Profile Management Tool appears. Click Launch

Profile Management Tool.

__ 2. Create a custom profile called profile2 and federate it to the deployment managersconfiguration.

__ a. Click Create from the Profiles list panel.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. On the Environment Selection panel click Custom profile. Click Next.

__ c. On the Profile Creation Options page, select Advanced profile creation to

specify your own configuration values during profile creation. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. For the profile name and location enter profile2 and <profile_root>\profile2

Click Next.

__ e. Ensure that the Node name and Host name are correct (they should be based

on the short form of the host name and not localhost — for example,

7/21/2019 WAS V7.pdf


Student Exercises




was7host01Node02). For Server name, keep the default name (short name forWindows and long name on UNIX). Click Next.

Information

For these labs, use the short name for your host. Although it is perfectly fine to use anotherform of the host name, it is important to be consistent. Since the short name was used in

the initial WebSphere installation lab, the short name should be used here as well.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. On the Federation panel enter the following information:

- Deployment manager host name: was7hostXX (where XX is 01, 02, 03 ...) - User name: wasadmin

- Password: web1sphere

- Do not click the Federate this node later check box.

__ g. Click Next.

Information

Not selecting Federate this node later causes the node to be federated now as part of theprocess defined by the wizard.

7/21/2019 WAS V7.pdf


Student Exercises




__ h. Accept the defaults on the Security Certificate (Part 1) panel. Click Next.

__ i. Accept the defaults on the Security Certificate (Part 2) panel. Click Next.

__ j. Accept the default on the Port Values Assignment panel. Click Next.

__ k. On the Profile Creation Summary panel, click Create.

__ l. The profile creation is now complete.

__ m. On the Profile Creation Complete panel deselect the Launch the First steps

console option. Do not use the First steps console for profile2. Click Finish toexit the wizard.

__ n. Close the Profile Management Tool.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 3. The node was7hostXXNode02 has been automatically federated into thedeployment managers configuration. Verify these new configuration changes.

__ a. Using the administrative console, list the nodes. From the navigation tree,

expand System administration. Click Nodes. There should be the federatednode was7hostXXNode02. Updates sometimes require a console relogin.

Information

Using a custom profile does not create a server instance. This is useful when adding nodesto a cell since the intention of federating a new node into a cell is normally to either addcluster members to the node or create servers named something other than server1..

__ 4. Verify that both node agents have been started.

__ a. From the navigation tree, click Node agents.

__ b. If any of the node agents need to be started, use the command:

<profile_root>\profileX\bin\startNode

(where X

is 1

or 2

)


<profile_root>/profileX/bin/startNode (where X is 1 or 2)

7/21/2019 WAS V7.pdf


Student Exercises




Add the IBM HTTP Server to the cell

During this section of the exercise you are going to add an unmanaged node, ihsnode, to

the cell was7hostXXCell01. You will also add a Web server, webserver01, to the

unmanaged node. Information about the Web server is communicated to the deployment

manager through the IHS administrative process.

Create a new node and add the Web server to the node. When adding a node you maycreate either a managed node or unmanaged node. A managed node contains a

WebSphere application server and a node agent. An unmanaged node does not have anode agent and is used for defining remote Web servers in the topology.

__ 5. Create a new unmanaged node for the Web server.

__ a. In the navigation tree, expand System administration and click Nodes.

__ b. Click Add Node.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. In the Add Node window, select Unmanaged node and click Next.

__ d. In the Nodes window enter configuration information for the node:

- Name: ihsnode

- Host Name: was7hostXX (where XX is 01, 02, 03 . . .)

- Platform Type: Windows

Enter the appropriate Platform Type for your environment.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. Click OK.

__ f. Save the changes.

__ g. The node ihsnode should now be displayed in the list of nodes.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Add the Web server to the configuration

In this step the Web server definition will be added to the ihsnode.

__ 1. Add the Web server to the ihsnode configuration.

__ a. From the navigation tree, go to Servers > Server Types > Web servers.

__ b. ClickNew

to add a Web server. __ c. On Step 1 of creating a new Web server enter the following information:

- Select ihsnode from the Select node drop-down list.

- For Server name, enter: webserverXX (where XX is 01, 02, 03 ...)

- Select IBM HTTP Server from the Type drop-down list.

Information

The Web server name must match the name that was assigned during the IBM HTTP

Server installation. You can check the Web server name by looking in <plugin root>/logs..

Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. On Step 2, specify the Web server template. Ensure that IHS is selected andclick Next.

__ e. On Step 3, specify the properties for the new Web server. Enter the followinginformation in the fields as provided. Click Next when complete.

When running on UNIX, there will not be a service name entry.

Table 16: Web server configuration details

Field Name Value

Port 80

Installation location <ihs_root>

Service name IBMHTTPServer7.0

Plug-in installation location <plugin_root>

Application mapping All

Port 8008

Username ihsadmin

Password web1sphere

Confirm password web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

Information

The Application mapping to the Web server feature was added in V6.1. Previously,

when a new Web server was added to the cell, the mapping of the applications to that Webserver would need to be done in a separate step. This could be done manually either

through the console or through a customized script created during the installation of theplug-in.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. On Step 4, the summary, click Finish.

__ 2. Save the changes.

__ 3. Stop and start the Web server using the administrative console.

__ a. Select webserverXX and click Stop. The Web server status should now be

stopped.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Verify in Windows services that the Web server is not running.

On UNIX, it is possible to check if the Web server processes are running with the followingcommand:

ps -ef | grep -i httpd

If the Web server or IHS administrative process is not running, they can be started with the

following commands:

/opt/IBM/HTTPServer/bin/apachectl start

/opt/IBM/HTTPServer/bin/adminctl start

__ c. Start the Web server before continuing. Select the Web server and click Start.

__ d. To verify the server has started, open a Web browser and connect to the IBM

HTTP Server welcome page. Specify the following address:

http://localhost

Mapping modules to servers

Each module of an application is mapped to one or more target servers. The target server

can be an application server, a cluster of application servers, or a Web server. Web serversspecified as targets will then have the routing information for the application generated in

their plug-in configuration files.

7/21/2019 WAS V7.pdf


Student Exercises




This mapping usually takes place during application deployment. But, since theDefaultApplication was already deployed at the time this particular Web server was added,

the DefaultApplication still needs to be mapped to your new Web server. That, in fact, wasdone for you during the last step of defining the Web server properties when All was

selected for the Application mapping to the Web server. That step actually mapped allinstalled applications to the new Web server.

This section of the lab verifies that the applications were correctly mapped to the new Webserver.

__ 1. Using the deployment manager administrative console, verify the mapping of theDefaultApplication modules to the Web server.

__ a. From the navigation tree, expand Applications and Application Types.

__ b. Click WebSphere enterprise applications.

__ c. From the list of applications, click DefaultApplication.

__ d. Under Modules, click Manage Modules.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Notice that the Default Web Application module has already been mapped notonly to the application server server1, but to ihsnode as well. This page can

also be used to modify the mappings manually.

__ f. Click DefaultApplication from the breadcrumb trail to return to the configuration

window. __ g. Under Detail Properties, click Target specific application status.

7/21/2019 WAS V7.pdf


Student Exercises




__ h. This view shows the mapping of a deployed object to servers.

Working with the plug-in configuration file

The plug-in configuration file contains routing information for all applications mapped to theWeb server. The plug-in configuration file needs to be regenerated and propagated to the

Web server whenever there are changes made to the WebSphere configuration that affecthow requests are routed from the Web server to the application server.

__ 1. Regenerate the plug-in configuration file.

__ a. From the administrative console navigation tree, expand Servers and ServerTypes. Click Web servers.

__ b. Select the Web server. Click Generate Plug-in.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

This step should not be necessary since the default behavior is to automatically generate a

new plug-in configuration file whenever an update is made. But this step confirms that thesetup is working correctly.

__ c. Verify the generation was successful by viewing the messages.

__ 2. View the plug-in configuration file, plugin-cfg.xml, from the administrative

console.

__ a. Click webserverXX.

__ b. Under Additional Properties, click Plug-in properties.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Under Plug-in properties, click View to see the plugin-cfg.xml file.

__ d. The next window shows the plug-in configuration file. Verify that the element:

<UriGroup Name="default_host_server1_was7hostXXNode01_Cluster_URIs">

includes the element

<Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid"

Name="/snoop/*/>

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty This ensures URLs containing /snoop will be recognized by the plug-in andforwarded to the application server.

__ e. Look through the list of URIs for the /Trade/web entry.

__ 3. After a plug-in configuration file is regenerated, it needs to be propagated to the

Web server. You can propagate manually by copying the file from the application

server machine to the Web server machine or you can do it from the administrativeconsole.

Information

The default is to automatically generate the plug-in configuration file and to propagate the

plug-in to the Web server. These settings can be viewed using the administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




From the navigation tree, expand Servers and Server Types. Click Web servers and

webserverXX. Under Additional Properties, click Plug-in properties.

__ a. From the navigation tree, expand Servers and Server Types. Click Web

servers. You could also navigate directly to the window by clicking Web servers

from the breadcrumb trail.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Select the Web server and click Propagate Plug-in.

__ c. Verify the propagation was successful by viewing the messages.

7/21/2019 WAS V7.pdf


Student Exercises




Test the plug-in configuration

By default, the Web server plug-in module checks for a new configuration file every 60

seconds. You can wait for the plug-in to find the changes, or you can restart the Web serverto pick up the changes immediately.

__ 1. Verify that the application server, server1, is running.

__ 2. Verify that the IBM HTTP Server is running.

__ 3. Access the snoop servlet.

__ a. Open a Web browser.

__ b. Specify the following address:


By using the port 9080 you are bypassing the external IBM HTTP Server.

__ c. The details should be visible in the snoop servlet.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 4. Verify the Web server is forwarding requests to the application server.

__ a. Using a browser, specify the following address:

http://localhost/snoop

This request will first go to the Web server.

__ b. The details should be visible in the snoop servlet.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises





This exercise goes through the process of creating a cell by producing a deploymentmanager profile. It then federates two additional profiles (or nodes) into the cell. The first

profile that was federated was profile1, which was created during the WebSphereinstallation exercise. The second profile was created as a custom profile.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 10. Clustering and workload management 10-1

5.2

Xempty Exercise 10.Clustering and workload management


This exercise covers the creation of a cluster. While creating thecluster, two cluster members are added. After the cluster is created,

the Trade application is configured to run in the cluster.

A replication domain is set up to use the memory-to-memoryreplication mechanism, and the application is tested to ensure that

session failover works as expected. Testing is achieved by stoppingone of the two servers in the cluster and watching the requests fail

over to the remaining running server.



• Create a cluster and add cluster members

• Map modules to clusters and Web servers

• Test load balancing and failover between two cluster members

• Configure a data replication domain for session management

Introduction

Up to this point you have worked with WebSphere Application ServerV7 in a single server environment. In this lab, after having previously

federated, you move to working with a cell using the deploymentmanager. You create a cluster so that workload can be managed

between two servers, one on each node you already have.

You also set up a memory-to-memory replication domain so that HTTPsessions can be shared in case of failure of one of the servers.

Requirements

To do this lab, you require a properly set up computer with WebSphereApplication Server V7 installed, as well as the necessary startup and

program files.

7/21/2019 WAS V7.pdf


Student Exercises





Preface

To do this exercise, you must have completed the Federating a cell exercise as it sets upthe environment of the nodes, node agents, and servers that will be clustered in this

exercise.

Check nodes and node agents

Before you can begin creating the cluster, make sure both node agents are running and thenodes are synchronized.

__ 1. Log in to the deployment manager’s administrative console using wasadmin and

web1sphere

__ 2. Make sure that both federated nodes, was7hostXXNode01 and

was7hostXXNode02, are up, running, and synchronized.

__ a. Select System Administration > Node agents.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Select System Administration > Nodes.

Information

If the node agents need to be started, use the startNode script from a command window tostart them. Make sure you are in the bin folder for the proper profile you are trying to start.

Creating the TradeCluster cluster

In this step you create the cluster that contains the cluster members that participate inworkload management of the Trade application.

A cluster is composed of two or more servers in a cell, which are assigned to run the same

applications.

Clusters are logical abstractions that are equivalent to servers.

__ 1. Create a new cluster called TradeCluster. __ a. Select Servers > Clusters > WebSphere application server clusters.

__ b. Click New.

__ c. Enter TradeCluster for the Cluster name.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Select Prefer local and Configure HTTP session memory-to-memory

replication.

Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Under Select basis for first cluster member click Create the member by

converting an existing application server, and from the drop-down list select

the existing server1 server.

__ f. Note how the Member name and Select node fields are now filled with theinformation from the existing server. Click Next.

__ 2. Add a new server called server2 to the cluster. This server should be created innode was7hostXXNode02.

__ a. Enter server2 for the Member name. This becomes the name of a new server

which is about to be created.

__ b. Select was7hostXXNode02 from the drop-down list for the node name. This

node was created in the previous lab using a custom profile.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Make sure Generate unique HTTP Ports is selected. Click Add Member.

Information

Notice the first server of the cluster is already listed at the bottom of the page. As newservers are added to the cluster, they are also displayed here.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Notice that the new server now appears at the bottom of the page. Additionalcluster members can be created at this time or after cluster creation.

__ e. Click Next and then Finish on the Summary page.

__ f. Before saving the changes, if not already done, set the console preferences to

synchronize configuration changes with the nodes when saving. Click the

Preferences link.

__ g. On the Preferences page select Synchronize changes with Nodes.

__ h. Click Apply then click Save to save and synchronize with the nodes.

7/21/2019 WAS V7.pdf


Student Exercises




Information

From now on, any saves will be automatically synchronized with the nodes during a save.

Note that preferences settings are persistent and are retained throughout browserinvocations.

__ i. Click OK on the Synchronize changes with Nodes page.

__ 3. Modify the default_host virtual host configuration. This will allow browsers to have

direct access to server2 without being forced to use the external IBM HTTP Server.

__ a. View the HTTP Transport for server2. In the administrative console click Servers

> Server Types > WebSphere application servers > server2.

__ b. Expand Ports under Communications.

The ports for server2 will be listed. Note the WC_defaulthost for server2 is

9081. You need to add this port number to the host aliases list for thedefault_host.

__ c. In the administrative console, navigate to Environment > Virtual Hosts >

default_host. Click Host Aliases under Additional Properties. The host

aliases for default_host are listed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. If 9081 is not already defined, add it by clicking New. Leave the default * for the

Host Name and specify 9081 for Port. Click OK and Save the changes.

__ e. Click OK on the dialog confirming that the nodes have been synchronized.

__ 4. Verify the new cluster has been added to the server configuration.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Select Servers > Clusters > WebSphere application server clusters. The

TradeCluster cluster should be displayed on the page.

__ 5. Start the TradeCluster.

__ a. Select TradeCluster and click Start to start the servers on the cluster.

Information

Ripplestart starts each server in the cluster individually, one at a time. The first server is

started, and not until it is running will the next server be started. This is useful in cases

where cluster members are on the same machine and starting multiple servers at the sametime would put the CPU under too much load.

Ripplestart also works as a “Ripple-restart” if the servers are already running, stopping andrestarting each server, one at a time. This, in addition to reducing the burden on the CPU,

keeps applications available while the cluster is restarting.

__ b. Make sure both servers in the cluster have started. Note that this may take a fewmoments.

Set the applications to run on the cluster

Now that the cluster has been defined, the next step is to configure the applications to run

on the cluster, rather than on individual servers. Since the Web server is used to workloadmanage the Web containers, the Web server also needs to be mapped to the applications.

__ 1. For the TradeApplication, verify the next series of steps to map the modules to the

TradeCluster cluster and the webserverXX Web server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Select Applications > Application Types > WebSphere enterprise

applications.

__ b. Click TradeApplication. Under Modules click Manage Modules.

Information

WebSphere has already automatically mapped the application to the cluster and Web

server since at this point there are no other reasonable choices. For the sake of doing it,the exercise still goes through the process.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Select all the modules of the application. Then, in the Clusters and servers list,select both the TradeCluster cluster and the webserverXX Web server (use the

Ctrl key to select multiple servers).

__ d. Click Apply. This creates the mapping.

__ e. Click OK.

__ f. Make sure that the modules were mapped to both the TradeCluster and theWeb server.

__ g. Save the configuration changes.

__ 2. Start the applications if necessary.

__ 3. Regenerate and propagate the Web server’s plug-in configuration file. (This should

happen automatically; do it manually if it did not.)

