Different timezone in WebLogic Logs and on OS

Check the time using the below commands,

date
hwclock
If this is as expected then check below

hwclock --localtime


If this is incorrect then synchronise using below command, (with root)

 hwclock --systohc --localtime



 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/sect-configuring_the_date_and_time-hwclock



 or you add the below startup parameter in weblogic,

 -Duser.timezone=GMT

 but I think it is OS related issue so better you resolve it on OS. 

.appmergegen" Directories Being Created And Taking Up Disk Space

In the "tmp" directory, many ".appmergegen" directories are getting generated and it takes up lot of disk space.  This appears to happen when applications are monitored via the Administration Console. Can these directories be deleted?

When deploying applications or monitoring complex applications via the Administration Console, those directories are created. Those can (and should) be removed every time there is a re-deployment or a new deployment

Example:
rm -rf .appmergegen*

These files/directories are created during application deployment and can safely be removed.
Also, an alternative, use the parameter: "-Djava.io.tmpdir= <path>" to generate the files at a different location and then delete them safely.

HALF_OPEN_SOCKET_RETRY weblogic proxy plugins with SSL

Thu Jun 22 03:24:04 2017] [error] [client 192.168.0.1] <636514981270442> weblogic: *******Exception type [HALF_OPEN_SOCKET_RETRY] (attempt to read from disconnected socket:Was unexpected EOF) raised at line 792 of URL.cpp
[Thu Jun 22 03:24:04 2017] [error] [client 192.168.0.1] <636514981270442> weblogic: *******Exception type [HALF_OPEN_SOCKET_RETRY] (attempt to read from disconnected socket:Was unexpected EOF) raised at line 792 of URL.cpp
[Thu Jun 22 03:24:04 2017] [error] [client 192.168.0.1] <636514981270442> weblogic: *******Exception type [HALF_OPEN_SOCKET_RETRY] (attempt to read from disconnected socket:Was unexpected EOF) raised at line 792 of URL.cpp

Environment details -
1. Apache  -2.2.25
2. Weblogic - 12.2.1.1
3. OFMW  - 12.2.1.1

Solution -

Create the WLSWallet file with user which is running apache and use the orapki utility to create the wallet file which is coming with mod_wl also add the apache modules in to the LD_LIBRARY_PATH as below.

export LD_LIBRARY_PATH=/usr/local/apache2/modules:/u01/Middleware/webgate/apache/lib:$LD_LIBRARY_PATH

WebCenter Portal Security Layers

WebCenter Portal Security Layers

WebCenter Portal applications share the same four bottom security layers (WebCenter Security Framework, ADF Security, OPSS, and WebLogic Server Security). The application layer will, of course, depend on the implementation.

1. WebCenter Portal Application Security
WebCenter Portal provides support for:
• Application role management and privilege mapping
• Self-registration
• Portal-level security management
• External application credential management

2. WebCenter Portal Security Framework
The WebCenter Portal Security Framework provides support for:
• Service Security Extension Framework (a common permission-based and role-mapping based model for specifying the security model for services)
• Permission-based authorization
• Role-mapping based authorization
• External applications and credential mapping
3. ADF Security
ADF Security provides support for:
• Page authorization
• Task flow authorization
• Secure connection management
• Credential mapping APIs
• Logout invocation, including logout from SSO-enabled configurations with Oracle Access Manager and Oracle SSO
• Secured login URL for ADF Security-based applications (the adfAuthentication servlet)

5. Oracle Platform Security Services (OPSS)
OPSS provides support for:
• Anonymous-role
• Authenticated-role
• Identity store, policy store, and credential store
• Identity Management Services
• Oracle Web Service Manager Security
• Authorization
• Policy and Credential Lifecycle

6. WebLogic Server Security
WebLogic Server Security provides support for:
• WebLogic authenticators
• Identity asserters
• J2EE container security
• SSL

How to check applied patches on weblogic

To check the applied patches on weblogic execute the below command,

1. Using the "java weblogic.version" command:

cd <gc_inst>\user_projects\domains\GCDomain\bin
. ./setDomainEnv.sh
which java
java weblogic.version -verbose


2. Using BSU:

cd <MIDDLEWARE_HOME>\utils\bsu
./bsu.sh -report

java.io.IOException NodeManager shows inactive in WebLogic console

Add the below parameter in the nodemanager.properties file

SecureListner=true

restart the nodemanager

WebLogic patch with Smart Update Utility

Below are the steps to apply patches on weblogic using the smart update utility.

