Troubleshooting: clients

This section provides some basic information about how to anticipate and correct issues related to the web client. This includes the following issues:

• Workflow diagrams are not displayed when Service Manager is accessed from the web client
• Cannot automatically log in to Service Manager from the web client
• Unable to view an attachment from the web client
• Windows client error: No trusted certificate found

Troubleshooting: workflow diagrams are not displayed in the web client

Workflow diagrams cannot be displayed when Service Manager is accessed from the web client.

Per Federal Desktop Core Configuration (FDCC) restrictions, the Java applet is not allowed to run in Internet Zone. Follow either of these two solutions to solve this issue:

Solution 1: Add the address of the web client to the Local intranet Zone setting or the Trusted sites Zone setting (recommend)

Per FDCC restrictions, the security settings of Internet Explorer are locked by default and the users cannot change these settings.

Follow these steps to unlock and change the Internet Explorer security settings:

1. Log on to the computer as a local administrator. 
2. Open the Windows command prompt.

3. Type the following command and press Enter to open the Group Policy window:

   gpedit.msc

4. Double-click Computer Configuration > Administrative Templates > Windows Components > Internet Explorer.
5. Double-click Security Zones: Do not allow users to change policies and select Not configured.
6. Click Apply, and then click OK to close the window.
7. Double-click Security Zones: Do not allow users to add/delete sites, and then select Not configured.
8. Click Apply, and then click OK to close the window.
9. (For Windows Vista only) Double-click Security Zones: Use only machine settings, and then select disabled.
10. Close the Group Policy window.
11. (For Windows Vista only) Restart Vista. 
12. Start Internet Explorer. Select Tools > Internet Options.
13. On the Security tab, select Local Intranet or Trusted sites, and then click the Sites button to open the Trusted sites window.
14. Add the address of the web client to the list. Click OK two times to close the Internet Options window.
15. Refresh the web client login page. Log in to Service Manager again by using the web client.

Solution 2: Allow Java Applets to run in Internet Zone

Follow these steps to allow Java Applets to run in Internet Zone:

1. Log on to the computer as a local administrator.
2. Open the Windows command prompt.

3. Type the following command and press Enter to open the Group Policy window:

   gpedit.msc

4. Double-click Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone.
5. Double-click Java Permissions. In the window that opens, select Enabled.
6. Select High safety in the Java permissions drop-down list.
7. Click Apply, and then click OK to close the window.
8. Close the Group Policy window.
9. (Optional) For domain computers, run the gpupdate /force command or wait for 10 minutes.
10. Restart Internet Explorer.

Troubleshooting: web client fails to automatically log in to Service Manager

Trusted sign-on (TSO) uses the current user's domain login name and password to log on. In the Internet Explorer security setting, only the Local intranet and Trusted sites security zones allow automatic logon.

However, the Service Manager web server is probably not identified as a local intranet or trusted site.

Refer to Solution 1 in "Troubleshooting: workflow diagrams are not displayed in the web client" to solve this issue.

Troubleshooting: unable to view an attachment from the web client

Why can I not open an attachment in a record (for example, an incident record) from the web client?

The getAbsolutePath() function in Attachment.java returns the full paths of attachments. The web tier supports long full paths (greater than 255 characters) for attachments when running on Linux, Unix, or Windows with an NTFS file system (not a FAT file system).

If the web tier is running on Windows with a FAT file system, and if the attachment file full path is greater than 255 characters, you cannot open the attachment. This issue is most likely to occur on WebSphere systems where the deployment path to the temp directory is prefixed by various WebSphere node name and server names, and attachment file full paths are dependent on the length of WAR file name and the installation path of the web application server.

The following is an example of a full path to an attachment that is greater than 255 characters, where the "x" string represents the unique directory created for each user session that handles attachment files:

/app/IBM/WebSphere7/AppServer/profiles/AppSrv01/temp/qasolaris01Node01/server1/PROD_webtier-7_02_013_P3_ear_SSO_HELP_SRVRPROD_webtier-7_02_013_P3_ear_SSO_HELP_SRVR_war/PROD_webtier-7_02_013_P3_ear_SSO_HELP_SRVRPROD_webtier-7_02_013_P3_ear_SSO_HELP_SRVR.war/attachments/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/sm_attachment.txt

Troubleshooting: No trusted certificate found in the Windows client

Users running the Windows client from a redeployed installer may experience the following error.