Create a cluster scoped JDBC resource

When creating the first cluster member from the existing server1, all resources alreadydefined at the server and node scope are maintained. Unfortunately, when adding the

second server on the was7hostXXNode02 node, the resource definitions from server1 and

was7hostXXNode01 are not automatically defined. You now have a problem: since bothservers run the same applications, by virtue of being on the same cluster, they both needaccess to the same resources.

One solution is to re-create the resources at the node scope for each additional node as its

servers are added to the cluster. That will work, but the disadvantage is you have to do thatevery time a new node’s server is added to the cluster. A better solution is to define

resources at the cluster scope.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

Resources can only be added at the cluster scope if the cluster members are running in

similar operating environments. Since many resources require pointers to a file systemlocation, having resources defined at the cluster scope for cluster members running in both

Windows and Linux will not work. In that case you must define the resources at the node

level.

__ 1. Remove the existing node scoped DB2 Universal JDBC Driver Provider (XA)provider.

__ a. Using the administrative console, expand Resources > JDBC > JDBC

Providers.

__ b. Select the existing providers defined earlier at the Node=was7hostXXNode01

scope and click Delete.

Information

Cluster scope takes precedence over node scope, so node scoped resources do not have

to be deleted. However, deleting them does avoid ambiguity.

Deleting the JDBC provider also deletes any data sources that were defined under it.

__ c. Save your changes.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Click OK on the dialog confirming that the nodes have been synchronized.

__ 2. Create cluster scoped JDBC provider and data source.

__ a. Using the administrative console, expand Resources > JDBC > Data sources.

__ b. From the Scope drop-down list select Cluster=TradeCluster. Click New.

__ c. Make sure the Scope is set to TradeCluster. Enter Trade for the Data source

name and jdbc/tradeds for the JNDI name. Click Next.

__ d. Since you do not yet have a cluster-scoped JDBC provider, select Create new

JDBC provider. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

At this point the Create Data source wizard temporarily branches into the Create JDBC

provider wizard.

__ e. Create a cluster scoped JDBC provider.

__ f. Select DB2 for the Database type, DB2 Universal JDBC Driver Provider for theProvider type, and XA data source for the Implementation type. Click Next.

7/21/2019 WAS V7.pdf


Student Exercises




__ g. Leave the path fields empty as you want the Node scope environment variablesto be used instead. Click Next.

__ h. Enter TRADE for the Database name, dbhost for the Server name, and acceptthe other values as defaults.

On UNIX, change the port number to 50001

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ i. Click Next.

__ j. From the Component-managed authentication alias drop-down list select

<nodename>/TradeApp. Click Next.

__ k. Click Finish.

__ l. Save your changes.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Configure the WebSphere variable DB2UNIVERSAL_JDBC_DRIVER_PATH fornode was7hostXXNode02 to point to the location of the DB2 JDBC drivers.

Information

This step does not need to be done for was7hostXXNode01 since the environment

variables were already created.

__ a. Expand Environment and click WebSphere variables.

__ b. Select the Node=was7hostXXNode02 scope.

__ c. Click DB2UNIVERSAL_JDBC_DRIVER_PATH.

__ d. Enter <db2_root>\java for the Value of the variable.

Enter <db2_root>/java

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Click OK.

__ f. Repeat the previous steps forDB2UNIVERSAL_JDBC_DRIVER_NATIVEPATH.

__ g. Save your changes and click OK on the dialog confirming that the nodes havebeen synchronized.

__ 4. Test the data source connection.

__ a. Using the administrative console, expand Resources > JDBC > Data sources.

__ b. Make sure the Cluster=TradeCluster scope is selected.

__ c. Select the Trade data source and click Test connection.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Check the messages generated to make sure both node agents were able toconnect.

Test the application

In this section of the exercise the application is tested in a clustered environment. The

application is served from both application servers in the cluster until affinity is established,upon login, by the creation of an HTTP session object. From then on, all requests are

directed to the same application server (or cluster member) that created the session.

If the cluster member that created the session is not available, the Web server plug-in willreroute the request to another cluster member, creating new affinity with that server.

Going to the cluster member will work to serve content that does not use information in the

HTTP session object. At this stage of the exercise, attempting to use session informationwill fail. This “problem” is fixed later in this exercise, where session replication is

configured.

__ 1. At this point, stop the cluster and the node agents. This will allow them to load the

new data source configurations.

__ 2. Start the node agents and the cluster, and make sure all servers and applicationsare up and running.

Information

Remember that the node agents must be started using the startnode script directly from the<profile_root>\ profile_name \bin folder. The cluster can be ripple started from the

WebSphere administrative console once the node agents are running.

__ 3. Make sure the Web server is running.

__ 4. Close all existing Web browser windows.

__ 5. Open a new Web browser window.

__ 6. Access the Trade application through the following address:

http://localhost/Trade/web

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 7. On the Welcome screen click Login.

Note that the runtime server information, in this case, indicates the page was served

from server2, which is the server in was7hostXXNode02. Also note, on the bottomof the screen, that subsequent requests were served from both server1 and

server2. The bottom of the screen is a frameset that calls a servlet to provide

runtime information; requests to this servlet are workload managed between the twoavailable servers in the cluster.

__ 8. Click Refresh on the Web browser a few times and see that workload management

continues to occur.

7/21/2019 WAS V7.pdf


Student Exercises




__ 9. Click Show cookies. Notice that at this time there are no cookies, as login to theapplication has not yet happened. A session is established once a user logs in.

On certain UNIX platforms, you may actually see several cookies showing an LTPA

security token. These, however, are not user session cookies. The cookie in question willbe called JSESSIONID.

__ 10. Use client1 for the user name and web1sphere for the password to log in to the

application.

__ 11. Notice the runtime server information. Take note of which server served the request: ________________

__ 12. Click Show cookies again. This time you should see the CloneID of the server that

served the request. This is indicated by the information after the colon.

__ 13. Continue testing the application; all the requests should now be served by the sameserver.

Hint

After you log in, look at the Runtime Info section of the left navigation bar, under Process. Itshows which server is serving your requests.

__ 14. After you are satisfied that affinity has been established, use the WebSphereadministrative console to stop the server that has been serving your requests.

This will force failover to the other server in the cluster.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 15. Without logging out of the application, navigate to another page of the application.This should result in an error as distributed session management has not yet been

set.

Information

Note that the server that served this request in this case is the “other” server in the cluster,

server1. Since session management has not yet been configured, server1 cannot obtainserver2’s session information and fails to find the account of the logged in user, which is

stored in the session.

Configure distributed session management

In order for session information to be shared between members of a cluster, a strategy toshare session data must be put in place. WebSphere Application Server provides a variety

of mechanisms to achieve this goal. The main strategies are database andmemory-to-memory replication. Setting up either of these is very straighforward. In this

exercise memory-to-memory replication is set up to handle session data replication.

Session management must be set on each of the servers in the cluster. Perform thefollowing steps first on server1 and then on server2.

__ 1. Select Servers > Server Types > WebSphere application servers.

__ 2. Click the hyperlink for either one of the servers.

7/21/2019 WAS V7.pdf


Student Exercises




__ 3. Under Container Settings click Session management.

__ 4. Under Additional properties, click Distributed environment settings.

__ 5. Click the Memory-to-memory replication hyperlink.

__ 6. Select the TradeCluster Replication domain and set the Replication mode to Both

client and server.

__ 7. Click OK and Save the changes.

Information

Starting in WebSphere Application Server V6.0, stateful session bean (SFSB) failover is

supported. This new feature is exploited by the Trade application where a list of the 10most recently viewed symbols is maintained by a stateful session bean. One more step is

needed to enable failover of SFSB.

__ 8. On the breadcrumb trail click the server name.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Under Container Settings, expand EJB Container Settings and click EJB

container.

__ b. Click the memory-to-memory replication hyperlink.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. On the next page select TradeCluster as the replication domain and use Both

client and server as the replication mode of the server.

__ d. Click OK.

__ e. Now that you have selected the replication domain, ensure the check box next to

Enable stateful session bean failover has been selected.

__ f. Click OK and Save the changes.

__ g. Repeat these steps for the next server.

__ 9. Verify that the memory-to-memory replication settings for both the Web containerand the EJB container are set correctly. It might also be a good idea to do a full

synchronization of the nodes to make sure the settings have been propagated.

__ 10. Restart the cluster.

__ a. Select Servers > Clusters > WebSphere application server clusters.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Select the check box for the TradeCluster.

__ c. Click Ripplestart. Wait until all servers are started.

Test the application (again)

In this section of the exercise the application is tested again. However, now that sessionmanagement has been configured, stopping one server should correctly fail over to the

other server in the cluster without losing the session information. __ 1. Make sure all node agents, servers, and applications are up and running.

__ 2. Make sure the Web server is running.

__ 3. Close all existing Web browser windows.

__ 4. Open a new Web browser window. This will make sure that the old cookies have

been flushed.

__ 5. Access the Trade application through the address:

http://localhost/Trade/web

7/21/2019 WAS V7.pdf


Student Exercises




__ 6. Click Login.

As before, note that the Runtime server information indicates the page was served

from server2, which is the server in was7hostXXNode02. Also note, on the bottomof the screen, that subsequent requests were served from both server1 and

server2.

__ 7. Click Refresh on the Web browser a few times and see that workload managementcontinues to occur.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 8. Click Show cookies. Notice that at this time there are no cookies, as login to theapplication has not yet happened. A session is established once a user logs in.

On certain UNIX platforms, you may actually see several cookies showing an LTPA

security token. These, however, are not user session cookies.

__ 9. Use client for the user and web1sphere as the password, and log in to theapplication.

__ 10. Notice the Runtime server information, which server served the request?

_________________

__ 11. Click Show cookies again. This time you should see the CloneID of the server thatserved the request.

__ 12. Continue testing the application; all the requests should now be served by the same

server as noted in the previous step.

__ 13. After you are satisfied that affinity has been established, use the WebSphereadministrative console to stop the server that has been serving your requests. This

will force failover to the other server in the cluster.

7/21/2019 WAS V7.pdf


Student Exercises




__ 14. Without logging out of the application, navigate to another page of the application.

Note that the server which served this request is the “other” server in the cluster,

server2. Also, failover was successful and the session was not lost. The requestwas routed to server2, which had the session data replicated from server1 by thememory-to-memory session data replication.

Information

Note that in the screen capture above, server1 had established session affinity afterlogging in as the client user. After stopping server1, server2 handled the session failover.

Your screen may look different depending on which server initially established sessionaffinity.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2


The first part of the exercise looked at creating a cluster of two servers, each in its ownnode.

Next the applications were configured to run on the cluster by assigning the modules of the

applications to the Web server and the cluster.

Lastly the application was thoroughly tested in the clustered environment, and failoverscenarios were created by stopping one of the servers.

To make failover to work when session data is involved, the Data Replication Service wasconfigured to use memory-to-memory replication. Stateful session bean failover was

enabled and the application was tested in a failover scenario.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 11. Configuring the service integration bus 11-1

5.2

Xempty Exercise 11.Configuring the service integrationbus


This exercise shows you how to create a service integration bus and

add a cluster as a member of the bus. You will also learn how toconfigure the bus and JMS resources necessary to support an

application that makes use of messaging. You will install twoapplications, a message sending simulator and a transaction

processor. You will use these applications to explore messagingbehavior using the high availability messaging engine policy.



• Configure the service integration bus, the messaging engine, anddifferent bus destinations in WebSphere Application Server

• Configure JMS queues and activation specifications for

message-driven beans

• Install and test the messaging features in the Trade Processor

application

Introduction

There have been many changes to the way WebSphere default

messaging is configured in WebSphere Application Server V7. Thereare new wizards to assist you in configuring how the messaging

engines behave depending on the messaging engine policies. It is nowpossible to configure for high availability, providing automatic failover

mechanisms. You may also configure for scalability where messagingengines can split the volume of messages and share the processing

load. There is also a preconfigured policy for a combination of highavailability and scalability.

Operating a secured messaging bus has also been made simpler by

improving the way users and groups are assigned the different rolesnecessary to send, receive, and connect to a messaging bus.

7/21/2019 WAS V7.pdf


Student Exercises




In this exercise you configure both JMS and service integration busresources to support two applications. The first application creates

simulated transactions that represent buying and selling stocks. AWeb page in the application lets you select the number of transactions

of each type (buy or sell). Each transaction places messages on aJMS queue.

The second application uses an MDB to listen to the same queue andreceives the messages sent by the simulator. The transactions aredisplayed on a table. Every 30 seconds the oldest transaction is

removed from the table.

Requirements

To do this lab you must have completed Exercise 10: Clustering.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


Part 1: Applications used in this exercise

The two applications that you install for this exercise require you to set up both service

integration bus (SIB) and JMS resources.

Below you see the user interface for both applications:

Table 17: Applications and their function

Application Function

Message Sender Simulator MSGSenderSimulator.ear

Simulates the function of buying and sellingstocks. You can select how many shares to

buy or sell. For each operation a message isplaced on a JMS queue. Each message has

a transaction number that includes the nameof the server that produced it and a

sequence number. You can view the action

of placing the message on the queue in theSystemOut log file.

Trade Processor Application TPApplication.ear

This application is driven by a

message-driven bean EJB (MDB) whichlistens on the same queue on which the

simulator places messages. As messagesare received by the MDB, they are listed in a

table on a Web page and displayed to theuser. Every 30 seconds the oldest message

is assumed to have been processed and is

removed from the table. As messages arereceived and discarded, trace entries arewritten to the SystemOut log file.

7/21/2019 WAS V7.pdf


Student Exercises




From the Monitor Web page you can create Buy messages and Sell messages andsend them to a server for processing.

From the same Monitor Web page you can see which server received the messages forprocessing. The Transaction column shows what server sent the message as well as the

order in which the message was received.

Later in this exercise you will install and configure these applications. You also will

configure the JMS and SIBus resources to make messaging work. Then you will trydifferent messaging engine policies to see how you can change the behavior of the

applications when running in a cluster to take advantage of scalability and high availability.

Part 2: The messaging environment created in the exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty You will create the SIBus objects and the JMS objects required to support the twomessaging applications. You will perform the following tasks in this exercise.

1. Create and secure an SIBus named: msgBus

2. Add the TradeCluster as a member of the bus. Once the TradeCluster is a

member of the bus, the messaging engine (TradeCluster.000-msgBus) will

become active in one of the cluster members, Server1 or Server2.

3. Create the bus destination named: TradeQueueDestination

4. Create the JMS objects required by the messaging applications: connection

factory, destination queue, and activation specification. These are Javaobjects that will be scoped to the cluster and will be given JNDI names.

5. Install the messaging applications to the TradeCluster.

In addition to creating this environment you will configure and test two messaging policies.

• High availability

• Scalability (optional)

7/21/2019 WAS V7.pdf


Student Exercises




Part 3: Setting up the service integration bus

In this section you will (1) create a secured service integration bus, (2) add the

TradeCluster as a bus member, and (3) configure an SIBus destination. In addition, specificusers and groups need to be authorized for the different bus roles.

__ 1. Create a secured service integration bus named msgBus.

__ a. Make sure that the deployment manager is up and running. If not, open a

command prompt, change to the directory <profile_root>\DmgrProfile\bin,and issue the startManager command.

__ b. If server1 and server2 are running, stop them now.

__ c. If the node agents for profile1 and profile2 are running, stop them now. Sinceyou will be doing a lot of configuration in the following steps, stopping the nodeagents will save time during node synchronization.

__ d. Log in to the administrative console as user ID wasadmin with password

web1sphere

__ e. From the administrative console's navigation menu on the left, expand Service

integration and click Buses.

__ f. On the Buses page, click New.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ g. On Step 1 of the wizard enter msgBus for the name of the bus. Also make surethat Bus security is checked. Click Next.

__ h. In the next page of the wizard you configure bus security. This is a multiple-stepprocess. Step 1.1 is the introduction. Read the information and then click Next.

__ i. The next step in setting up bus security is to configure whether you need to useSSL for the transport. Since you are in a secured, isolated network, you do not

7/21/2019 WAS V7.pdf


Student Exercises




require SSL. Uncheck Require clients use SSL protected transports. Click

Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ j. Next you choose which security domain to use for authenticating bus users. Forthis exercise select Inherit the cell level security domain. Click Next.

__ k. Read the confirmation page and click Next.

__ l. On the final page click Finish to complete the creation of the new bus. Wait afew minutes for the bus to be created.

