Support recommends reboot when deploying a Web Tier update in Authentication Manager 8.5 and later
3 years ago
Originally Published: 2021-09-09
Article Number
000063710
Applies To
RSA Product Set: RSA SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.5.0
Platform: Linux
Platform (Other): null
O/S Version: SUSE Linux 12
Product Name: null
Product Description: null
Issue
After a recent webtier update from AM 8.5 Patch 2, 8.5.0.2.0 to m 8.5 Patch 4, 8.5.0.4.0, which involves following the Web Tier instructions to uninstall then delete all the original AM 8.5 P2 Web Tier directories and install the new AM 8.5 P4 Web Tier with a new Web Tier Package, users of the Web Tier for CTKip were seeing connection problems, with monitoring software reporting a response of "HTTP/1.1 400 Bad Request" (Error 404).

After several hours, the customer rebooted the Web Tier, at which point it started working correctly.  The Web Tier Readme does not say a reboot is required.

The reboot cleared out effective file descriptor limits and set them back to a reasonable level, and that appears to be the difference that prevented the HTTP 404 errors to the Web Tier
Tasks
1. uninstall original Web Tier software and delete all Web Tier directories 
2. generate new web tier package
3. Install new version of Web Tier software using the Web Tier package
4. Reboot the Web Tier.

Step 4 is not in the Web Tier Readme or manuals.  However, Technical Support has been advocating for a reboot to be added to the documentation as it is typically the first fix tried whenever a new Web Tier is not working correctly after update.
Resolution
The reboot is recommended by Technical Support based on experience, but lately an analysis of this 404 problem showed a difference in what the restart of Web Tier services did versus the restart of Web Tier Services as part of a reboot.

* different 
During Restart 
Aug 13, 2021 12:41:25,655 AM CDT> ExecuteThread: '3' for queue:
<System has file descriptor limits of soft: 16,384, hard: 16,384
Aug 13, 2021 12:41:25,655 AM CDT> <Using effective file descriptor limit of: 16,384 open sockets and files.> 

During Reboot
Aug 13, 2021 8:21:16,718 AM CDT> ExecuteThread: '2' for queue:
<Using effective file descriptor limit of: 4,096 open sockets and files.> 
Aug 13, 2021 8:21:16,718 AM CDT> <Using effective file descriptor limit of: 4,096 open sockets and files.> 

We know that under load testing conditions, much more file descriptors are opened which can result in stack issues.  We also know that for years Support has been advocating that our documentation call for a reboot of a Web Tier after it is installed.  The Reboot clears out all the file descriptors and starts with a fresh limit.  This is the difference and this explains what we have seen.
Notes
Restart WT Services only
===AdminServerWrapper.log===
Aug 13, 2021 12:41:24,846 AM CDT> <Network Configuration for Channel "AdminServer"
 Listen Address         :7030 (SSL)
Aug 13, 2021 12:41:24,855 AM CDT> <Network Configuration for Channel "VirtualHostChannel"
 Listen Address         https://:443
 Public Address         https://:443
* different Aug 13, 2021 12:41:25,655 AM CDT> ExecuteThread: '3' for queue:
<System has file descriptor limits of soft: 16,384, hard: 16,384
Aug 13, 2021 12:41:25,655 AM CDT> <Using effective file descriptor limit of: 16,384 open sockets and files.> 
Aug 13, 2021 12:41:25,655 AM CDT> <PosixSocketMuxer was built on Apr 24 2007 16:05:00> 
Aug 13, 2021 12:41:25,717 AM CDT> <Allocating 3 reader threads.> 

   <Native I/O enabled.> 

Reboot including restart WT services
===AdminServerWrapper.log===

Aug 13, 2021 8:21:15,606 AM CDT> <Network Configuration for Channel "AdminServer"
 Listen Address         :7030 (SSL)
Aug 13, 2021 8:21:15,610 AM CDT> <Network Configuration for Channel "VirtualHostChannel"
 Listen Address         https://:443
 Public Address         https://:443
* different Aug 13, 2021 8:21:16,718 AM CDT> ExecuteThread: '2' for queue:
 <Using effective file descriptor limit of: 4,096 open sockets and files.> 
Aug 13, 2021 8:21:16,718 AM CDT> <Using effective file descriptor limit of: 4,096 open sockets and files.> 
Aug 13, 2021 8:21:16,719 AM CDT> <PosixSocketMuxer was built on Apr 24 2007 16:05:00> 
Aug 13, 2021 8:21:16,797 AM CDT> <Allocating 3 reader threads.>

 <Native I/O enabled.>
 

Related Articles

Trending Articles

Don't see what you're looking for?