Symantec Access Management

 View Only
Expand all | Collapse all

CA Access Gateway Apache Service Not Starting After 12.8.03 Patch

  • 1.  CA Access Gateway Apache Service Not Starting After 12.8.03 Patch

    Posted Apr 27, 2020 01:20 PM
    Hello,

    Me and my team are having issues starting the Tomcat Apache service one of our Access Gateways. We have 2 Access Gateways for high availability. Server 1 after patching worked fine and was able to run the service but Server 2 is not.

    Our Access Gateway was upgraded from version 12.8 to 12.8.03. We downloaded the AdoptOpenJDK version 8 - OpenJ9 from their website located at https://adoptopenjdk.net for Red Hat Linux (.tar file). Since SP 03 supports AdoptOpenJDK and our client wants to migrate from Oracle JDK version 8 (jdk1.8.0_221).

    We tared/unzipped the OpenJDK file and have the AdoptOpenJDK directory (jdk8u252-b09) located in our directory structure /opt/apps.

    - With the 12.8.03 installer, we were able to run the installer correctly. It prompted the notification of a new upgrade to SP03, we proceeded, selected 'View existing instances', selected the instance 'default'.

    - When prompting for valid JVM/Java path - we inputted the AdoptOpenJDK directory as {DIR}/jdk8u252-b09/bin/java (since for Oracle JDK - we previous inputted {DIR}/jdk1.8.0_221/bin/java and that worked fine, so we wanted to mirror the path structure).

    - Upon entering the AdoptOpenJDK structure and hit [Enter] to proceed, a message below would stated 'Unable to install the Java Virtual Machine with this installer" but still proceeded with the upgrade... then showed the Pre-Installation Summary and started installing.

    - The installer would then try to start the services and it would state failed to start service and we would have to start the services manually then proceeded to close the installer.

    From Server 1, the workflow listed above was the same and after existing the installer, we ran the command "sudo systemctl status sps-ctl" to check if the service was off or on before restarting. Then proceeded to run "sudo systemctl start sps-ctl" and Apache services came up fine.

    However, with Server 2 that is not the case... when we try to run "sudo systemctl start sps-ctl" we get prompted the message: "Job for sps-ctl.service because the control process exited with error code. See 'systemctl status sps-ctl.service' and 'journalctl -xe' for details."

    We ran "sudo systemctl status sps-ctl" and here is what it prompts:

    $ sudo systemctl status sps-ctl

    • sps-ctl.service - CA Access Gateway

       Loaded: loaded (/etc/systemd/system/sps-ctl.service; enabled; vendor preset:                                   disabled)

       Active: activating (auto-restart) (Result: exit-code) since Sun 2020-04-26 13                                  :32:59 PDT; 7s ago

      Process: 423 ExecStart=/bin/bash /opt/apps/CA/secure-proxy/proxy-engine/sps-ct                                  l start (code=exited, status=1/FAILURE)

     

    Apr 26 13:32:59 spsintstg02 systemd[1]: Failed to start CA Access Gateway.

    Apr 26 13:32:59 spsintstg02 systemd[1]: Unit sps-ctl.service entered failed ....

    Apr 26 13:32:59 spsintstg02 systemd[1]: sps-ctl.service failed.

    Hint: Some lines were ellipsized, use -l to show in full.


    Please let us know of any methods to troubleshoot to try and resolve this issue as soon as possible. Thank you!


  • 2.  RE: CA Access Gateway Apache Service Not Starting After 12.8.03 Patch
    Best Answer

    Broadcom Employee
    Posted May 01, 2020 11:15 AM
    Hi Tiffany,

    I believe we resolved this issue through the support ticket after we found that your env variable script is missing FIPS mode in it and which caused this issue. 

    Thanks

    ------------------------------
    Santhosh Bura
    Senior Support Engineer 
    Broadcom Inc
    ------------------------------