Note

To run with bus security enabled, global security must be enabled. The wizardautomatically enables global security if you request the creation of a secure bus. Notice

that this configuration did not require an SSL transport. A new feature in WebSphere

Application Server Version 7 is that an authentication alias is no longer required forinter-engine communications (as long as all messaging engines are running on version 7).

__ m. Save the changes to the master configuration.

__ n. Wait for the node synchronization to complete and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




__ o. Verify that the new bus is created and security is enabled.

__ 2. Install the SVG Viewer in the Internet Explorer browser. If you are using another

browser such as Firefox, your steps might be slightly different.

__ a. Use Windows Explorer to navigate to <software_cds> \misc\SVGViewer.

__ b. Double-click SVGViewer.exe.

__ c. Wait until you see the Install succeeded message.

Linux

Nothing needs to be done on Linux. For background, feel free to read the rest of this

information block.

The Firefox browser has SVG support built in, so no plug-in needs to be installed.

Unfortunately, the console support within WebSphere does not correctly recognize thatFirefox on Linux has the correct support.

There are a number of workarounds for this problem. One, which has already been addedto the standard Linux image for this course, is to add a config property to Firefox. This is

done by typing the following into the URL field:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty about:config

Then the following string is added (right-click New > String):

name: general.useragent.override

value: "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14)

Gecko/20080410 Firefox/2.0.0.14"

__ d. Log out of the administrative console and back in using wasadmin and

web1sphere

__ 3. Assign the TradeCluster as a bus member and configure the high availabilitymessaging engine policy.

__ a. On the Buses page click msgBus.

__ b. On the next page, under Topology click Bus members.

__ c. On the Bus members page click Add.

__ d. Select the Cluster radio button. The only defined cluster, TradeCluster, shouldbe preselected. Click Next.

Note

At this point you will need to complete the installation of the SVG Viewer.

On Windows Internet Explorer you will be prompted to allow the browser to run the SVG

Viewer add-on.

• Click the message and select Run ActiveX Control.

• Click Run on the Security warning.

7/21/2019 WAS V7.pdf


Student Exercises




• You will have to repeat the previous steps before this note to get back to themessaging engine policy assistance settings.

• Click Accept on the Software License Agreement.

Information

In previous versions of WebSphere Application Server, setting up the core group policiesthat determine how messaging engines behave in a clustered environment was a complex

task. Starting in version 7, you can enable messaging engine policy assistance and usewizards in the administrative console to assist you in selecting and maintaining messaging

engine policies. In this exercise you configure and test two policies, first high availabilityand then scalability.

__ 4. Configure the high availability message engine policy.

__ a. With the SVG Viewer installed you will see the policy diagram as shown below.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Notice that the diagram shows the suggested configuration of the bus member,TradeCluster, for the high availability messaging engine policy.

__ b. Click Next at the bottom of the messaging engine policy assistance settings

window.

__ c. Select File store and click Next.

Notice that one messaging engine will be created named TradeCluster.000-msgBus.

Failover will be enabled with the preferred order of servers being server1 first,server2 second. However, the message store is still not completely configured.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. In the previous step you select the type of message store, File store. Now youneed to specify where the log files will be located. Click the

TradeCluster.000-msgBus link.

__ e. Enter ME_logs for both the Log directory path and the Permanent store

directory path, and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. Verify that you now see Yes in the column: Is the message store configured?Click Next again.

__ g. Accept the default heap sizes and click Next.

__ h. Read the Summary page and click Finish. The bus member is now fully

configured and available.

__ i. Save the changes to the master configuration.

7/21/2019 WAS V7.pdf


Student Exercises




__ j. Wait for the node synchronization to complete and click OK.

__ k. Verify that you now see the messaging engine policy enabled for high availability.

__ 5. Create a bus destination called TradeQueueDestination.

__ a. On the breadcrumb trail click msgBus.

__ b. Under Destination resources click Destinations.

__ c. Click New.

__ d. In the Create new destination wizard select Queue and click Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Enter TradeQueueDestination for the Identifier and click Next.

__ f. On Step 2 of the wizard, ensure that the bus member is Cluster=TradeCluster.There should be no other choice as there is only one bus member defined on the

bus. Click Next.

__ g. Read the confirmation page and note that this process will create the queue

points. Click Finish.

__ h. Save the changes to the master configuration. __ i. Wait for the node synchronization to complete and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




__ j. Verify that the new SIBus destination has been created.

Information

When running a service integration bus with security enabled, you have to configure whichusers and groups are authorized for the different roles that the bus requires. In the

following steps, you will assign users to security roles. However, before the actual bussecurity authorization can be configured, two other settings must be performed:

• Create a J2C alias to be used by the resources to authenticate with the server.

• Create a user in the user registry that matches the J2C alias so authentication

will succeed.

__ 6. Create a J2C alias. __ a. On the administrative console, click Security > Global security.

__ b. Under Authentication expand Java Authentication and Authorization service

and click J2C authentication data.

__ c. Click New.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Enter SIB User for the Alias. Enter busUser for the User ID and web1spherefor the Password fields. Add an optional description if you like. Click OK.


__ f. Wait for the node synchronization to complete and click OK.

__ g. Verify that the new J2C alias has been created.

__ 7. Create a user in the current user registry that matches the attributes of the J2C alias just created.

__ a. On the administrative console, click Users and Groups > Manage Users.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Click Create.

__ c. Enter busUser for the User ID. The first and last names can be anything; use SIBus and User, respectively. Enter web1sphere for the passwords.

__ d. Click Create. Click Close.

__ e. Verify that the new user was created.

__ 8. Configure SIBus security.

__ a. On the administrative console, click Service integration > Buses.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Under Security, click the Enabled link.

__ c. Under Authorization Policy, click Users and groups in the bus connector

role. In order to connect to the bus, valid credentials must be presented.

__ d. Click New.

__ e. On the first page of the wizard, select Users and click Next to search for alldefined users.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. A list of defined users in the current user registry is displayed. From the list select

busUser and click Next.

__ g. Read the summary page and click Finish.

__ h. Save the changes to the master configuration. The user, busUser, is now

assigned to the bus connector role.

__ i. Wait for the node synchronization to complete and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Part 4: Configuring the JMS resources

Now that the service integration bus has been configured, it is necessary to configure the

JMS resources so that the applications can produce and consume messages.

There are three JMS resources that need to be configured for the applications to work; theyare:

• JMS connection factory

• JMS queue

• JMS activation specification

Remember that applications have no knowledge of the service integration bus itself. The

applications use JMS to place and retrieve messages using, in this case, a JMS queue.

__ 1. Create a connection factory called Trade Connection Factory.

__ a. In the administrative console go to Resources > JMS > Connection factories.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. From the Scope drop-down list select Cluster=TradeCluster.

__ c. Click New.

__ d. Select Default messaging provider. Click OK.

__ e. Change only the following values; accept the defaults for all the rest.

__ f. Click OK when you are done entering all of the values.

__ g. Save the changes to the master configuration.

__ h. Wait for the node synchronization to complete and click OK.

__ i. Verify that the connection factory was created.

Table 18: Fields and values for the connection factoryField Value

Name Trade Connection Factory

JNDI name jms/tradeCF

Bus name msgBus

Mapping-configuration aliasDefaultPrincipalMapping

Container-managed

authentication aliaswas7hostXXCellManager01/SIB User

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. Create a queue named Trade Processor Queue

__ a. On the administrative console click Resources > JMS > Queues.

__ b. From the Scope drop-down list select Cluster=TradeCluster.

__ c. Click New.






__ i. Verify that the queue was created.

__ 3. Create the activation specification.

__ a. From the administrative console click Resources > JMS > Activation

specifications.

__ b. From the Scope drop-down list select Cluster=TradeCluster. __ c. Click New.


Table 19: Fields and values for the queue

Field Value

Name Trade Processor Queue

JNDI name jms/tradeprocq

Bus name msgBus

Queue name TradeQueueDestination

7/21/2019 WAS V7.pdf


Student Exercises








__ i. Verify that the activation specification was created.

Table 20: Fields and values for the activation specification

Field Value

Name Trade Processor Activation Spec

JNDI name jms/tradeAS

Destination type Queue

Destination JNDI name jms/tradeprocq

Bus name msgBus

Authentication alias was7hostXXCellManager01/SIB User

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Part 5: Installing the messaging applications

As mentioned at the beginning of this exercise, two applications will be used to

demonstrate messaging on the service integration bus. The first application generatesmessages that are placed on a queue, and the second application consumes those

messages. Now that the message bus and the JMS resources have been configured, youmust now install the applications. This will be a very straightforward installation since

limited configuration is required.

__ 1. Install the MSGSenderSimulator application.

__ a. From the administrative console, click Applications > New Application.

__ b. On the New Application wizard, click New Enterprise Application.

__ c. Select Local file system.

__ d. Click the Browse button to the right of the Full path entry field.

__ e. Navigate to the folder: <software_dir> \Messaging.

7/21/2019 WAS V7.pdf


Student Exercises




__ f. Select the file: MSGSenderSimulator.ear and click Open. Click Next.

__ g. Select Detailed - Show all installation options and parameters and click

Next.

__ h. Click the link for Step 2 Map modules to servers.

__ i. Check the box for the MSGSenderWeb module.

__ j. Under the Clusters and servers window, select (highlight) TradeCluster.

__ k. Click Apply.

__ l. Verify that the MSGSenderWeb module is mapped to the TradeCluster.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyNote

Notice that the steps to map modules to servers is really not necessary because

WebSphere does this automatically. However, it is worth verifying that the mapping iscorrect.

__ m. Click the link for Step 6 Bind message destination references to

administered objects.

__ n. In this step you map the reference used by the code to access the queue, to theJNDI name of the JMS queue you previously configured. Enter jms/tradeprocq

in the Target Resource JNDI Name entry field.

__ o. Click Next to get to Step 7 Map resource references to resources.

__ p. Here you configure the authentication alias used by the connection factory andmap its name to the resource reference used in the application. Select the

MSGSenderWeb module.

__ q. Click Modify Resource Authentication Method to define which J2C alias touse.

7/21/2019 WAS V7.pdf


Student Exercises




__ r. The page expands to show the different options for authentication. Select Use

default method and from the drop-down list select

was7hostXXCellManager01/SIB User. Click Apply.

__ s. Select the MSgSenderWeb module again and click the Browse button in the

Target Resource JNDI Name column of the table to see all defined JNDI names

for connection factories.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ t. There is only one connection factory configured. Select it and click Apply.

__ u. Verify that the JNDI name and the authentication method have been set

correctly.

__ v. Click the link for Step 11: Summary. Read the summary and click Finish.

__ w. Wait for the application to install successfully and click Save to save to the

master configuration.

__ x. Click OK at the Node synchronization screen.

__ y. At this point the wizard returns to the first page where you can install the nextapplication.

__ 2. Install the Trade processor application.

__ a. Select Local file system.

__ b. Click the Browse button to the right of the Full path entry field.

__ c. Navigate to the folder: <software_dir> \Messaging.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Select the file TPApplication.ear and click Open.

__ e. Click Next.

__ f. Select Fast Path - Prompt only when additional information is required andclick Next.

__ g. Click the link for Step 3 Summary.

__ h. Read the summary and click Finish.

__ i. Wait for the application to install successfully.

__ j. Click Save to save the changes to the master configuration.

__ k. Wait for the node synchronization to complete and click OK.

__ 3. Verify that both applications were installed successfully. __ a. From the administrative console, click Applications > Application Types >


The application status you see will depend on whether the node agents arestarted. You will start all the required servers in the next part of the exercise.

Note

Most likely you will see additional applications installed on your lab machine depending on

what you installed in previous lab exercises.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty Part 6: Testing the applications and exploring messaging engine

policies

In this part of the exercise you test the applications under different messaging enginepolicies. Also you will explore the effects of configuring different activation specification

options and queue options. The first configuration you will test is a single messagingengine using the high availability policy and all other default options.

Before you can test the applications, both node agents and both cluster members need to

be started.

__ 1. Start the node agents.

__ a. In a command window change directory to <profile_root>\profile1\bin andinvoke the startNode command.

The UNIX command to start the node is:./startNode.sh

__ b. Wait until the node agent is running.

__ c. To start the second node agent, change directories to <profile_root>\profile2\bin and invoke the startNode command.

__ d. Wait until the node agent reports is running.

__ e. Using the administrative console, verify that both node agents have started by

clicking System administration > Node agents.

7/21/2019 WAS V7.pdf


Student Exercises




__ 2. Start the cluster.

__ a. Using the administrative console, click Servers > Clusters > WebSphere

application server clusters.

__ b. Check the box for TradeCluster and click Ripplestart.

Note

Ripplestart stops servers (if they are running) and then starts all servers in a cluster, waiting

for each of the servers to start before moving on to the next server. This alleviates the load

on the processor because only one server is ever starting at a time.

__ c. Wait for the Status indicator to turn to a solid green arrow (may take several

minutes) signifying that all servers in the cluster have started. (You may need toclick the refresh icon several times.)

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Verify that both servers are started by clicking Servers > Server Types >

WebSphere application servers.

__ e. If either of the servers is not yet started, select the server and click Start.

__ 3. Ensure that both the applications you installed earlier are running.

__ a. On the WebSphere administrative console click Applications > Application

Types > WebSphere enterprise applications.

__ b. Verify that both applications are in a started state.

Note

If either of the applications is not running, and does not start upon selecting it and clicking

Start, check the SystemOut logs to determine what is preventing the application fromstarting. Check the steps you went through when you installed the applications. The

problem is most likely related to the resolution of resource references or authenticationaliases not being applied to the resource references. If after checking these settings you

still have a problem, contact your instructor.

7/21/2019 WAS V7.pdf


Student Exercises




Information

There are two applications installed, a message producer and a message consumer. The

message simulator application is the message producer; the trade processor application isthe consumer of messages. Since the applications are installed in a cluster, each server in

the cluster runs both applications.

When using the high availability messaging engine policy, only one messaging engineis started in the cluster. A WebSphere component called the high availability manager

decides which server in the cluster gets to run the messaging engine (usually the firstserver to be started in the cluster). Should the server running the messaging engine fail,

the high availability manager chooses another cluster member and starts the messagingengine there. In this configuration the messaging engine can fail over to another cluster

member, thus providing high availability.

Producers in any cluster member can generate and place messages on a queue. However,only the consumer which is on the same server as the running messaging engine gets to

consume and process the messages. In the next few steps you prove these points.

__ 4. Invoke the Monitor HTML page. The Web page has been provided as part of theTrade processor application to more easily demonstrate the interactions between

the application servers and messaging engines.

__ a. Open a new browser and enter the Web address:http://localhost:9080/Trade/processor/Monitor.html

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Since you will be running the Monitor repeatedly throughout the rest of thisexercise, you may want to bookmark the Web address in your browser.

The page has four frames:

• Top left: Message producer simulator running on server1

• Top right: Trade processor running on server1

• Bottom left: Message producer simulator running on server2 • Bottom right: Trade processor running on server2

In the message sender applications you can select how many messages of each kind, buyor sell, are sent to the queue.

Note

You could use port 9081 for the monitor's Web address. Doing that would serve the pagefrom server2 instead of server1.

__ 5. Determine which server is currently running the messaging engine.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. From the Monitor Web page’s top left frame (sending messages from server:server1), leave the default values (1 message) for Buy and Sell messages and

click the Send messages button.

__ b. Observe which server processed the messages, server1 or server2.

__ c. Record the server name here________________________. In the highavailability policy only one server in the cluster is running the messaging engine.

__ d. From the Monitor Web page’s bottom left frame (Sending messages from server:

server2), leave the default values (1 message) for Buy and Sell messages andclick the Send messages button.

__ e. Record the server name here________________________. The same server

should be processing messages sent from both server1 and server2.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ f. Examine the SystemOut.log file for whatever server processed the messagesin the last few steps. Use Windows Explorer to navigate to: <profile_root>\<profile_name>\logs\<server_name>

__ g. Open the SystemOut.log file with Notepad and look for messages similar to thefollowing.

SystemOut O MDB received message: server1 - 2


SystemOut O Removed message: server1 - 2






The application receiving the messages is the one running on the server where the

messaging engine is active. You can verify this by looking at the SystemOut.log file for bothcluster members and looking for the message that indicates the messaging engine is in the

Started state: Messaging engine TradeCluster.000-msgBus is in state Started.

The other server in the cluster will have a message indicating the message engine is in the

Joined state: Messaging engine TradeCluster.000-msgBus is in state Joined.