1. Stop all WebLogic servers.

2.  unzip patch to {MW_HOME}/utils/bsu/cache_dir or any local directory
 
   Note: You must make sure that the target directory for unzip has required write and executable permissions
         for "user" with which the component being patched is installed.

3. Navigate to the {MW_HOME}/utils/bsu directory.
 To Apply patch -
 - Execute bsu.sh -install -patch_download_dir={MW_HOME}/utils/bsu/cache_dir -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}
   Where, WL_HOME is the path of the WebLogic home
 
 To Remove patch -
 - Stop all WebLogic Servers
 - Navigate to the {MW_HOME}/utils/bsu directory.
 - Execute bsu.sh -remove -patchlist={PATCH_ID} -prod_dir={MW_HOME}/{WL_HOME}

4. Check WebLogic Version -

 The following command is a simple way to determine the application of WebLogic Server PSU.

  $ . $WL_HOME/server/bin/setWLSEnv.sh
  $ java weblogic.version

  

Recovering the WebLogic Admin Password and datasource password using WLST

To recover the Admin password and data source password using the wlst, follow the below steps.

$ cd $DOMAIN_HOME/bin

$. ./setDomainEnv.sh

start wlst

$cd $WL_HOME/common/bin/wlst.sh

run the following command

from weblogic.security.internal import BootProperties .BootProperties.load(“/oracle/Middleware/user_project/domains/PROD_DOMAIN/servers/PROD_Adminserver/security/boot.properties”,false)
prop = BootProperties.getBootProperties()
print “username: ” + prop.getOneClient()
print “password: ” + prop.getTwoClient ()

the username and password will be displayed on the screen, using the same method we can recover the data source password also.

Enabling JRockit Mission Control Flight Recorder

    To enable to flight recording add the following server start parameter

-XX:FlightRecorderOptions=defaultrecording=true,disk=true,repository=./jfr/Prod_server01,

maxage=1440ms,size=100m

maxage and size value 0 = unlimited

 Generating the heap dump automatically on OOM ( Out Of Memory ) conditions

add the below argument in server startup parameter 

-XX:+HeapDumpOnOutOfMemoryError

heap file dump generating same like generating using jrcmd command

Thread Dumps

The thread dumps can be taken from the administration console, shell or using jrcmd command in weblogic

              a)   Using administration console

console — environment — servers– server name — monitoring — threads — Dump Thread Stacks

              b)   Using jrcmd

$ps aux | grep Prod_server01 | grep -v grep | awk ‘{print $2}

$jrcmd PID print_threads some_log_file

     c)   Using a shell command

$Kill -3 Server PID

Set page load time in access.log

Login to the Console —> lock & edit —> Environment —> servers —> managed server name  —> Logging – > http – > advanced —> extended —> format – > and type the logging format.

c-ip date time cs-method cs-uri sc-status bytes time-taken

save and activate changes, repeat the above procedure for all managed server
It will show you which pages or request taken longer time

Identity Store Configuration — Add multiple Authenticatior in WebLoigc

After Adding the multiple authentication provider  in WebLogic, we need to add some additional property.

To Add these property first login to the em and perform the below steps,

Expand the Domain Name –> Right Click on domain name –> Identity Store Configuration –> then add the below property

        1)  Virtualize –> true 

    2)   PROPERTY_ATTRIBUTE_MAPPING  –> GUID=uid

        3) user.login.attr    –> uid

       4)  CONNECTION_POOL_CLASS  –> oracle.security.idm.providers.stdldap.JNDIPool — This comes default

=====================================================================================================

After adding the virtualize=true property,the side effect is that your domain logs may capturing a high value of libOVD

warning messages.

To prevent that unwanted messages perform the following the steps

Connect to the SOA domain:

connect(‘<admin user>’,'<admin password>’,’t3://<admin host>:<admin port>’)

Run this command for each managed server:

setLogLevel(target='<managed server name>’,logger=’oracle.ods.virtualization’,level=’ERROR:1′,addLogger=1)

Connect to the WCP domain:

connect(‘<admin user>’,'<admin password>’,’t3://<admin host>:<admin port>’)

Run this command for each managed server:

setLogLevel(target='<managed server name>’,logger=’oracle.ods.virtualization’,level=’ERROR:1′,addLogger=1)

**Restarts are not necessary.**