Killing the Process Controller

[Pavansai C]

Hi There,

I just wanted to understand the gateway controller processes, I heard that there were 6 processes running
and have seen 6 processes when ran "ps -ef | grep /bin/java" (is this a right way to check the process controller processes?)

I don't know the exact way to check the same.

ps -ef | grep ssg -> does this shows only gateway or ssg but not process controller?

What is SSPC or Process Controller or a Gateway Controller processes?

and also wanted to know, how gateway reacts if each of the process gets killed (individual process).

How important they are? is that okay to kill that process or somehow it gets killed with-out human intervention?

Please help me with a tech-doc or a clear insight.

sorry I have lot many questions around this :(   Please help :)

ps -ef | grep /bin/java

root 1751 1 0 2019 ? 00:00:00 su fndsrv -c /opt/SecureSpan/JDK/bin/java -Xmx1024M -Dkaraf.history=/opt/SecureSpan/Platform/.history -Djava.endorsed.dirs=/opt/SecureSpan/JDK/jre/lib/endorsed:/opt/SecureSpan/JDK/lib/endorsed:/opt/SecureSpan/Platform/lib/endorsed -Djava.ext.dirs=/opt/SecureSpan/JDK/jre/lib/ext:/opt/SecureSpan/JDK/lib/ext:/opt/SecureSpan/Platform/lib/ext -Dkaraf.instances=/opt/SecureSpan/Platform/instances -Dkaraf.home=/opt/SecureSpan/Platform -Dkaraf.base=/opt/SecureSpan/Platform -Dkaraf.data=/opt/SecureSpan/Platform/data -Dkaraf.etc=/opt/SecureSpan/Platform/etc -Djava.io.tmpdir=/opt/SecureSpan/Platform/data/tmp -Djava.util.logging.config.file=/opt/SecureSpan/Platform/etc/java.util.logging.properties -Dkaraf.startLocalConsole=false -Dkaraf.startRemoteShell=true -classpath /opt/SecureSpan/Platform/lib/karaf-jaas-boot.jar:/opt/SecureSpan/Platform/lib/karaf.jar:/opt/SecureSpan/Platform/lib/karaf-jmx-boot.jar:/opt/SecureSpan/Platform/lib/karaf-org.osgi.core.jar org.apache.karaf.main.Main

fndsrv 1773 1751 0 2019 ? 05:11:51 /opt/SecureSpan/JDK/bin/java -Xmx1024M -Dkaraf.history=/opt/SecureSpan/Platform/.history -Djava.endorsed.dirs=/opt/SecureSpan/JDK/jre/lib/endorsed:/opt/SecureSpan/JDK/lib/endorsed:/opt/SecureSpan/Platform/lib/endorsed -Djava.ext.dirs=/opt/SecureSpan/JDK/jre/lib/ext:/opt/SecureSpan/JDK/lib/ext:/opt/SecureSpan/Platform/lib/ext -Dkaraf.instances=/opt/SecureSpan/Platform/instances -Dkaraf.home=/opt/SecureSpan/Platform -Dkaraf.base=/opt/SecureSpan/Platform -Dkaraf.data=/opt/SecureSpan/Platform/data -Dkaraf.etc=/opt/SecureSpan/Platform/etc -Djava.io.tmpdir=/opt/SecureSpan/Platform/data/tmp -Djava.util.logging.config.file=/opt/SecureSpan/Platform/etc/java.util.logging.properties -Dkaraf.startLocalConsole=false -Dkaraf.startRemoteShell=true -classpath /opt/SecureSpan/Platform/lib/karaf-jaas-boot.jar:/opt/SecureSpan/Platform/lib/karaf.jar:/opt/SecureSpan/Platform/lib/karaf-jmx-boot.jar:/opt/SecureSpan/Platform/lib/karaf-org.osgi.core.jar org.apache.karaf.main.Main

root 22988 1 0 May07 ? 00:00:00 su layer7 -c /opt/SecureSpan/JDK/bin/java -Djava.security.egd=file:/dev/./urandom -jar Controller.jar

layer7 22992 22988 0 May07 ? 00:05:05 /opt/SecureSpan/JDK/bin/java -Djava.security.egd=file:/dev/./urandom -jar Controller.jar