__ h. Close the browser in which the Monitor is running.

__ 6. Test messaging engine failover.

__ a. From the administrative console, stop the server in which the messaging engineis currently running (server1 or server2).

__ b. Wait for the server to stop; then open the SystemOut.log file for the server that

is still running and look for the following message near the end of the log.

SibMessage I [msgBus:TradeCluster.000-msgBus] CWSID0016I:

Messaging engine TradeCluster.000-msgBus is in state Started.

__ c. This message indicates that the messaging engine has been started on the

server that is still running.

__ d. From the administrative console, start the server that you stopped in Step (a).

__ e. Wait for the server to start; then open a browser and enter the Monitor Web

address: http://localhost:9080/Trade/processor/Monitor.html

7/21/2019 WAS V7.pdf


Student Exercises




__ 7. Now check which server is processing the messages as you did before.

__ a. From the Monitor Web page’s top left frame (sending messages from server:server1), leave the default values for Buy and Sell messages and click the Send

messages button.

__ b. Observe which server processed the messages, server1 or server2.

__ c. Record the server name here________________________. In the highavailability policy only one server in the cluster is running the messaging engine.

__ d. From the Monitor Web page’s bottom left frame (Sending messages from server:server2), leave the default values (1 message) for Buy and Sell messages and

click the Send messages button.

__ e. Record the server name here________________________. The same servershould be processing messages sent from both server1 and server2.

__ f. You should observe that the messaging engine that failed over to the other

server continues to process messages from both servers even when the other

server is running again. The high availability policy has failover but not “failback”.

__ g. Close the browser in which the Monitor is running.

Information

High availability: Pros and cons

The fact that only one of the message consumers in a cluster gets to process messages

might be just what you want. This configuration is called for when messaging order is

important and messages should be processed in the same sequence in which they wereproduced (to ensure message order, more configuration may be required).

If message order is not important, this configuration is not very efficient in a clustered

configuration. All servers in the cluster are running the message consumer application, butonly one of those servers actually processes them.

There are at least two solutions to get more message consumers processing messages

from the queue. In the next steps you first configure the activation specification to allowall consumers in the cluster to get messages, and later you change the messaging engine

policy from high availability to scalability to provide workload management of the

messaging engine.

__ 8. Configure the activation specification to start all MDBs in the cluster. There is an

option to configure an activation specification to activate message-driven beans(MDBs) in all the servers, not just the server with the running messaging engine.

The result of this configuring option is that all consumers in all cluster membersreceive messages.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. From the administrative console click Resources > JMS > Activation

specifications.

__ b. Click the link for the Trade Processor Activation Spec.

__ c. Near the bottom of the page, in the Advanced section, select Always activate

MDBs in all servers and click OK.

__ d. Save the changes to the master configuration.

__ e. Wait for the node synchronization to complete and click OK.

__ 9. Ripplestart the TradeCluster.

__ a. From the administrative console, click Servers > Clusters > WebSphere


__ b. Check the box for TradeCluster and click the Ripplestart button.

__ c. Wait for the Status indicator to turn to a solid green arrow (may take 5–6


__ d. Verify that both servers are started by clicking Servers > Server Types >


__ 10. Test whether MDBs are active in both servers using the Monitor Web page.

__ a. Start a new browser and enter the Web addresshttp://localhost:9080/Trade/processor/Monitor.html

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Make sure that both Trade processor applications have no pending transactions.You may quickly clear the table of pending transactions if necessary by selecting

Reset from the Refresh drop-down list.

__ c. Leave the default values of 1 Buy and 1 Sell messages and click the Send

messages button in the top left frame.

__ d. Which processor application displayed the messages? You should see similarbehavior in your own browser. One message, the Buy message, was processed

by Server1, and the other message, Sell, was processed by Server2. As a result

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty of the configuration of the activation specification that you just performed, thereis now an active MDB on both servers that can consume messages.

__ e. Now from the bottom left frame, send three Buy messages and two Sell

messages.

__ f. Notice the distribution of messages between the two processor applications.

They each may, or may not, have received an equal number of messages. It ispossible that the consumer application in the same server as the producer, may

have received more messages, as seen below. But in the long run, with a muchhigher message volume, distribution should even out. This is based on how busy

7/21/2019 WAS V7.pdf


Student Exercises




the consumer, which is co-located with the producer, is at the time the messagesbecome available on the queue.

__ g. Try sending some more messages from the producers in both servers and seewhich consumer picks up the messages.

__ h. Close the browser in which the Monitor is running.

Information

Possible performance issues

One of the problems with this activation specification configuration is that the single activemessaging engine is now sending messages to queue points in multiple servers. In a local

network with a small volume of messages, there may be no performance issues, but in awidely distributed environment, with heavy volume of messages, it can cause performance

problems — mainly due to network traffic.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty To provide better scalability you can change the messaging engine policy to Scalability

which requires a messaging engine in each cluster member.

Part 7: (Optional) Configure the scalability messaging engine policy

In this section you change the messaging policy to scalability. This involves creatinganother messaging engine that will run on the second cluster member.

Two different messaging engines will run on their preferred server unless that server fails;

then its messaging engine will fail over to the other server.

__ 1. Change the messaging engine policy to Scalability.

__ a. On the WebSphere administrative console click Service integration > Buses.

__ b. Click msgBus > Bus members > TradeCluster.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Select Scalability.

Note

Further configuration is required to implement this policy. A second messaging engineneeds to be added.

__ d. Click OK.



__ 2. Create a new messaging engine.

__ a. After saving the changes above, you should have been returned to the Bus

members page. If you are not seeing this page then, using the WebSphereadministrative console, click Service integration > Buses > msgBus > Bus

members.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click TradeCluster.

__ c. Under Additional Properties click Messaging engines.

__ d. Click the Add messaging engine button.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. Select File store; click Next.

__ f. Enter ME_logs for both Log directory path and Permanent store directory

path. __ g. Click Next.

__ h. Click Finish to create the messaging engine.

__ i. Save the changes to the master configuration.

__ j. Wait for the node synchronization to complete and click OK.

__ 3. Check to see if the new messaging engine started.

__ a. Click Service integration > Buses > msgBus.

__ b. Click Messaging engines.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Verify that both messaging engines are running. In the figure below the secondmessaging engine failed to start.

Note

It is very likely that the new messaging engine did not start. This is because in the previoussteps of this exercise messaging engine TradeCluster.000.msgBus failed over to server2

and created its own log files. These files still exist but are not suitable for the newmessaging engine TradeCluster.001.msgBus. You can further analyze this fact by looking

at the system log and looking for the messages where the messaging engine attempts tostart.

__ 4. If the second messaging engine, TradeCluster.001.msgBus, did not start, perform

the following steps.

__ a. Stop server2.

__ b. Once the server has stopped, delete the following files from the<profile_root> \profile2\ME_logs folder:

- Log

- PermanentStore

- TemporaryStore

__ c. Start server2.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Check again to make sure both messaging engines are running. (Refer to detailsin the previous step: Check to see if the new messaging engine started.)

__ 5. Another item to clean up, now that you have a messaging engine on each clustermember, is the setting on the activation specification which started the MDBs on all

servers; that will happen automatically now.

__ a. From the administrative console click Resources > JMS > Activation

specifications.

__ b. Click the link for the Trade Processor Activation Spec.

__ c. Near the bottom of the page, in the Advanced section, uncheck Alwaysactivate MDBs in all servers.

__ d. Click OK.



7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 6. Ripplestart the TradeCluster.

__ a. From the administrative console, click Servers > Clusters > WebSphere


__ b. Check the box for TradeCluster and click the Ripplestart button.

__ c. Wait for the Status indicator to turn to a solid green arrow (may take 5–6


__ d. Verify that both servers are started by clicking Servers > Server Types >


__ 7. Use the Monitor Web page to test the Scalability messaging engine policy.

__ a. Open a browser and enter the Web address:

http://localhost:9080/Trade/processor/Monitor.html

__ b. For each server change the number of Buy and Sell messages to 1 and click theSend messages button for server1 and server2.

Note

The expected behavior is that messages are consumed on the same server where they areproduced. Confirm this by looking at the Transaction column of the Trade processor. You

should see that the source of the message is the same server where they are consumed.

7/21/2019 WAS V7.pdf


Student Exercises




Note

If you prefer to have messages consumed across your servers, regardless of where theyare produced, you can perform some additional configuration on the queue definition. A

new feature in WebSphere Application Server V7 is the capability to control the local queuepoint behavior. You may, or may not, choose to prefer a local queue point.

__ 8. Configure the Trade Processor Queue to not prefer local queue points.This will allowthe spreading of producer messages over all available queue points.

__ a. From the administrative console click Resources > JMS > Queues.

__ b. Click the link for the Trade Processor Queue.

__ c. Near the bottom of the page select Do not prefer a local queue point over

other queue points. With this setting enabled, all available queue points are

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty treated equally, with no preference given to a local queue point. Messages areworkload balanced across all queue points.

__ d. Click OK.

__ e. Save changes to the master configuration.

__ f. Ripplestart the cluster as you did in a previous step above.

__ 9. Test the new configuration.

__ a. Open a browser and enter the Web addresshttp://localhost:9080/Trade/processor/Monitor.html

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Select two Buy messages from server1 and two Sell messages from server2.Select None for the other type of message on each server.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Click the Send messages button for each server.

__ d. You should notice that the two Buy messages were distributed to each server as

well as the two Sell messages. This demonstrates workload balancing betweentwo servers.

__ 10. This concludes the exercise. Log out of the administrative console and close any

browsers that may still be open.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises





In this exercise you configured the service integration bus and JMS resources as requiredby the Trade Processor and Message Sending Simulator applications. This included

configuring the bus members, bus destination, JMS connection factory, JMS queue, andJMS activation specification.

You then experimented with different configurations of the service integration bus and JMSresources, including two different messaging engine policies and settings in the JMS queueand activation specification that control the production and consumption of messages.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 12. Configuring WebSphere security, including fine-grained 12-1

5.2

Xempty Exercise 12.Configuring WebSphere security,including fine-grained administrativeaccess


This exercise starts by ensuring that the WebSphere administrative

security is enabled. With administrative security turned on (the defaultis that it is enabled during profile creation), there are several effects.

These include the fact that administrative tools such as theadministrative console, wsadmin, and many of the scripts (stopServer,

serverStatus) require proper authentication and authorization to run.

The exercise then goes through the process of defining newadministrative users and granting them specific access to parts of theadministrative console and verifies that access is limited to certain

functions.

This is done by first logging into the administrative console using theuser ID that was created during the profile creation. This specific user

has, by default, implicit rights to the WebSphere administrativeconsole as it is the initial user created. This exercise creates additional

users and defines which rights they will have within the administrative

console.Finally, this exercise configures fine-grained access for both the

TradeApplication and the DefaultApplication. Fine-grained access, anew console feature in WebSphere Application Server V7, is done by

defining administrative authorization groups. These groups mapspecific scopes or objects to console users and roles, thus allowing

those users that role access to those specific objects. When theconsole users attempt to access other objects for which they do not

have fine-grained access configured, they only have the same accessrole level that was defined for them at the global level.



• Enable WebSphere security

• Configure administrative security (that is, access to administrative

functions)

7/21/2019 WAS V7.pdf


Student Exercises




• Configure fine-grained administrative security

Introduction

This lab configures access to the administrative console by defining a

number of roles and mapping those roles to existing users. In order to

test the configuration, you will attempt to perform various functionsfrom the different users and see if the security configurations correctlylimit access to various functions.

The last part of this lab defines fine-grained access from different parts

of the WebSphere environment.

Requirements

This exercise requires a workstation with WebSphere Application

Server V7 installed and that the previous exercises for this coursehave been successfully completed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


Verify administrative security

This exercise configures security access to the administrative tools. Before any securityaccess takes effect, administrative security has to be enabled. This happens by default

during the creation of a profile (but could easily be disabled).In this section of the lab, the state of administrative security is verified.

__ 1. Check the state of administrative security.

__ a. Log in to the administrative console using the user wasadmin and the password

web1sphere

Information

At this point you already know the answer to whether administrative security is enabled.

The fact that the administrative console prompted for a user name and password verifiesthat.

__ b. In the administrative console, click Security > Global security.

__ c. Verify that the Enable administrative security option is checked.

Information

If administrative security is not enabled, you need to check the box, save your changes,make sure all nodes are synchronized, and then restart all of your WebSphere processes

(deployment manager, node agents, and application servers).

Defining WebSphere administrative console users

When WebSphere Application Server is installed and profiles are created, administrativesecurity is enabled by default. Initially, the only user that has access to the administrative

console is the primary user that was specified during the profile creation. In these

exercises, that would be the wasadmin user. So initially, in the case of these labs, the onlyuser that can access the administrative console is wasadmin.

In a real environment, it is desirable to have multiple administrative users and possiblyhave different rights for each user.

This section of the lab creates users and maps them to different levels of console access.

__ 1. Create WebSphere users for testing purposes.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. In the administrative console, expand Users and Groups and click Manage

Users.

__ b. Leave the defaults and click Search. This will display the list of current

WebSphere administrative users.

__ c. The wasadmin user was created during the profile creation and the busUser user

was created in an earlier exercise. In order to create additional users for this lab,click Create.

Information

Other users may also exist, depending on which exercises have been completed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Enter the User ID: wasadm Enter anything for the First name and Last name. Enter web1sphere for the

Password and Confirm password. Then click Create.

__ e. Click Create Like to create additional users. Repeat this process for additional

user IDs of wascfg, wasmon, and wasoper. Again, fill in anything for the Firstand Last name, but use web1sphere for the passwords.

Information

These user IDs are being created inside of the WebSphere user repository, not in the localoperating system or in LDAP.

__ 2. Map these new user IDs to their appropriate administrative console roles.

__ a. Under Users and Groups in the administrative console, select Administrative

user roles.

__ b. Click Add.

__ c. Click Search to display the list of available users. Select wasadm from theAvailable column near the bottom of the screen and click the right arrow to

move it to the Mapped to role column. Then select the Administrator role near

7/21/2019 WAS V7.pdf


Student Exercises




the top of the screen. Click OK to create the mapping between the wasadm userand the Administrator role.

Information

Depending on what components have been installed, it is possible for there to be additionalroles within the list.

Depending on which labs have been completed, your list of users may be different from thescreen capture above.

__ d. Repeat these last two steps for wasoper, wascfg, and wasmon (mapping each

user to the appropriate role).

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 3. Once all four users are mapped, save the changes.

__ a. In the administrative console, click System administration > Save changes to

the master repository.

__ b. Click Save.

__ c. Click System administration > Nodes and select nodes was7hostXXNode01 and was7hostXXNode02. Click Full Resynchronize.

Information

Since these particular users are stored within the WebSphere configuration information, itis a good idea to do a full resynchronize with the nodes after creating new users.

__ 4. Extra credit (optional): Go back and add a new console user called wassecmgr andmap it to the Admin Security Manager role.

This user can now be used to map security roles for console users. At this point, the

only user that has this ability would be wasadmin due to the fact that it is the primaryuser (and therefore has this ability implicitly).

Authenticate to the WebSphere administrative console and test mappedusers

In this section of the lab, access to the console is granted to only correctly mapped users.

And depending on the role to which they are mapped, the administrative console allowsthose users to execute only certain functions.

7/21/2019 WAS V7.pdf


Student Exercises




Information

By default, the user ID used to define the authentication mechanism has implicit access as

an administrator role.

__ 1. Bring up a new browser and log into the administrative console.

__ a. Log in as wasadm

__ 2. Verify that full access to administrative functions is available.

__ a. Check the functions available by clicking Applications > Application Types >


__ b. Notice that all standard functions are available.

__ 3. Now verify the available functions for other users.

__ a. Log out from the administrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Log back into the administrative console as wasoper, and see what functions areavailable on the Enterprise applications.

__ c. Notice that not all the same functions are available. Now only Start, Stop, and

Rollout Update are available.

__ 4. Log in as wascfg and wasmon and see what functions are available.

__ 5. Close all Web browsers. This will ensure there are no existing session cookies

when you start the next part of the exercise.

Enabling fine-grained control

Now that users have been created which have different types of access to theadministrative console, it might be interesting to control the access more specifically. For

example, in the following example the exercise creates two new administrative users. Thefirst (TradeAppAdmin) is configured to have rights on only the TradeApplication. The

second (DefaultAppAdmin) is configured to have rights on only the DefaultApplication.

By creating this setup, the exercise demonstrates how fine-grained access controls can begranted to administrative users. These types of controls could be granted on many different

types of objects, not just applications.