Error message	Cause and solution	Affected application or component
Error Connecting to server, server not up or wrong connection parameters: https://<hostname>:<port> Cause: javax.xml.soap.SOAPException: Message send failed – sun.security.validator.ValidatorException: No trusted certificate found	Cause: The path to the CA certificates file on the local Windows client installation is different from the path that the Client Packaging Utility originally saved. This is usually the result of the local user saving the Windows client to a different path than the Windows client used by the Client Configuration Utility. Solution: Change the path to the CA Certificate file. Log on to the machine running the Windows client using a local administrator account. Start the Windows Client. The Windows client displays the "No trusted certificate found" error message. Click OK. Close the Connections window. Click Window > Preferences > Service Manager > Security. In the CA Certificates File field, type or select the path to the CA certificates file.	Windows client

Troubleshooting: Service Request Catalog (SRC)

If you are a system administrator, read this section to discover how to troubleshoot some common problems that you might encounter when you use Service Request Catalog.

Use Luke to examine Apache Lucene indexes

Lucene is an open source Java search engine that Service Request Catalog uses to create indexes from downloaded catalog data. Luke is a diagnostic tool that enables you to view or modify the Lucene indexes in the catalog. For more information, see the Luke project site at http://code.google.com/p/luke/.

To use Luke, follow these steps.

1. Stop the Tomcat service.
2. Download the latest version of Luke from http://code.google.com/p/luke/. For example, the downloaded file for version 3. is lukeall-3..0.jar.
3. Double-click the downloaded .jar file to run Luke. The Luke Toolbox appears.
4. In the Path Index directory dialog, browse to the Service Request Catalog installation directory\secure\luceneIndexedData. For example, if you deploy the Service Request Catalog application in a folder named C:\src, the path index would be C:\src\secure\luceneIndexedData
5. Click OK.
6. When Luke displays the folder structure within luceneIndexedData. Each folder represents a complete index. Open a folder to view the indexed contents. Do not open individual files. For example, open the index folder en_US to view the indexed information in the US English catalog.
7. You can view catalog items and fields within an index. You can also search for a specific item. Use this tool to troubleshoot catalog download problems.

You can view catalog items and fields within an index. You can also search for a specific item. Use this tool to troubleshoot catalog download problems.

Use Charles to monitor internet activity

Charles enables you to monitor Internet requests and responses, including the internet traffic between Service Request Catalog and Service Manager. Use Charles to troubleshoot communication issues. For more information, see the Charles project site at www.charlesproxy.com.

To use Charles, follow these steps.

1. Make sure that you comply with the system requirements described on the download site (http://www.charlesproxy.com/download/).
2. Download the latest version of Charles. For example, the downloaded file for version 3.5 is charles_setup.exe.
3. Double-click the downloaded .exe file to install Charles.
4. Click Run to start the installation.
5. Follow the installation prompts and click Finish when the installation is complete.
6. Start Charles.
7. Start the browser that you want to use. Firefox requires you to install an add-on before you can use Charles successfully.

Charles functions as a play/record mechanism to track and troubleshoot internet activity.

Use logs to monitor Service Request Catalog/Service Manager Communication

You can set the log4j properties to provide more log information. To do so, follow these steps:

1. Navigate to this location

   src-9.61\WEB-INF\classes

2. Open log4j.properties with a text editor. Log4j parameters typically have these settings.
   • INFO provides a minimal amount of operational information
   • DEBUG provides detailed operational information
   • TRACE captures all activities.

3. Locate this property and change the logging level to increase (or decrease) the amount of log information captured during communication between Service Request Catalog and Service Manager.

   log4j.rootLogger=TRACE, stdout, rolling

You can also change the log level for packages to increase or decrease the log size. For more information about additional settings, see the documentation for the Apache Software Foundation log4j logging utility.

Run the svcCatalogMix script

If you have upgraded from a previous version of Service Manager or if you import some catalog items from a .unl file in Service Manager, the svcCatalogMix script must be run in Service Manager before you start SRC.  

This script updates the Service Catalog records in older versions of Service Manager as one of the following types:

• Category: The record contains only child categories or only bundles/items.
• Item: The record is a bundle/item only.
• Mix: The record contains both child categories and bundles/items.

