Webagent initialization errors

[mallireddygangadhar]

Hi,

 

When starting Apache web server, The  web agent is not initializing  ..The info. from the logs 

 

[08/Sep/2017:14:22:59] [Info] [CA WebAgent LLAWP] [85201] [LLAWP Monitor: LLAWP has been started.]
[Fri Sep 08 14:23:04.659220 2017] [sm:warn] [pid 85196:tid 139814556088256] #Siteminder Web Agent: restart not supported.
[Fri Sep 08 14:23:04.660558 2017] [mpm_worker:notice] [pid 85196:tid 139814556088256] AH00292: Apache/2.4.16 (Linux/SUSE) configured -- resuming normal operations

[08/Sep/2017:14:23:04] [Error] SiteMinder Agent

Sm_AgentApi_Init Failed.

ff ff ff ff
[08/Sep/2017:14:23:04] [Error] SiteMinder Agent
Failed to initialize the configuration manager.
LLAWP unable to get configuration, exiting.#

 

I have added the Policy server HOSTNAME in smreghost.conf and policy server I.P in /etc/hosts file of Apache webserver as mentioned in below link . But that didn't resolve the issue

 

https://communities.ca.com/thread/241783283-apache-web-agent-on-linux-vm-from-aws-fails-to-intialize-on-startup

 

Already tested below check points

The F.W between web and policy server is OPEN,

The objects in Siteminder and webserver are correct

Added the Policy server HOSTNAME instead of I.P in smreghost.conf , And policy server I.P in /etc/hosts file of Apache web server

 

 

[Chris_Stallone]

Hi,

 

I am moving your question into the CA Security community to get it answered faster.

 

-Chris

[TOM MATHEW]

Hi ,

 

Can you  crosscheck  the policy server details in HCO settings.

 

Thanks

Tom

[Ujwol]

Hi,

Can you please refer to this blog and let me know if that helps:

https://communities.ca.com/community/ca-security/ca-single-sign-on/blog/2017/09/06/tech-tip-ca-single-sign-on-web-agent-how-to-troubleshoot-agent-initialization-issues

[Uzi Cohen]

updated link: https://community.broadcom.com/enterprisesoftware/blogs/ujwol/2019/05/30/tech-tip-ca-single-sign-on-web-agent-how-to-troubleshoot-agent-initialization-issues

[Ujwol]

Looking at the error it looks to me , agent is unable to read HCO from Policy server.

Can you please check? It's case sensitive.

ff ff ff ff     unable to get the HostConfigurationObject from any Policy Server   

[mallireddygangadhar]

Hi Ujwol, We have verified the settings..The HCO and ACO are the same at Siteminder and webserver. No case sensitive found... But i see we are unable to do a nslookup with policy server I.P from the Webserver, We are trying to fix it

[Ujwol]

Nice. That is covered in the following basic troubleshooting points in my blog:

• Ensure that the policy server FQDN/IP is specified in SmHost.conf file. Also ensure that you can ping and resolve the DNS for the specified policy server from the web server host.
• Ensure that a valid Policy server FQDN/IP is specified in Host configuration object in the policy store. Also ensure that you can ping and resolve the DNS for the specified policy server from the web server host.

Keeps us posted on how you go.

[mallireddygangadhar]

Hi Ujwol,

 

The DNS issue is resolved now, But the issue still persists...

[Patrick Dussault]

Hi,

 

You can try to add AgentWaitTime set to 40 to the WebAgent.conf if you have only 1 Policy Server. That help to make the Web Agent connecting to the Policy Server. Check also that there's no firewall blocking connection on the Web Agent and Policy Server machines.

 

Best Regards,

Patrick

[mallireddygangadhar]

Hi ,

 

The F.W is open, And i tried adding AgentWaitTime to 40 and restarted the apache . But the error still occurs...

[Ujwol]

Did you fix nslookup? telnet works?

[mallireddygangadhar]

yes, the DNS issue is fixed and the F.W is open. We have re-registered the smreghost once again after fixing the DNS issue

[Ujwol]

If you haven't can you please verify all the points mentioned here:

https://communities.ca.com/community/ca-security/ca-single-sign-on/blog/2017/09/06/tech-tip-ca-single-sign-on-web-agent-how-to-troubleshoot-agent-initialization-issues

[emmle02]

Hi , 

 

Verify SELinux has been disabled.

 

Access the /etc/selinux/config file.

Run the following command to check the current status:

 

sestatus

 

If SELinux is set to enforcing, change the status to either permissive or disabled.

 

Regards,

Leo Joseph

[mallireddygangadhar]

Hi,

 

sestatus is disabled....  We are using Suse Linux 12 SP1 (x86_64)

[Ujwol]

Hi Gangadhar, 

If you still couldn't get this fixed, please open a support ticket.

I am pretty sure this is something easy one. It just need some deeper look at your logs/configs.

Regards,

Ujwol

[mallireddygangadhar]

Hi Ujwol,

 

the issue still there, i don't get much info from logs other than what i updated  in this post

 

Regards

Gangadhar M