The fine-grained access is defined by mapping administrative authorization groups to

administrative console users. The administrative authorization groups themselves point atspecific scopes or objects. When an administrative user attempts to access an object, and

does not have global access, the access defined by the administrative authorization groupsfor the object is checked.

__ 1. As was done in the previous section of this exercise, create two new users

(TradeAppAdmin and DefaultAppAdmin) and map them to the monitor role.

__ a. Make sure you are logged in to the administrative console with a user ID thatgives you Admin Security Manager role access (this role provides permission

to map console roles for console users and groups), like wasadmin. Since

7/21/2019 WAS V7.pdf


Student Exercises




wasadmin is the primary user ID, it has Admin Security Manager accessimplicitly.

__ b. In the administrative console, expand Users and Groups in the left navigation

menu and select Manage Users.

__ c. Leave the defaults and click Search. This will display the list of currentWebSphere administrative users. Click Create.

__ d. Enter the User ID TradeAppAdmin Enter anything for the First name and Last name. Enter web1sphere for the


__ e. Repeat this process to create the DefaultAppAdmin user.

__ 2. Map the two new users to the global monitor role. Any console user or group that isused for fine-grained access requires a minimum role mapping of monitor. This

means that they can view any objects, but can have additional rights on specificobjects defined by administrative authorization groups.


user roles. Click Add.

__ b. Click Search to display the list of available users. Select both TradeAppAdmin

and DefaultAppAdmin (hold down the control key to multi-select) from the

Available column and click the right arrow to move them to the Mapped to role column. Select the Monitor role near the top of the screen and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Save the changes. Wait for the nodes to synchronize and click OK.

__ 3. Create the administrative authorization groups for the TradeAppGroup and

DefaultAppGroup.

__ a. In the administrative console, click Security > Administrative Authorization

Groups.

__ b. Click New to create the new authorization group.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Enter TradeAppGroup for the Name.

__ d. Under Resources expand all the entries and the subentries. Take note of all ofthe different levels that can be defined in an administrative authorization group.

Expand Applications; select the box next to TradeApplication.

__ e. Click Apply.

__ f. On the right, under Additional Properties, click Administrative user roles.

__ g. Click Add to map the administrative console TradeAppAdmin user.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ h. Select the Administrator role and then click Search to show all known users.Select TradeAppAdmin and then click the right arrow to move the user from

the Available column to the Mapped to role column.

__ i. Click OK.

__ j. Save the changes. Wait for the nodes to synchronize and click OK.

__ k. Repeat these steps to create the DefaultAppGroup and map

DefaultAppAdmin. Start by clicking Security > Administrative Authorization

Groups and clicking New.

7/21/2019 WAS V7.pdf


Student Exercises




__ l. Save the changes. Wait for the nodes to synchronize and click OK. The final listlooks like this:

Test the fine-grained access

Now that the new administrative console users have been created, and the administrativeauthorization groups have been added and mapped to the applications, access by the

users to the applications needs to be verified.

__ 1. Open a new administrative console window and log in as TradeAppAdmin

__ 2. Once logged in, browse through various parts of the console. Notice that the

TradeAppAdmin user has only monitor rights to most areas. But, also notice that

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty the TradeAppAdmin user has complete administrator rights to only the

TradeApplication enterprise application.

__ 3. Log out of the administrative console, and log in again as DefaultAppAdmin

__ 4. Again, browse through various parts of the administrative console and notice that

this user only has monitor access. Navigate to the enterprise application list and

7/21/2019 WAS V7.pdf


Student Exercises




notice that this user has administrative access to the DefaultApplication, but not toanything else.

__ 5. Log out of any administrative console windows that may still be open and close all

browsers.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises




5.2


The exercise looked at setting up security for accessing the administrative console. Thiswas done by creating new administrative console users and mapping them to global

access roles. Then two new console users were mapped to administrative authorizationgroups to create fine-grained access to the TradeApplication and the DefaultApplication.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 13. Configuring application security 13-1

5.2

Xempty Exercise 13.Configuring application security


This exercise secures the administration module of the Tradeapplication using WebSphere application security. The application is

tested with application security enabled and an explanation, throughexploration of configuring application security in Rational Application

Developer assembly and deploy.



• Define Java EE security roles

• Define access for resources in an application

• Enable and verify application security

Introduction

This lab deals with configuring application security for the Trade

application using the administrative console and the Rational

Application Developer assembly and deploy.

Requirements

This exercise requires a workstation with WebSphere Application

Server V7 installed and that the previous exercises for this coursehave been successfully completed.

7/21/2019 WAS V7.pdf


Student Exercises





Enabling application security

In a previous exercise, administrative security was configured. This exercise enables andconfigures application security. The application security allows WebSphere to provide

authentication and authorization for the enterprise applications. So, unlike administrativesecurity (which secures the administrative interfaces), application security controls who has

access to which parts of the enterprise applications being run within the applicationservers.

In this section of the lab, WebSphere application security is enabled through the

administrative console.

__ 1. Configure the application security setting.

__ a. Make sure you are logged in to the administrative console with a user ID thatgives you administrator privileges, such as wasadmin or wasadm

__ b. Click Security > Global security.

__ c. Check the box next to Enable application security and click Apply.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

WebSphere administration security was already enabled during profile creation. At this

point, all that is being done is the enabling of application security. As such, there is no needto define user registries or authentication mechanisms.

__ d. Save the changes and make sure to synchronize the nodes.

__ 2. Restart all WebSphere Application Server processes.

__ a. Using the administrative console, stop the cluster. This stops all of the

application servers within the cluster.

__ b. Restart the cluster.

Information

In previous versions of WebSphere, all processes within the cell would have needed to be

restarted. Because global security was already enabled at profile creation time, theinclusion of application security only required the restarting of the application servers.

Securing the Trade application

When running with application security enabled, enterprise applications can take

advantage of role-based application security to restrict access to servlet and EJB

resources. The Trade application’s administration module has already been configured totake advantage of application security by adding a security role called TradeAdmin to the

application and mapping it to parts of the administration module. At this point, all that stillneeds to be done by the administrator is to map the TradeAdmin security role to the users

or groups that exist in the runtime environment.

Information

Java 2 security can also be used to provide fine-grained access to system resources,

such as ports, sockets, file system, and so forth. Java 2 security is orthogonal to J2EE

security and does not require administrative security to be enforced. In this exercise you donot use Java 2 security.

__ 1. Create a new user ID TradeUser to use for application authentication.


Users.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Leave the defaults and click Search. This will display the list of currentadministrative users.

__ c. Click Create.

__ d. Enter the User ID: TradeUser Enter anything for the First name and Last name. Enter web1sphere for thePassword and Confirm password fields and click Create.

__ e. Click Close.

__ 2. Test the application before mapping roles to users and groups.

__ a. With all the servers up and running, access the address:

http://localhost/Trade/web/welcome.html

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click Administration.

Information

Note that only the administration part of the application has been enabled for security. Therest of the application can be accessed just as before application security was enabled.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Try to log in to the administration module of the Trade application. Enter TradeUser and web1sphere and click Login.

__ d. At this point, you get an error page. This is because you have not defined

TradeUser as a user that can assume the role of TradeAdmin.

The TradeAdmin application security role has been mapped to various servletand EJB methods within the Trade application. Once application security is

enabled, a user attempting to access these secured methods has to be mappedto the TradeAdmin security role.

__ 3. Create a registry group and user to which the TradeAdmin security role can be

mapped.

Information

It would be easiest to simply map the application security role to a list of user IDs. But, it is

a much better practice to use a group instead.


Groups.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click Search. This will display the list of current WebSphere administrativegroups. At this point, there should not be any.

__ c. Click Create. Enter TradeGroup or the Group name and anything for the

Description. Click Create.

__ d. Click Close.

__ 4. Add TradeUser to the TradeGroup.

__ a. Click Users and Groups > Manage Groups.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Click TradeGroup.

__ c. Click the Members tab.

__ d. Click Add Users.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. On the next screen, click Search. The result shows the list of known users.

__ f. Select TradeUser and click Add.

__ g. Click Close to verify that the TradeUser was added to the TradeGroup.

__ 5. Map users and groups to Java EE security roles defined within the enterpriseapplication.

__ a. Click Applications > Application Types > WebSphere enterprise

applications.

__ b. Click TradeApplication.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Under Detail Properties, click Security roles to user/group mapping. Note atthis time there are no users or groups mapped to the TradeAdmin security role.

Information

There are four types of users: Everyone, All authenticated, Mapped users and Mapped

groups. The first two do not apply to this exercise as you do not want Everyone to accessthe administration module; and since there has been no previous opportunity to

authenticate, that rules out All authenticated.

The mapped entries refer to users and groups in the current user registry.

__ d. Select the TradeAdmin role and click Map Groups.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Make sure the Search String is * and click Search. Note that the Available listfills up with the group defined within the WebSphere user registry.

__ f. Select TradeGroup and click the right arrow to move the entry to the Selected

list.

__ g. Click OK.

__ h. Click OK.

__ i. Save the changes.

7/21/2019 WAS V7.pdf


Student Exercises




Note

If necessary, in the left navigation bar click System administration > Save changes to

master repository. Notice that there are pending changes that need to be saved to themaster configuration. Click Save.

__ 6. Ensure that the nodes have been fully synchronized.

__ a. Click System administration > Nodes.

__ b. Select both the nodes in the cluster and click Full Resynchronize.

__ 7. Close all Web browser windows. Open a new Web browser.

Access the welcome page of the Trade application at

http://localhost/Trade/web/welcome.html

__ 8. Click Administration.

__ 9. Log in using TradeUser and web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyWarning

Beware, this may not work immediately. By default, the application server has a 10-minute

authentication cache timeout. Therefore, if the initial login failure is still cached, it may nottime out for up to 10 minutes.

To solve this problem, you can either wait until the timeout happens or restart theapplication server.

To view you security authentication timeout settings, go to Security > Global security >

Authentication cache settings (which is under Authentication mechanisms).

__ 10. This time you are authenticated properly and allowed access.

7/21/2019 WAS V7.pdf


Student Exercises




__ 11. From the menu click Adjust Balance.

__ 12. Enter a new amount for one or more users and click Set balance.

__ 13. Confirm that the amount changed.

__ 14. Click Logout.

How does it work? (optional)

To complete this part of the exercise, you need to open the assembly and deploy tool to the

workspace you created earlier in this class when assembling the Trade application. Theassembly and deploy tool is used to explore the EAR file, the TradeEJB and TradeWebmodules to see how security is configured.

Instructions on using the assembly and deploy tool itself will be short and to the point; you

should be familiar with the assembly and deploy tool from previous exercises.

Information

The assembly and deploy tool is currently only available for Windows and Linux.

__ 1. Start the assembly and deploy tool and point it to the workspace where you

assembled the Trade application.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyLinux

Start the assembly and deploy tool by navigating to /opt/IBM/SDP and invoking the

./eclipse & command.

Note

If you did not assemble the Trade application in an earlier exercise, complete the followingsteps:

5) Enter <software_dir>\Assemble\TradeApp and click OK.

6) Close the Welcome screen by clicking the X in the Welcome tab.

7) Click File > Import > Java EE > EAR file.

8) Click Next.9) Browse to <software_dir>\solutions and select

TradeApplication.ear.

10)Click OK.

11)Click Finish.

This will import the TradeApplication.ear to explore for this portion of the exercise.

__ 2. Switch to the Java EE perspective, if it is not already set. __ 3. The first interesting question on your mind probably is: Why does clicking the

Administration button on the welcome page cause an authorization challenge to bepresented, and how does the application know which page to display with the login

form?

__ a. In the Enterprise Explorer expand TradeWeb > WebContent > WEB-INF.Double-click web.xml, which represents the deployment descriptor. The Web

Application Deployment Descriptor Editor for this module opens on the editorpane on the upper right corner of the window.

__ b. Double-click the web.xml tab to maximize the Web Application DeploymentDescriptor Editor. This will enable you to see the Web Application Structure moreeasily.

7/21/2019 WAS V7.pdf


Student Exercises




Click Login Configuration in the Web Application Structure.

You may see errors detected at the top of the page. This can be ignored.

Note

Note that the Authentication Method is set to FORM. This means the application provides its

own login and error pages — in this case adminlogin.jsp and loginfailure.jsprespectively. You may open these pages if you wish to see how they are coded.

When a protected resource is accessed by a non-authenticated user,

WebSphere Application Server presents the login page instead of the requestedresource. After successful authentication the originally requested resource is

served.

__ 4. The next question is: How are resources protected or secured?

__ a. Click Security Constraint in the Web Application Structure of the editor.

Notice the role name TradeAdmin in the Authorization Constraint area.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click the Web Resource Collection (under Security Constraint) in the WebApplication Structure of the editor.

In the Details section of the Web Resource Collection you should see a set ofHTTP access methods and URL patterns which can be assigned to an

Authorized role.

In this case you see that one of the URL patterns is /adminFunctions. This is

the page called when the Administration button is clicked on the welcomepage. At the bottom of the figure above note that the AdminFunctions resource

collection has a Web resource name AdminFunctions. All of these resources arepart of the security constraint that is associated with the TradeAdmin role.

7/21/2019 WAS V7.pdf


Student Exercises




Any time any of the above resources are accessed by an non-authenticateduser, the login page is presented instead.

This is how the Web module is protected.

__ c. Double-click the web.xml tab again to reduce the size.

__ 5. Enterprise JavaBeans are protected through method permissions, all Enterprise

JavaBeans in this application are accessed through a session bean called

TradeFacade. Therefore protecting the Enterprise JavaBeans only involves

protecting key methods of this bean.

__ a. Expand TradeEJB. Double-click the second TradeEJB, which represents thedeployment descriptor. The deployment descriptor editor for this module opens

on the editor pane on the upper right corner of the window.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Expand the Assembly and Method Permission lines of the editor.

__ c. Here you see that the TradeAdmin security role has been granted permission to

access two methods of the TradeFacade EJB. These methods are the onescalled to get the registered accounts and to set the balances for the accounts.

__ 6. Security roles can be added through the application, EJB, and Web moduledeployment descriptor editors. In the case of the TradeApplication the security roleswere added in the Web and EJB modules. There is also an option to add security

roles to the application deployment descriptor.

__ 7. Close the assembly and deploy tool when you finish exploring.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises





The first part of the exercise looked at setting up security for accessing the WebSphereadministrative console. Then application security was enabled and access to the Trade

application was tested.

Lastly an explanation of how Java EE security is configured in the assembly and deploy

tool was presented.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 14. Configuring SSL for WebSphere 14-1

5.2

Xempty Exercise 14.Configuring SSL for WebSphere


This exercise explores some of the features and configurations withinWebSphere’s SSL environment. It goes through the process of

creating a profile and then examining the certificates createdspecifically for the node within the profile. It then explores some of the

administration tasks required for managing the certificates within acell.

Finally, in an optional part of the exercise, the IHS is configured to use

a self-signed certificate to secure the communications between abrowser and the Web server.



• Define the certificate life span of a profile

• Use the administrative console to find and view certificates within acell

• Configure and run the certificate expiration service

• Propagate the generated plug-in keystore out to the plug-ins

• Create a keystore for a Web server

• Generate a self-signed key

• Configure IBM HTTP Server to load and use HTTPS

Introduction

WebSphere Application Server V7 configures and manages many of

the SSL configurations that are required to secure communicationwithin a cell. But, it is important to understand how this infrastructureworks so that it can be maintained correctly. This exercise goes

through creating a new profile and examining the certificates andkeystores that are created for that new profile or node. The exercise

then looks at the interfaces that deal with expiring certificates. It alsogoes through the log files and security reports that are helpful in

tracking when certificates are about to expire.

7/21/2019 WAS V7.pdf


Student Exercises




Another very important step in managing a WebSphere environment ispropagating keystores out to the Web server plug-ins. This lab goes

through the steps required to view the plug-in’s generated keystoreand then propagate it out to the Web server.

As an optional part of the lab, the last section goes through configuring

the IBM HTTP Server for inbound SSL. iKeyman is used to generate a

new keystore and self-signed certificate. IBM HTTP Server is thenconfigured to support HTTPS communications using the newly createdcertificate.

Requirements

This lab requires a computer properly set up with WebSphereApplication Server V7 installed, IBM HTTP Server installed, and the

necessary startup and program files.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


Create a backup

Since this exercise makes changes to the existing environment which, if done incorrectly,could cause problems for the rest of the exercises, doing a backup at this point is a good

idea. __ 1. Create a backup for the deployment manager.