gateway 23035 23032 1 May07 ? 01:01:24 /opt/SecureSpan/JDK/bin/java -Dcom.l7tech.server.home=/opt/SecureSpan/Gateway/node/default -Djava.ext.dirs=/opt/SecureSpan/JDK/jre/lib/ext:/opt/SecureSpan/Gateway/runtime/lib/ext -Dcom.l7tech.server.siteminder.enabled=true -server -Djava.net.preferIPv4Stack=true -Djava.security.policy=/opt/SecureSpan/Gateway/runtime/etc/ssg.policy -Djava.security.egd=file:/dev/./urandom -Dfile.encoding=UTF-8 -Dsun.net.inetaddr.ttl=30 -Djava.awt.headless=true -XX:CompileThreshold=1500 -Dcom.l7tech.server.defaultClusterHostname=bat00658003.iuser.iroot.adidom.com -Djava.util.Arrays.useLegacyMergeSort=true -Dorg.apache.xml.dtm.DTMManager=org.apache.xml.dtm.ref.DTMManagerDefault -Xmx8166966k -Xss256k -XX:+UseParallelOldGC -XX:+UseCompressedOops -Dcom.l7tech.server.transport.reservedPorts=7001,7100 -XX:MaxPermSize=256M -Dcom.l7tech.server.home=/opt/SecureSpan/Gateway/node/default -Dcom.l7tech.server.processControllerPresent=true -Dcom.l7tech.server.processControllerCert=/opt/SecureSpan/Controller/var/run/pc.cer -Dcom.l7tech.server.processControllerIpAddress=127.0.0.1 -Dcom.l7tech.server.processControllerPort=8765 -Djava.util.logging.config.class=com.l7tech.server.log.JdkLogConfig -Dcom.l7tech.server.log.console=true -jar /opt/SecureSpan/Gateway/runtime/Gateway.jar pc run

[Jay MacDonald]

The Process Controller is a daemon responsible for starting and maintaining the run status of the Gateway. It runs as user layer7, which has elevated privileges. When the ssg rc script runs on an appliance (see /etc/init.d/ssg) it actually starts the Process Controller (see /opt/SecureSpan/Controller/bin/processcontroller.sh), which in turn checks for a configured Gateway and, if found, starts it. You see two processes related to it because it is initially the root owned process that makes the call using su to run it as layer7. Once the Gateway is running, the Process Controller confirms that it is running every minute and, if not, it will kill any Gateway processes and restart the Gateway. It also listens at port 8765 for Enterprise Service Manager and Gateway requests to "do things" as the elevated user layer7, such as managing the firewall ports, etc.

The karaf process is for the Foundation Services, which are accessed from the ssgconfig menu under 1) Configure system settings -> 5) Use Restricted Shell. It is a mechanism for managing OS level configurations without accessing root. There are two karaf related processes for the same reason as there are two Process Controler process - the first is the root call that uses su to switch it to fndsrv. To be honest, the Foundation Services have never seen a lot of use that I am aware.

SSPC stands for SecureSpan Process Controller. SecureSpan was the original branding of the Layer 7 product, hence SSG stands for SecureSpan Gateway.

Killing the Process Controller will also kill the Gateway. I don't recommend doing that, nor do I see any reason to do so. As for the karaf processes, I don't see a reason to kill them ether, but I am not aware of any negative effect if one does. That is not to say it will not have a negative effect, only that I am not aware of any, so it is probably best to leave it alone, too.

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------

[Pavansai C]

Thanks Jay Mac!!

That makes sense, but please correct my understanding.

so, normally there are 5 java processes (excluding grep) for Gateway/SSPC when done "ps -ef | grep /bin/java"

2 java processes (root and fndsrv) belong to org.apache.karaf.main.Main and killing these doesn't have any impact on gateway.
+
2 java processes (root and layer7) belong to Controller.jar,  so there will be an impact when this is killed.

+
1 Java process (gateway) belong to /opt/SecureSpan/Gateway/runtime/Gateway.jar pc run is the main process (there will be an impact when killed)

[Jay MacDonald]

In the karaf and Controller.jar cases, the one owned by root is actually for the su command that calls the java process. Killing either the java process or the su process will result in both the su and java processes being killed.

If you kill the Gateway.jar java process then yes, it will definitely have an impact on the Gateway, although if the Process Controller is still running then it will restart Gateway.jar within the next minute as it is supposed to.

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------

[Jackie Wilson]

"Once the Gateway is running, the Process Controller confirms that it is running every minute and, if not, it will kill any Gateway processes and restart the Gateway."

Is the gateway restart time configurable or is one minute hard-coded?  We have a use case where we need to increase that timeout value.

[Jay MacDonald]

As far as I know it is not configurable.

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------