WebLogic Agent on Windows doesn't show "Security Subsystem" metrics

[Manish Parikh]

According to CA doc on "CA APM for Oracle WebLogic Server Guide"...........

 

Security Subsystem

The following metrics are available in the Investigator tree under the WebLogic > Security Subsystem node:

Basic User Form Authentication: Average Response Time (ms)

     Average time to check basic user form authentication.

Authenticate Users: Average Response Time (ms)

     Average time to authenticate a user.

Access Checks: Average Response Time (ms)

     Average time to check for the access.

Get Roles: Average Response Time (ms)

     Average time to get the roles given a resource and subject.

Adjudicate Results: Average Response Time (ms)

     Average time to adjudicate results.

Validate Principal: Average Response Time (ms)

     Average time to validate principal.

Run as Users: Average Response Time (ms)

     Average time for the request on running as a particular user.

 

I see these metrics clearly on the ULinux platform for introscope java agent for OWL, but I don't see it at all on Windows platform. Are these not turned on by default on Windows like they are on Unix platform?

 

[Haruhiko Davis]

If I'm not mistaken, those come from JMX. Can you see them under JMX if you remove your JMX filter?

[Manish Parikh]

hikodavis Hiko_Davis

They are not under JMX. My JMX metrics are enabled and I also did a "search" under the agent and nothing came up.

 

[Haruhiko Davis]

It looks like you have a filter in place.

If you don't want to remove the filter, try using JConsole to see if you can see the data from the security MBean.

[Manish Parikh]

Hiko_Davis

I don't have any filter in place. I install both agents (Linux and Windows) with "Typical" settings. If "Typical" setting does create a filter then how do I remove that? I was under the impression that with "Typical" agent install on Linux, it shows me those metrics, so it would do the same on Windows.

 

Am I wrong to assume that?

[Haruhiko Davis]

The default WLS agent has a filter already enabled, I believe. Just go find the property, remove the filter, and restart.

[Manish Parikh]

Hiko_Davis

It's all enabled, by calling "ppweblogic.pbd" (introscope.autoprobe.directivesFile=weblogic-typical.pbl,hotdeploy,ppweblogic.pbd,PPTuxedoConnectors.pbd)

which has the following properties/switches...........

 

######################################################################################################

##  Security Subsystem

######################################################################################################

# Basic User Form Authentication

TraceOneMethodOfClass: weblogic.servlet.security.internal.SecurityModule checkAccess BlamedMethodTimerHC "WebLogic|Security Subsystem|Basic User Form Authentication:Average Response Time (ms)"

# Authenticate Users

TraceOneMethodOfClass: weblogic.security.service.PrincipalAuthenticator authenticate BlamedMethodTimerHC "WebLogic|Security Subsystem|Authenticate Users:Average Response Time (ms)"

# Access Checks

TraceOneMethodOfClass: weblogic.security.service.AuthorizationManager isAccessAllowed BlamedMethodTimerHC "WebLogic|Security Subsystem|Access Checks:Average Response Time (ms)"

# Get Roles

TraceOneMethodOfClass: weblogic.security.service.RoleManager getRoles BlamedMethodTimerHC "WebLogic|Security Subsystem|Get Roles:Average Response Time (ms)"

# Adjudicate Results

TraceOneMethodIfInherits: weblogic.security.spi.AdjudicatorV2 adjudicate BlamedMethodTimerHC "WebLogic|Security Subsystem|Adjudicate Results:Average Response Time (ms)"

# Validate Principal

TraceOneMethodOfClass: weblogic.security.internal.ServerPrincipalValidatorImpl validate BlamedMethodTimerHC "WebLogic|Security Subsystem|Validate Principal:Average Response Time (ms)"

# Run as Users

TraceOneMethodOfClass: weblogic.security.service.SecurityManager runAs MethodTimerHC "WebLogic|Security Subsystem|Run as Users:Average Response Time (ms)"

[Haruhiko Davis]

Do you have any additional security parameters enabled in WLS that would prevent you from getting this data? J2EE Security?

 

What version of APM are you using?

[Manish Parikh]

No additional security parameters as far as I know w/n WLS that would prevent me from getting this data. But I will reach out to the app owner and find out.

 

APM v10.1

Java Agent for Windows v10.1 (for OWL).

[Manish Parikh]

So, if there is something on the OWL/WLS side that could be preventing the agent to grab these metrics..............and if the OWL/WLS admin is not sure what it could be...............how do we begin to troubleshoot this?

 

I am thinking it's gotta be something w/n the Admin Console for each app server that being instrumented. Just have to know which property or a check box could it be which would then allow the agent to grab these metrics.

 

Perhaps compare the Linux Admin Console properties against the Windows Admin Console properties?

[Haruhiko Davis]

Stop the JVM, clear the logs, put the logs in DEBUG mode, start the JVM.

Look for any issues with ProbeBuilder and other messages to see if it can point you in the right direction. If not, then at least you have logs to post to your CSO ticket.

 

BTW What version of WLS are your running?

[Manish Parikh]

WLS v10.3

[Haruhiko Davis]

Any luck with the logging?

[Manish Parikh]

Shouldn't the logging be a hot property? Do I really need to stop the JVM? I understand I won't have a clean log but I will have a harder time to get the JVM recycled in a timely manner.

[Haruhiko Davis]

You need to be able to see the startup behavior.

[Manish Parikh]

I had forgotten to add "PPTuxedoConnectors.pbd" to the agent profile. But I know that is not related to this issue at all.

 

Upon restarting the JVM, the "Security Subsystem" metric started to report. Not sure if it has anything to do with PPTuxedoConnectors.pbd or not

 

Thanks Hiko_Davis for all your help. Again..........not sure if it was the above PPD that did it or just the restart of the JVM did it. I did not change anything else in the agent profile.

[Haruhiko Davis]

Was the agent clamped?

Were you missing an extension for the PBD?

[Manish Parikh]

not agent clamping......and don't think I was missing an extension for the PBD. The only thing I can think of is from last week initial instrumentation and creating 3 different .profile files........something didn't take and needed a restart of the JVM one more time.....maybe?

 

I know it wasn't the Tuxedo pbd.

[Haruhiko Davis]

Well, if there was an extension installed but the associated PBD wasn't there, it may cause a problem.