__ a. In a command-prompt window, navigate to the

<profile_root>\DmgrProfile\bin directory.

__ b. Stop the deployment manager process if it is running by issuing the following

command:

stopManager.bat -username wasadmin -password web1sphere

On UNIX:

./stopManager.sh -username wasadmin -password web1sphere

__ c. Once the deployment manager has stopped, issue the following command tobackup the entire profile:

manageprofiles.bat -backupProfile -profileName DmgrProfile

-backupFile <software_dir>\backups\Pre-SSL_backup.zip

7/21/2019 WAS V7.pdf


Student Exercises




On UNIX:

./manageprofiles.sh -backupProfile -profileName DmgrProfile

-backupFile <software_dir>/backups/Pre-SSL_backup.zip

__ 2. Restart the deployment manager.

__ a. From a command window, in the deployment manager’s profile\bin directory,

issue the startManager command.

Create a new profile

In order to better understand the various pieces of the SSL puzzle within the WebSphereApplication Server environment, a new custom profile is created. This will help demonstrate

how and where the various keystores and certificates are managed. __ 1. Start the Profile Management Tool.



To start the Profile Management Tool on UNIX, navigate to <was_root>/bin/ProfileManagement and run ./pmt.sh &.

__ b. The Welcome screen for the profile creation wizard appears. Click Launch

Profile Management Tool.

__ 2. Create a custom profile called SSL and federate it to the deployment manager’s

configuration.

__ a. In the Profiles window click Create.

__ b. In the wizard, select the Custom profile option and click Next.

__ c. On the Profile Creation Options page, select Advanced profile creation andclick Next.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. For the profile name and location enter SSL and <profile_root>\SSL Click Next.

__ e. On the Node name and Host name screen, ensure the values of was7hostXXNode03 and was7hostXX are entered (if on UNIX a fully qualified

name is presented, accept it: was7hostXX.ibm.com). Click Next.

__ f. On the Federation window enter was7hostXX for the deployment manager’shost name. The default SOAP port (8879) is shown. Enter wasadmin for the

security user name and web1sphere for the password. Be sure that the

7/21/2019 WAS V7.pdf


Student Exercises




Federate this node later option is not selected. The node should automaticallybe federated to the cell during creation. Click Next.

__ g. On the next screen, accept the defaults for creating a new default personal

certificate and a new root signing certificate. Click Next.

Information

On the next screen, you see the specifics of the certificates that are about to be created.

The alternative on this screen is to import existing certificates.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ h. On the next screen, which specifies the profile’s node certificate information,

accept the defaults and click Next. Make sure to read the next information

block as it explains the importance of these entries and how they relate to SSL.

7/21/2019 WAS V7.pdf


Student Exercises




Information

Unlike in WebSphere Application Server V6.1, each node (or profile) no longer gets a

single self-signed certificate. Instead, in WebSphere Application Server V7, two certificatesare created. The first one is the node’s personal certificate that is by default used for

secured communication with the node and any application servers on that node. This

personal certificate has a default life span of 1 year. Note that this is not a self-signedcertificate. Instead, it is signed by the second certificate specified on this screen. That is the

node’s root certificate.

Unlike the node’s personal certificate, the node’s root certificate has a default life span

of 15 years. This longer life span helps when the personal certificate is replaced close towhen it is about to expire. Since all of the personal certificates (old and new) are signed by

the node’s root certificate (which has a 15-year life span instead of just 1 year) anyprocesses that need to communicate securely with the node agent or application servers

will already have access to a valid copy of the node’s root signer certificate regardless of

whether the personal certificate has been undated.This model helps solve some of the certificate propagation problems since updating

personal certificates no longer requires any sort of certificate propagation to occur.

As background, signer certificate propagation within a cell is accomplished throughstandard node synchronization. All of the node signer certificates are included in the cell

truststore file, which is synchronized throughout the cell. Propagation to Web serverplug-ins, however, is more tricky.

In order for the plug-ins to be able to communicate securely with the application servers,

they need access to the appropriate signer certificates. The node signer certificates are

made available to the plug-ins in their generated plug-in key rings. Since the node’s rootcertificates are now being used as the signers, updating expiring personal certificates is nolonger a problem. However, adding new nodes to a cell does require propagation of the

plug-in key rings. Just like plugin-cfg.xml files, this propagation can either be donemanually or, in some limited cases, automatically.

Note: the keystore password defaults to WebAS

__ i. Accept the default ports on the next screen. Click Next.

__ j. On the summary screen, click Create.

__ k. The profile creation is now complete, uncheck the Launch the First steps

console and click Finish. Close the Profile Management Tool.

__ 3. Verify the new node in the administrative console.

__ a. Open an instance of the administrative console and log in as wasadmin withpassword web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Go to System administration > Nodes and verify that this new node(was7hostXXNode03) now exists.

__ c. Stop the node agent for node was7hostXXNode03. Since the node is not

actually used in this exercise, and to save system resources, select the node andclick Stop.

Examine the node certificates

This new node has a couple of certificates that are associated with it. The section of the

exercise uses the administrative console to examine them.

__ 1. Examine the node certificates.

__ a. In the administrative console, navigate to Security > SSL certificate and key

management.

__ b. On the right side, under Related Items, click Key stores and certificates.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. This screen shows a list of the keystores and trust files for the cell. Click the key

store link for the node that was just created (was7hostXXNode03).

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. The next screen shows the basic information for the node keystore. On the right,under Additional Properties, click Personal certificates.

__ e. This screen shows the keystore entries for the node that was just created. Notice

there are two chained certificates. The first, whose alias is default, is the newnode’s personal certificate. Notice that it is set to expire in 1 year. The second

is the new node’s root certificate, which expires in 15 years. Take note of the

7/21/2019 WAS V7.pdf


Student Exercises




root certificate’s Serial Number (Serial #: _______________________ ) and

Expiration date (Date: _______________________ ).

__ f. Tracking the serial numbers can be helpful. In other parts of the administrativeconsole, the representation of the certificates can change. In order to tell whichcertificate is which, knowing the serial number can be helpful. Click the alias

default for further information. Knowledge of the Fingerprint can also behelpful. Usually knowing just the last couple of bits is sufficient — FB:55

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ g. Using the breadcrumb trail, return to the NodeDefaultKeyStore. This time, clickthe Signer certificates link. Notice that none are listed. This is because they are

stored in the trust files.

__ 2. Examine the node’s signer certificates.

__ a. Using the breadcrumb trail, return to the Key stores and certificates.

__ b. Click the CellDefaultTrustStore .

__ c. On the right, under Additional Properties, click Signer certificates.

__ d. At this point you get a list of signer certificates in the cell default truststore. Look

for the root signer certificate (not the personal certificate) for the new node. Thebiggest clue will be the node name of was7hostXXNode03. But you can also

7/21/2019 WAS V7.pdf


Student Exercises




possibly tell by the expiration date which you saw in the previous step. In thiscase, the alias is default_4.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Click the alias for the new node’s root signer certificate.

__ f. Notice that the Serial number matches the serial number from the previous stepwhere you noted the information for the node’s root certificate. This verifies the

fact that the signer certificate for the node’s root certificate was indeed added tothe cell default truststore. And since the cell default truststore is synchronized to

all nodes within a cell, all nodes and all application servers have access to allsigner certificates.

Information

It is expected that in a future fix pack, node certificates will no longer be signed by the noderoot certificate. Instead, upon federation, a new certificate will be generated for the

federating node which will be signed by the cell root certificate. This is beneficial since

adding new nodes to a cell will no longer require propagation of new plug-in keystores.

Examine certificate expiration and updating

Since the personal certificates have a life span of only 1 year, administrators need to beaware that these certificates will expire. Fortunately, WebSphere has a built-in mechanism

to automatically update these certificates when they are about to expire. And, since the

7/21/2019 WAS V7.pdf


Student Exercises




signer certificates remain the same, there is no need to propagate anything new to theremote nodes or plug-ins.

__ 1. Examine the certificate expiration settings.

__ a. In the administrative console, navigate to Security > SSL certificate and key

management. Under Configuration settings click Manage certificate

expiration.

Built into WebSphere is a service that runs through the list of all certificates and

replaces any that are about to expire. This screen configures when that service isrun. It could be run immediately by clicking Start now, or it can be scheduled. As

seen below, it defaults to running every forth Sunday at 21:30. This checking can beturned off by unchecking the Enable checking box. It is also possible to run the

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty checking service but to not automatically replace the existing certificates or to notdelete the replaced expiring certificates.

By default, the expiration notifications are written to the log file. Additionalnotifications, including e-mail, can be configured by clicking the Notifications linkunder Related Items.

Information

The name of the Expiration notification threshold field can be misleading.

When the expiration notification thread is run (either manually or through scheduling), it

checks to see if any certificates are within X days (defined by the expiration notificationthreshold) of the current date. If there are any, they are subject to replacement.

There is another field (not visible through the administrative console) that defines how

many days out the notification (but not replacement) occurs.

__ b. Run the expiration notification service now by clicking Start now. Using a texteditor, open the deployment manager’s SystemOut.log. Near the end of the file,

7/21/2019 WAS V7.pdf


Student Exercises




there will be an entry starting with “Expiration Monitor” and it looks somethinglike this:

__ c. Since the cell has been newly created, there should be no certificates that need

replacing. If any changes need to be saved, feel free to either save or discard.

__ 2. Use the security report to view the list of all the certificates and their expirationdates.

__ a. In the administrative console, navigate to Security > Global security. Click

Security Configuration Report.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. A new browser window shows the HTML report. Scroll to the bottom of the reportand find the Certificate Management section.

__ c. Notice the list of the certificates and the expiration dates. This report can be a

very helpful tool for administrators in dealing with their certificate management.

Warning

When WebSphere Application Server V7 updates a node certificate (either manually or

automatically), the specifics of the replacement certificate depend on the fix pack level.

If no fix packs are present (v7.0.0.0), the new node certificate will be created and will besigned by the cell root certificate (not by the node root certificate, as the original node

certificate was signed). This might be important if existing SSL relationships exist whichdepend on the propagation of the signer certificate.

In most situations, this does not cause a problem since all nodes have access to the cell

root signer via the cell default truststore. Also, all plug-ins have access to the cell rootsigner via the generated keystores. Where this could become an issue is in cases where

additional SSL configurations are established.

If fix pack 1 (7.0.0.1) has been installed, replacement node certificates will be signed by the

original signer. In most cases this means the node root certificate. Therefore, any existingSSL relationships should still work after a node certificate is replaced.

Future fix packs may change this behavior.

7/21/2019 WAS V7.pdf


Student Exercises




Plug-in key ring propagation

Not only do the processes within cells (deployment managers, node agents, and

application servers) need to have certificates and know about each other’s signercertificates, so do the Web server plug-ins. If the communication between the Web server

plug-ins and the application servers is to be secured, the plug-ins and application serversneed to be able to negotiate an SSL session. To do this, they need to have personal

certificates (by default the application servers use the node personal certificate) and haveaccess to each other’s signer certificates.

WebSphere is able to make sure that all of the required certificates are available to the

Web server plug-ins by creating the plug-ins keystores from within WebSphere. By doingso, WebSphere can make sure that not only does the plug-in have a valid personal

certificate, but that it also has all of the necessary node signer certificates. At the sametime, WebSphere can ensure that the plug-in’s signer certificate is also available in the cell

truststore.

The real problem with this approach is that once WebSphere generates the plug-in

keystore, it then still needs to be propagated to the machine running the Web server. Thereis also a problem with updating the plug-in keystores once new nodes are added to the cell(or if existing nodes have their signer certificates replaced). This would require that the

plug-in keystores be regenerated and repropagated to the Web server.

The propagation process of plug-in keystores is similar to the propagation of theplugin-cfg.xml file. It is usually done manually, but in some cases can be configured to be

done automatically (although this is usually not desirable).

__ 1. View the contents of the plug-in keystore.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. In the administrative console, navigate to Servers > Server Types > Web

servers. Click your webserver link (webserverXX). Then, under Additional

Properties, click Plug-in properties.

__ b. Notice the plug-in keystore file name. Initially this file can be found within the

configuration directory structure of the deployment manager. It can be foundunder the ihsnode directory. More specifically, the directory would be:

<profile_root>\DmgrProfile\config\cells\<cell-name>\

nodes\ihsnode\servers\<web-server>

This is also the same directory where the Web server specific version of the

plugin-cfg.xml exists.

__ c. Take note of the size of the file.

7/21/2019 WAS V7.pdf


Student Exercises




__ d. Next, examine the contents of this file. In the console, click the Manage keys

and certificates button. On the right, click Signer certificates.

__ e. At this point, there are probably at least two pages worth of signer certificates.

Scroll to the bottom of the page and click the button to go to the next page. Itwould also be possible to filter based on the name default*.

__ f. Verify that the signer certificate for the new node (was7hostXXNode03) isamong the signer certificates.

__ 2. Propagate the plug-in keystore file. Although this is usually a manual process, thereare some cases where it can be configured to be done automatically or through theadministrative console.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Using Windows Explorer, navigate to the <plugin_root>\config\webserverXXdirectory. Take note of the size and date-time stamp for the current

plugin-key.kdb.

__ b. Return to the administrative console and return to the Web server’s plug-in

properties page. Click the Copy to Web server key store directory button.

__ c. Notice the message at the top of the administrative console window shows asuccessful copying of the files:

__ d. Return to the Explorer window and verify that the size of the file (and thedate-time stamp) has changed.

__ 3. If you have time, try using iKeyman to open the kdb file above on the Web servermachine and verify that the new signer certificate has been propagated.

7/21/2019 WAS V7.pdf


Student Exercises




Configuring SSL for IHS (optional)

This section of the lab steps through the process of creating a certificate and a key ring.

These will then be used to configure SSL on the connection between the client browserand the Web server.

__ 1. Create a new directory to hold the key ring.

__ a. Create the directory: <ihs_root>\ssl

__ 2. Create a key ring with a self-signed certificate for IHS.

__ a. Run IHS’s iKeyman. This can be done through either a command-line window orusing Start > Programs > IBM HTTP Server V7.0 > Start Key Management

Utility. This could also be done from the command line by executing thefollowing command from <ihs_root>\bin:

ikeyman.bat

On UNIX, from the bin directory, use the following command:

./ikeyman &

__ b. Create a new key ring by selecting Key Database File > New.

__ c. Use type CMS, file name ihsKeyring.kdb, and a location of <ihs_root>\ssl Click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. When prompted for a password for the key ring, enter and confirm web1sphereas the password. If desired, modify the expiration time. Check the Stash the

password to a file check box.

Warning

The stash file is created containing an encoded form of the password. This encodingprevents casual viewing of the password, but is not highly secure. Therefore, you should

protect this file by using operating system file permissions to prevent all access fromunauthorized principals.

The file name of the stash file will be the same as the name of the key file, only it will have

an .sth suffix. The stash file gets stored in the same directory as the key file.

__ e. Click OK. __ 3. Create a new self-signed certificate.

__ a. In iKeyman, select Create > New Self-Signed Certificate and enter thefollowing information:

Table 21: Self-signed certificate details Example Description Key label IHSCertificate

Common name www.trade.com

Organization Trade

Organization unit Trade

Locality myLocation

State or province myState

Zip code myZipcode

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Accept the defaults for the Version, Key Size, and Validity Period.

__ c. Click OK.

Information

This stores the certificate in the key file in the Personal Certificates section. Optionally

(there is no need to do this in the exercise) it is possible to extract the public signingcertificate so that clients can use it. To do this, click Extract Certificate, and then enter a

File Name and Location. Click OK.

__ d. Exit iKeyman by going to Key Database File > Exit.

__ e. Check the contents of the <ihs_root>\ssl\ directory and verify that thefollowing files were created: ihsKeyring.kdb, ihsKeyring.sth, and ihsKeyring.rdb.

__ 4. Configure IHS for HTTPS. This requires modifying the httpd.conf in order to define

the required setting to enable SSL for IBM HTTP Server. It also includes loading theSSL module, defining a listener port, defining a virtual host, and enabling SSL.

__ a. Add www.trade.com to the hosts file by editing the file

C:\WINDOWS\System32\drivers\etc\hosts and adding a line at the bottom to

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty define the host name www.trade.com and map it to your system’s IP address.You can find your IP address by using the command ipconfig in a command

window.