To execute the script, follow these steps:

1. In the Service Manager client, type "SL" in command line in SM and then press the ENTER key to open ScriptLibrary editor.
2. Enter "svcCatalogMix" into the Name field and then click Search.
3. Select svcCatalogMix from the list and then click Execute button to run this script.

Common issues

Insufficient memory

Not enough memory to load the catalog.

1. If you see one of these messages:

   java.lang.OutOfMemoryError: PermGen space at java.lang.Throwable.getStackTraceElement(Native Method)

   java.lang.OutOfMemoryError

2. Verify that you completed the steps to configure Java Options (see Install Service Request Catalog (SRC)). These steps include increasing the amount of available memory for Tomcat.

Corrupt indexes

Follow these steps to fix index problems:

1. Stop the Tomcat service.
2. Navigate to the Service Request Catalog installation directory\secure\luceneIndexedData folder. For example, if you deploy the Service Request Catalog application in a folder named C:\src, the path index would be C:\src\secure\luceneIndexedData
3. Delete the contents of the luceneIndexedData folder.
4. Navigate to the C:\src\secure\attachments directory

5. Delete files that begin with "version" as shown in the following example:

   C:\src\secure\attachments\version*.*

6. Re-start the Tomcat service.

Service Manager connections

Connection errors occur when the Service Manager server is unavailable or your connection information is invalid

I/O error: Connection refused: connect; nested exception

Unable to authenticate and therefore load the catalog

If you receive one of these messages, follow these steps to resolve:

1. Make sure the Service Manager server is running and you can access the Service Manager server wsdl from the browser by typing:

   http://fqdn:portnumber/SM/7/ServiceCatalogAPI.wsdl

   For example: http://myserver:13088/SM/7/ServiceCatalogAPI.wsdl

2. Verify the Service Manager server connection information is correct in the applicationContext.properties file. You can locate this file in the Service Request Catalog installation directory. For example:

   C:\src\WEB-INF\classes\applicationContext.properties

3. Verify these properties are accurate:

   serviceManager.hostname=<IP or hostname>

   serviceManager.port=<PortNumber>

   serviceManager.adminCredentials=LIST (username, ENC(EncryptedPassword))

Service Managersessions

If a user logs into Service Request Catalog and then logs out, the session may still appear to be active on the Service Manager server. This may happen if there is a Load Balancer managing traffic between the Service Request Catalog and Service Manager nodes. In this case the Load Balancer is not able to maintain session stickiness between the Service Request Catalog and Service Manager nodes.

The solution is to configure the Load Balancer for session stickiness using the http cookie value JSESSIONID and assign it to the Service Manager node.

Troubleshooting tips

Best practices

• The minimum resolution for SRC is 1024 x 768 pixels.
• Do not edit the applicationContext.properties file while Tomcat is still running.
• Do not attach a file more than 30MB to prevent the failure of a request submission.

• Do not set the max logins value in a user's operator record in Service Manager below the default value of 2.

  Note When you close the browser tab or browser window without logging out SRC, the current session is terminated in 15 to 30 seconds instead of being terminated immediately. When you log in to SRC again during this period, the following error message may occur:

  <Message: Login failed. Maximum active logins for this user exceeded.>
  

  To prevent this from happening, you can set the value of max logins to 3 or a bigger number.

• If the hostname format of SRC is different from the hostname format of Service Manager, or the Service Manager server disables the query harsh feature, you may fail to open SRC links which are generated by the Service Manager server. To prevent this from happening, you can disable the src.enableQueryHash parameter in applicationcontext.properties.

Login problems

• Verify the Service Manager server is running.
• Verify the user you created has the SOAP API and other required capability words configured in Service Manager.

Troubleshooting: Service Management Service Portal is not trusted by Internet Explorer

If a CA is not trusted by Internet Explorer, the user may see a blank page while trying to log on.

In order for a CA to be trusted by Internet Explorer, follow these steps:

1. Obtain the /opt/hp/propel/security/CA.crt file from the Service Portal server.

2. In Internet Explorer, open Internet Options.

3. On the Content tab, click Certificates in the Certificates section.

4. On the Trust Root Certification Authorities tab, click Import.

5. Follow the instructions in the wizard to import the CA.crt you obtained in step 1.

6. Save and restart Internet Explorer.