The hosts file on UNIX systems can be found at /etc/hosts

The command to find your IP address on a UNIX system is: ifconfig -a

__ b. Save and exit the file.

__ c. Back up the httpd.conf. Since changes are about to be made to the httpd.conf,

it would be a good idea to make a backup of it before starting. Copy the httpd.conf in <ihs_root>\conf to httpd-backup.conf.

__ d. Using a text editor, open httpd.conf in <ihs_root>\conf. Add a virtual host

definition for HTTPS. This allows for the definition of HTTPS on a separatevirtual host from HTTP. Place these lines near the very bottom of the httpd.conf,

after the VirtualHost examples and before the loading of the WebSphere plug-inmodule.

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

Listen 0.0.0.0:443

<VirtualHost *:443>

SSLEnable

</VirtualHost>

KeyFile "C:/Program Files/IBM/HTTPServer/ssl/ihsKeyring.kdb"

7/21/2019 WAS V7.pdf


Student Exercises




SSLDisable

Information

There are sample configuration files in <software_dir>\ssl\ that can be used to copy

and paste. These files include only the last portion of a completed httpd.conf.

Make sure the paths and slashes are correct if this is being done on a UNIX system.

LoadModule ibm_ssl_module modules/mod_ibm_ssl.so

Listen 0.0.0.0:443

<VirtualHost *:443>

SSLEnable

</VirtualHost>KeyFile /usr/IBM/HTTPServer/ssl/ihsKeyring.kdb

SSLDisable

__ e. Save your updates and exit the editor.

Testing the SSL connection

__ 1. Restart the IBM HTTP Server process so that the new httpd.conf settings take

effect. __ a. Using the Window Services, select the IBM HTTP Server 7.0 service from its

context menu select Restart.

On UNIX, use the command <ihs_root>/bin/apachectl restart to restart the server.

__ b. Verify that the IBM HTTP Server process is running by checking the systemprocess list. If IBM HTTP Server failed to start, check the <ihs_root>\logs\error.log and

<profile_root>\logs\<webserver>\http_plugin.log for the possible cause.

__ 2. Connect to IBM HTTP Server using HTTPS.

__ a. First, verify that the Web server is actually running. Connect to the following site:

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty http://localhost/

__ b. Now that the Web server is known to be running, enter the following address toverify that HTTPS is working (notice, the only difference is that the HTTPprotocol was replaced with HTTPS):

https://localhost/

__ 3. Correct the certificate warnings. There should be a warning since there are a couple

of problems with the server’s certificate. The first problem is that the server namedoes not match the URL (localhost versus www.trade.com). The second problem

is that since a self-signed certificate is being used, the signer certificate is unknownto the browser. Both problems can be ignored, but the next few steps can help

correct the issues (these steps are specific to IE 7 — other browsers will havedifferent interfaces).

Since your browser will be different on UNIX, the next few steps will not apply to your

environment. In your case, simply accept the certificates.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Click Continue to this website.

__ b. Notice that the URL has a red background and there is a Certificate Errorwindow. Click the Certificate Error. Then click View certificates.

__ c. On the pop-up Certificate window, the message indicates that the CA Root

certificate is not trusted. This is simply because the certificate is self-signed and

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty unknown to the browser. Click the Install Certificate button to install the signercertificate.

__ d. Take all the defaults in the wizard that comes up. That will be a Next, anotherNext, a Finish and a Yes to install the certificate. Click OK and OK again to

close the dialog boxes.

__ e. Notice that the certificate warning is still there. Now use the following addressand notice that the certificate warning is gone:

https://www.trade.com/

__ 4. Finally, try connecting to both snoop and the TradeApplication using https:

https://www.trade.com/snoop

https://www.trade.com/Trade/web

__ a. Verify that the application servers are running.

__ b. Using a browser, connect to both of the addresses above.

Note : if application security is enabled, the snoop servlet will prompt for

authentication. This is because it has been configured to allow access to allauthenticated users. Use any of the user IDs that have been created already to

authenticate, for example wasadmin.

7/21/2019 WAS V7.pdf


Student Exercises




Notice that both addresses work correctly using secured communication. Also noticethe icon next to the address window indicating that the communications are going

over SSL (note: each browser has its own icon).

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2


This lab introduced basic HTTPS configuration concepts for both IBM HTTP Server andWebSphere Application Server.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 15. Auditing (optional) 15-1

5.2

Xempty Exercise 15.Auditing (optional)


The objective of this lab is to go through some of the new securityauditing features in WebSphere Application Server V7. This exercise

is split into two main sections. The first half goes through the processof enabling security auditing, setting basic audit configurations and

viewing the audit reports. The second half, which is optional, goesthrough some slightly more advanced features of the auditing

functionality, including encrypting and digitally signing the audit logs.

What you should be able to doAt the end of the exercise, you should be able to:

• Enable security auditing

• Configure security auditing for different administrative users

• Generate and view security audit reports

• Configure new event filters

• Configure digital signing for the audit logs

• Configure encryption settings for security auditing

Introduction

This lab goes through the process of configuring and enablingWebSphere auditing. It starts by defining a new administrative user

that is defined as an auditor role. This allows for a level of separationbetween those with administrator rights and those that can audit. Next,

the exercise configures and enables the basic auditing settings andviews the resulting audit logs.

Finally, the last section of the exercise is optional and goes very briefly

through some slightly more advanced features of auditing. Thesefeatures include adding filters, digitally signing, and encrypting audit

records.

7/21/2019 WAS V7.pdf


Student Exercises




Requirements

This exercise requires a workstation with WebSphere ApplicationServer V7 installed and that the previous exercises for this course

have been successfully completed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


Defining WebSphere administrative console users

WebSphere has the ability to grant administrative users different roles to distinguishbetween the sorts of access they have within a cell or application server. With WebSphere

Application Server V7, a new role of auditor has been added and is required to configureand enable any of the auditing features. By having a separate role for auditing, it is possible

to distinguish between administrative users and those users to whom you want to grantaccess for the auditing functions. First create some WebSphere users for testing purposes.

__ 1. For security reasons, it is not necessarily desirable to have administrators be able to

configure and control the audit settings. The primary security user has implicit rightsto the audit functionality, but other administrators do not (unless they have explicitly

had the audit role added to their user). This step goes through adding a new usernamed wasaudit and assigning it to the auditor role.

__ a. Log in to the WebSphere administrative console as wasadmin (or some other

user in the administrative security manager role).

__ b. Expand Users and Groups in the left navigation menu and select Manage

Users.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Leave the defaults and click Search. This displays the list of current WebSphereadministrative users.

__ d. Click Create to create the new wasaudit user.

Information

Other users may also exist, depending on which exercises have been completed.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ e. Enter the User ID: wasaudit Enter anything for the First name and Last name. Enter web1sphere for the


__ f. Click Close to exit the Manage Users wizard.

__ 2. Assign the Auditor role to the wasaudit user.


user roles. Click Add.

__ b. Click Search to display the list of available users. Select wasaudit from the

Available column near the bottom of the screen and click the right arrow to

move it to the Mapped to role column. Then select the Auditor role near the top

7/21/2019 WAS V7.pdf


Student Exercises




of the screen. Click OK to create the mapping between the wasaudit user andthe auditor role.

__ 3. Save the changes. Wait for the nodes to synchronize and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

Since these particular users are stored within the WebSphere configuration information, it

is a good idea to do a full resynchronize with the nodes after creating new users.

Configure and enable WebSphere security auditing

Now that an auditor user exists, this part of the exercise configures and enables

WebSphere security auditing. Before auditing can be enabled, several configurationsettings need to be set so that the audit service knows what to do with the audit events.

This section of the exercise simply turns on the basic auditing functions and sends theoutput to a log file.

__ 1. Before enabling security auditing, there are some configuration settings that need to

be set.

__ a. In the administrative console, click Security > Security auditing.

__ b. Before enabling the auditing, it is necessary to determine what happens with theaudit records. Start by clicking Audit monitor under Related Items.

__ c. Under Notifications, click New.

__ d. This screen defines the notification specifics. Enter Log_Notification for the

Notification name and check the Message log box. This causes the audit logs

7/21/2019 WAS V7.pdf


Student Exercises




to be written to a local log file. It is also be possible to configure e-mailnotifications if that is desired.

__ e. Click OK And Save the changes.

__ f. Wait for the nodes to synchronize and click OK.

__ g. Now that a notification definition exists, it is possible to configure auditing to use

that notification. On the same screen, check the Enable monitoring box and

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty verify that Log_Notification has been selected in the Monitor notification drop-down list.

__ h. Click OK and Save the changes.

__ i. Wait for the nodes to synchronize and click OK. This returns you to the main

Security auditing page. __ 2. Now that the configuration settings have been completed, it is possible to enable the

auditing.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. At this point, check the Enable security auditing box. From the Audit

subsystem failure action drop-down list, select Log warning. And from the

Primary auditor user name, select wasaudit.

Information

The Audit subsystem failure action drop-down menu has the following options:

• No warning: The No warning action specifies that the auditor will not be notified

of a failure in the audit subsystem. The product will continue processing but auditreporting will be disabled.

• Log warning: The Log warning action specifies that the auditor will be notified of

a failure in the audit subsystem. The product will continue processing but auditreporting will be disabled.

• Terminate server: The Terminate server action specifies the application server

to gracefully quiesce when a fatal error occurs in the auditing subsystem. If

e-mail notifications are configured, the auditor will be sent a notification that anerror has occurred. If logging to the system log is configured, the notification ofthe failure will be logged to the system file.

__ b. Click Apply and Save the changes.

__ c. Wait for the nodes to synchronize and click OK.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 3. Restart all the processes in the environment so that they all pick up the changes.In this case, this includes the deployment manager, the node agents, and the


View the audit logs

WebSphere security auditing has now been turned on. This part of the exercise goesthrough the process of viewing the audit data.

The fastest way to view the data is to simply look at the log file that is generated, but that

can be difficult to read. The other way to view the data is to use wsadmin to generate anHTML report. This part of the exercise goes through both of these options.

__ 1. View the log records with a text editor.

__ a. Using a text editor, open the file called BinaryAudit in the <profile_root>\DmgrProfile\logs\dmgr directory.

Information

In a stand-alone application server environment the name of the file will simply beBinaryAudit.log. In a federated environment, the file name will differ depending on which

process you are inspecting.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Notice the sequence numbers. Those are the individual audit records, but thisformat certainly is not easy to read.

__ c. If a better text editor than Notepad is used, the output can be slightly more

readable, but still not easy to read.

__ d. It is also possible, if available, to use tail -f in a command window to trackthe entries added to the log file in real time.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. Verify that auditing is actually seeing events that need to be reported.

__ a. Open a new browser instance to the administrative console.

__ b. When prompted for a user name and password, enter BADUSER and

web1sphere

__ c. Reopen the audit log file in a text editor and search for BADUSER

There will be several instances, but the format of the records makes it difficult toread and understand.

__ 3. View the log entries using the Audit Log Reader. This is an interface availablethrough wsadmin which will convert the audit log entries into an HTML report.

__ a. Open a command prompt and change directory to

<profile_root>\DmgrProfile\bin

__ b. Enter the command:

wsadmin -lang jython -username wasaudit -password web1sphere

The command on UNIX platforms is:

./wsadmin.sh -lang jython -username wasaudit -password web1sphere

__ c. Once the wsadmin shell has started, enter the following command to generate

an HTML report:

AdminTask.binaryAuditLogReader("-interactive")

7/21/2019 WAS V7.pdf


Student Exercises




__ d. The interactive mode will prompt for input for the following questions. Enter thefollowing:

__ e. At this point an HTML file by the name of basicAuditReport.html is generated.Browse to the C:\ directory and double-click basicAuditReport.html to open it in

a browser.

Table 22: Responses for interactive AdminTask

Field Value

fileName <enter audit log file name with full path>

outputLocation

C:\basicAuditReport.html

UNIX: /tmp/basicAuditReport.html

keyStorePassword <blank>

dataPoints <blank>

timeStampFilter <blank>

reportMode basic

outcomeFilter <blank>

eventFilter <blank>

sequenceFilter <blank>

Select F

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty

The audit report was generated in the /tmp directory. With a Firefox browser, go to File >

Open File and browse to /tmp. Select basic AuditReport.html and click Open.

__ 4. Generate a complete audit report.

7/21/2019 WAS V7.pdf


Student Exercises




__ a. Using the commands in the previous step, regenerate the audit report. But thistime enter complete for the reportMode and change the output file name to

completeAuditReport.html

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. View the report with a browser. Notice that the audit reports include much moredetail.

Information

For more detailed information about the audit logs and what information is available, see

the article in WebSphere Application Server V7 Information Center, Using the audit reader.

Create a new event filter (reference, optional)

At this point, WebSphere Security Auditing has been configured and enabled. And, the logshave been viewed through a text interface as well as an HTML report. Those are the most

basic steps for getting started with Auditing.

The rest of the exercise goes through some additional features, including configuring filtersand encryption of the audit data. Since these features might not be of interest to all

students, these parts have been marked as Reference and are not covered in completedetail.

In this part of the exercise, an additional event filter is created. This filter tells the auditservice to audit any authorization failures.

__ 1. Add an Event type.

__ a. Log in to the administrative console as wasaudit using the password of web1sphere

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Go to Security > Security auditing.

__ c. Click Event type filters under Related Items.

__ d. Click New.

__ e. Enter Authorization_Event for the Name. Select SECURITY_AUTHZ from

the Selectable events region and click the right arrow to move it into the

Enabled events. Then select DENIED from the Selectable events outcomes and click the right arrow to move it into the Enabled event outcomes.

__ f. Click OK and Save the changes.

__ g. Wait for the nodes to synchronize, and click OK.

Information

Although the event has now been defined, WebSphere still needs additional configurationso that it will both gather and report audit records relating to the event.

The event factory is where the configuration is done to define what events are gathered.

The service provider is where the configuration occurs to define which events arereported. See the information center for details on the numerous other event types that can

be configured.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. The next step is to configure the service provider.

__ a. Go back to the Security auditing page and click Audit service provider. Thereis only one defined at this point, click auditServiceProviderImpl_1.

__ b. Notice that the Authorization_Event that was just created is listed under the

Selectable filters, but is not part of the Enabled filters list. Select the new filterand click the right arrow to move it to the Enabled filters list.

__ c. Click OK and Save the changes.

__ 3. The next step is to update the event factory configuration.

__ a. Return to the Security auditing page and click Audit event factory

configuration. There is only one defined at this point; click

auditEventFactoryImpl_1.

7/21/2019 WAS V7.pdf


Student Exercises




__ b. Like in the service provider screen, move the Authorization_Event to the

Enabled filters for the event factory.

__ c. Click OK and Save the changes.

__ 4. Restart all of the WebSphere processes (deployment manager, node agents, andapplication servers) in order for the changes to take effect.

Note

Since you logged in to the administrative console as wasaudit instead of wasadmin, youwill not be able to stop the server process from the console. Either log out and log back in

as wasadmin or restart the servers from the command line.

__ 5. Once the servers have been restarted, look at the audit log file in the

<profile_root>\DmgrProfile\logs\dmgr directory. Take note of the latestsequence number and enter it here: ____________

__ 6. Now, attempt to stop the deployment manager using wasaudit as the user name.

Since the wasaudit user is not a console administrator, this should fail.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ a. Open a command prompt and change directory to

<profile_root>\DmgrProfile\bin

__ b. Enter the command: stopManager.bat -username wasaudit -password

web1sphere

__ c. Once the stopServer command has failed, look at the BinaryAudit.log file again(the one with the latest time stamp if there is more than one audit log). Look for

the SECURITY_AUTHZ entry that shows the denial.

Additional audit features (optional reference)

This section of the exercise is optional reference. It simply lists and briefly describes some

of the other features that can be taken advantage of when it comes to the audit logs.

This section is not intended to provide detailed instructions.

__ 1. Digitally sign the audit records.

7/21/2019 WAS V7.pdf


Student Exercises




Information

Digitally signing the audit logs is interesting because that can protect the integrity of the

data within the files.

__ a. In order to digitally sign the audit records, a number of things need to happen,

including enabling of the signing as well as choosing which certificate is used todo the signing. After the configuration is done, all the WebSphere processes

need to be restarted.

__ b. In order to get to the configuration screen to configure the signing, as an

administrator go to Security > Security auditing > Audit record signing

configuration.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ c. Since you will not actually be configuring the signing in this exercise, click

Cancel.

__ 2. Encrypt the audit records.

Information

Encrypting the audit logs not only protects the integrity of the data within the files but alsomakes them unreadable by anyone without the right access to the certificate used to

encrypt the data.

In order to encrypt the audit records, a number of things need to happen, includingthe creation of a special keystore and certificate to be used for encrypting the audit

data. Then, the encryption needs to be enabled and the new certificate needs to bespecified. After the configuration is done, all the WebSphere processes need to be

restarted.

__ a. To create the new keystore, go to Security > Security auditing > Audit

encryption key stores and certificates, click New and create a keystore.

__ b. Enter AuditKeyStore for the Name and<profile_root>\DmgrProfile\properties\audit for the Path. Enter was1sphere for both passwords. Accept the default type PKCS12.

__ c. Click OK. Save changes.

__ d. You should now see the new keystore listed. Click AuditKeyStore.

7/21/2019 WAS V7.pdf


Student Exercises




__ e. On the right, click Personal certificates to create the audit certificate that will belocated in the new keystore.

__ f. Click Create self-signed Certificate and enter the appropriate information.

Important

You will not actually create the self-signed certificate in this exercise. So you will just clickCancel at this point.

__ g. Click Cancel.

__ h. To configure the encryption, go to Security > Security auditing > Audit record

encryption configuration. Enable the encryption and specify the certificate to

be used.

__ i. Click Cancel.

__ j. Restart all server processes.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ k. After all the processes have been restarted for the changes to take effect, youwill need to specify the keystore and keystore password when generating the

audit reports.

__ 3. Enabling verbose logging.

__ a. In order to enable verbose audit logging, go to Security > Security auditing,check the Enable verbose auditing box, and click Apply.

Information

For more information on verbose audit logging, see the article in WebSphere ApplicationServer V7 Information Center on Security Auditing detail.

End of lab

7/21/2019 WAS V7.pdf


Student Exercises





This exercise looked at enabling and configuring security auditing using the WebSphereadministrative console. It then went through several different ways to view the data. Finally,

in optional sections, the exercise also looked very briefly at some slightly more advancedfeatures, including digitally signing and encrypting the audit records.

7/21/2019 WAS V7.pdf


Student Exercises



© Copyright IBM Corp. 2009 Exercise 16. Using the performance monitoring tools 16-1

5.2

Xempty Exercise 16.Using the performance monitoringtools


In this exercise, you use the performance tools available in

WebSphere Application Server to monitor various application andserver resources in real time, and generate tuning advice.



• Use the integrated performance viewer within the administrativeconsole

• Configure data collection levels on application resources

• Monitor the data collected by the performance instrumentation

Introduction

WebSphere Application Server offers a collection of tools to monitor

and help tune the runtime environment, including Tivoli PerformanceViewer, the TPV advisor and request metrics.

The Tivoli Performance Viewer is the user interface for monitoring the

performance of application servers, servlets, and other resources inthe environment. It is integrated into the administrative console and

can be used for a number of tasks, including viewing real-timeperformance data, gauging the load on servers over time, and

evaluating the efficiency of resource allocations.

The Tivoli Performance Viewer advisor provides advice to help tunesystems for optimal performance and recommendations to remedy

inefficient server resource settings. It generates advice based on datacollected by the Performance Monitoring Infrastructure (PMI).

Request metrics allow you to track the response time of the individual

components traversed by a transaction, providing you with an in-depthunderstanding of the application flow that satisfies the user request.

7/21/2019 WAS V7.pdf


Student Exercises




Requirements

To complete this exercise, you require a properly set up computer withWebSphere Application Server installed as well as the necessary

startup and program files.

7/21/2019 WAS V7.pdf


Student Exercises




5.2


Preface

In the first part of this exercise, you use Tivoli Performance Viewer to monitor applications

running on WebSphere Application Server.

When the Performance Viewer is running in a Network Deployment environment, the datais collected at each of the nodes and stored in memory at the node agent. Data is then

viewed from the deployment manager. This architecture enables the monitoring work to bedistributed among the nodes.

In this exercise, you monitor applications running on profile1’s single server, server1.

Resetting the environment

If you changed the maximum heap size to a lower value (because class machines often do

not have enough memory to run the deployment manager), it is recommend that yourestore the maximum heap size to the default setting, because the Tivoli Performance

Viewer executes inside the deployment manager.

__ 1. Verify that the deployment manager, and the node agent and WebSphere

Application Server server1 in profile1 are all running.

__ 2. Start the administrative console and log in.

Information

You can stop server2 and its node agent to free up physical memory if the class machineshave limited RAM. As a rule of thumb, if your machine has less than 2 G of RAM it may bebeneficial to run only server1 for this lab.

Enabling performance monitoring and setting user preferences

Before the Tivoli Performance Viewer can begin monitoring data, the performancemonitoring service must be started. The monitoring service is enabled by default on the

application server.

__ 1. Verify that the Performance Monitoring Infrastructure (PMI) is enabled for server1.

__ a. In the administrative console navigation tree, click Monitoring and Tuning >

Performance Monitoring Infrastructure (PMI). In the workspace area on theright pane of the administrative console, click server1.

__ b. On the Configuration tab, make sure that Enable Performance Monitoring

Infrastructure (PMI) is already selected. This is the default setting.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. In the Currently monitored statistic set area, notice that the Basic level isselected. This is the default monitoring level setting.

__ d. Click the Runtime tab and verify that Basic is selected (default statistic set).

__ e. Click Cancel.

Information

The Runtime tab allows you to change the monitoring settings without having to restart theserver. The new settings are applied immediately after clicking OK. If the Persist my

changes check box is selected, the runtime settings are saved and will appear in the

Configuration tab. This option allows you to make immediate changes to the PMI settings,

and have them become the standard configuration the next time the server is started.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ 2. In order to get more frequent data collection, change the Monitoring Refresh Rate to 20 seconds.

__ a. Under Monitoring and Tuning, expand Performance Viewer and click Current

activity.

__ b. On the right pane, select the check box for server1 and start the monitoringprocess for this server by clicking Start Monitoring.

__ c. Click the server1 link to view its current activity. If the tree for server1 is

collapsed, click [+] next to server1 to expand it. Expand Settings and click User. __ d. In the User Settings panel, change the Data Collection Refresh Rate to 20

seconds. Click Apply.

7/21/2019 WAS V7.pdf


Student Exercises




Viewing servlet and Web applications module dataTo view any performance data in a graphical mode, the browser must be enabled to show

Scalable Vector Graphics (SVG) data. SVG is a graphics file format and Web developmentlanguage that can be displayed using an SVG Viewer, or SVG enabled browser. You

should have already installed the SVG Viewer in a previous exercise.

__ 1. If you have not already done so in a previous exercise, install the SVG Viewer fromAdobe before using the browser to view the data produced by TPV.

__ a. Run the SVGViewWindows.exe program to install this viewer. It can be found in

the <software_dir>\Troubleshooting\SVGViewer directory.

Linux

Nothing needs to be done on Linux. For background, feel free to read the rest of this

information block.

The Firefox browser has SVG support built in, so no plug-in needs to be installed.Unfortunately, the console support within WebSphere does not correctly recognize that

Firefox on Linux has the correct support.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty There are a number of workarounds for this problem. One, which has already been addedto the standard Linux image for this course, is to add a config property to Firefox. This is

done by typing the following into the URL field:

about:config

Then the following string was added (right-click New > String):

name: general.useragent.overridevalue: "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14)

Gecko/20080410 Firefox/2.0.0.14"

__ b. Log out of the administrative console and restart the browser.

Windows

If you are using Mozilla or Firefox as your browser, there may be some graphical data

visible without installing SVG Viewer, but you should still install the viewer. For reference,the latest version of SVG Viewer is available at: http://www.adobe.com/svg/

__ 2. Open a new browser and start the snoop servlet at the Web address (URL):


If application security is enabled, you will be prompted for a user ID and password.

Log in as wasadmin, if necessary. This executes the snoop servlet, which is part of the Default application, and brings

up a page with various information about the servlet. A servlet must be loaded inorder for data collection to take place. Leave the browser window open as you will

come back here soon.

__ 3. Using the administrative console, navigate to the Tivoli Performance Viewer andmonitor server1:

__ a. Click Monitoring and Tuning > Performance Viewer > Current activity >

server1.

__ b. Expand Summary Reports and select Servlets. In the Servlets SummaryReport pane, locate the entry for the Snoop Servlet, which is part of

DefaultWebApplication.war.

Information

You may have to go the next page of the report to find the listing for the snoop servlet. Use

the arrows at the bottom of the page to navigate to the different pages of the report. As an

7/21/2019 WAS V7.pdf


Student Exercises




alternative, you can use filters to reduce the amount of information shown, or sort byapplication name or other attribute.

__ c. Explore the additional summary reports:

• Are there any Enterprise JavaBeans being monitored? Click EJBs underSummary Reports. The EJBs Summary Report lists all enterprise beans

running on this server, the amount of time spent in their methods, thenumber of EJB invocations and the total time spent in each enterprise

bean.

• Click Connection Pool. The Connection Pool Summary Report lists alldata source connections that are defined in the application server and

shows their usage over time. The performance data is displayed in graphform.

• Click Thread Pool. The Thread Pool Summary Report shows the usage

of all tread pools in the application server over time.

__ 4. Inside Tivoli Performance Viewer (TPV), view the available performance countersfor the snoop servlet and the JVM Runtime module.

__ a. In TPV, expand Performance Modules and select the JVM Runtime check box.

Expand Web Applications > DefaultApplication >

DefaultWebApplication.war > Servlets and select Snoop Servlet.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

XemptyInformation

If Snoop Servlet is not available, try to call snoop again using the other browser, then click

Refresh in the TPV navigation pane.

__ b. Click View Module(s) at the top of the viewer (you may need to scroll your

browser). You will see a table or a graph displaying the monitored data.

7/21/2019 WAS V7.pdf


Student Exercises




__ c. Use the browser to reload the snoop servlet several times by clicking the

browser refresh button. Review the changes in the console.

Information

You should see changes in the metrics for the snoop servlet. The request count should

increase and the service time may change. Keep in mind the JVM Runtime counters maychange too.

Warning

When viewing graphs and comparing lines, take note of the Scale value. The Performanceviewer scales values such that all data points can fit on the graph. Notice in the screen

capture above that the graph for UpTime appears above the HeapSize graph even thoughthe values are lower.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. In the Performance viewer, click View Table to switch to a tabular view of theperformance data. You can toggle back and forth between the table and graph

view by selecting the View Table or View Graph button.

__ e. Reload the snoop servlet several times and observe the servlet metrics

7/21/2019 WAS V7.pdf


Student Exercises




__ f. You can also test the HelloHTML.jsp by selecting it in the Performance

Modules tree as you did for the snoop servlet. Then enter the following address

in the browser window:

http://localhost:9080/hello

__ g. To monitor other modules and components, you may need to click Refresh andView Module(s) again.

Using the TPV performance advisor

WebSphere Application Server includes a performance advisor, the TPV advisor, which is

accessed from inside the Tivoli Performance Viewer and provides helpful tuning advice forvarious resources — for example, dynacache size, JVM heap size, and so forth. The TPV

advisor also provides recommendations to address inefficient settings.

__ 1. To access TPV advisor messages, in the administrative console, select Monitoring

and Tuning > Performance Viewer > Current Activity > server1. In the TPV

navigation pane, click Advisor under server1.

__ a. In the pane on the right, read the provided advice messages.

Are there some Alert messages?_____Is there a configuration advice message?____ If more than one page is available, view the messages on subsequent pages.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ b. Click the link for the TUNE5042W: Enable servlet caching... message to seethe advice details.

Information

In your lab environment, the CPU utilization is usually low. You should see the configurationadvice to enable the servlet caching with descriptions as to how to use the console to

enable this feature.

You should run the performance advisor with a representative workload. ApacheBench isonly a simple tool, not designed for distributed software testing. A more robust tool is IBMRational Performance Tester

(http://www.ibm.com/software/awdtools/tester/performance/index.html) orOpenSTA (http://opensta.org/).

Hint

The TPV advisor requires that you enable performance modules, counters, or both.

You can find more details in: IBM Redbook, SG24-6392, IBM WebSphere Application

Server V6 Scalability and Performance Handbook .

7/21/2019 WAS V7.pdf


Student Exercises




Using request metrics

Request metrics log the time spent at major components of the application server, such as

the Web server plug-in, Web container, EJB container, and so forth.

The request metric architecture differs from the Performance Monitoring Infrastructure(PMI). PMI provides information about average system resource usage, with no correlation

between the data across different WebSphere components.On the other hand, request metrics track each individual transaction within WebSphereApplication Server, recording the response time of the major components such as time in

the Web server or in the Enterprise JavaBeans (EJB) container. The collected informationcan be saved to log files or forwarded to an Application Response Measurement (ARM)

agent. __ 1. Using the administrative console, enable request metrics by selecting Monitoring

and Tuning > Request metrics.

__ a. Under General Properties, select Prepare Servers for request metricscollection.

__ b. Under Components to be instrumented, select ALL.

__ c. Set Trace level to Debug.

Information

Setting the trace level to Debug provides detailed instrumentation data, including response

times for all intra-process servlet and Enterprise JavaBeans (EJB) calls. This provides a

fine level of detail on each method call.Setting the trace level to Hops generates instrumentation information on processboundaries only (for example, a servlet request coming from a browser or a Web server

and a JDBC request going to a database).

You can also filter requests so that only specific incoming requests will result in requestmetrics being logged. This can keep the logs from being overloaded with request metrics

for every request.

7/21/2019 WAS V7.pdf


Student Exercises




5.2

Xempty __ d. Under Request Metrics Destination, select Standard Logs.

__ e. Click OK.

__ f. Save directly to the master configuration and log out of the administrativeconsole.

__ g. Restart server1.

__ 2. Open a Web browser and run the Trade application by entering the following

address:

http://localhost:9080/Trade/web

__ 3. Log in to the Trade application as the user: client/web1sphere

Notice that the first page returned is the Account Information page: it shows basicuser information including name, e-mail address, account balance, and home and

business addresses.

__ 4. Now look at the standard output log. In the <profile_root>/profile1/logs/server1 directory, open the SystemOut.log

file. Find the first entry with a message ID of PMRM0003I: 0000002e PmiRmArmWrapp I

PMRM0003I: parent:ver=1,ip=192.168.61.129,time=1233808789417,

7/21/2019 WAS V7.pdf


Student Exercises




pid=1548,reqid=1,event=1 - current:ver=1,ip=192.168.61.129,

time=1233808789417,pid=1548,reqid=1,event=1 type=URI

detail=/Trade/web/login.jsp elapsed=31

Request metrics messages appear in the log with the message ID of PMRM0003I.

Notice that the first entry corresponds to the URI /Trade/web/login.jsp, which is

invoked when you click the Login button. Two correlators are shown, a parentcorrelator and a current correlator, representing the upstream request and thecurrent operation, respectively. A correlator consists of the comma-separated fields

following the “parent” or “current” keyword. If the parent and current correlators arethe same, as in this case where all field values are the same (including reqid=1),

then the record represents an operation that occurs as it enters WebSphereApplication Server. In this example, the login.jsp invocation took 30 milliseconds to

execute.

Information

The time and pid fields are the start time and ID of the application server process. Type and

detail are the description of the type of operation being timed and its name, respectively.Most important is the measured elapsed time in milliseconds, which includes all

suboperations called by this operation. The reqid is an unique ID assigned to the requestby request metrics.

__ 5. How much time did the retrieval of the Account Information page take? Scroll to the

bottom of the log and look for a record with type=URI anddetail=/Trade/web/AccountInfo. In this example, the elapsed time was 31

seconds. This cumulative time includes all suboperations invoked by theAccountInfo servlet. Write down the correlators’ (identical) reqid value (1 in this

case): _____

__ 6. Disable Request Metrics.

__ a. Select Monitoring and Tuning > Request metrics.

__ b. Deselect Prepare Servers for Request metrics collection.

__ c. Click OK.

__ d. Save directly to the master configuration and log out of the administrative

console.

__ e. Restart server1.

End of exercise

7/21/2019 WAS V7.pdf


Student Exercises




5.2


In this lab, you used WebSphere’s PMI technology and integrated Tivoli PerformanceViewer to monitor application and system resources. You enabled the request metrics

function and used it to monitor application flow. In addition, you used the TPV Performanceadvisor to generate tuning advice.

7/21/2019 WAS V7.pdf


Student Exercises




7/21/2019 WAS V7.pdf


5.3

ackpgBack page

Documents

WAS V7.pdf