Thursday, October 10, 2013

SSL and index crawl errors in log.



Index Errors


CLFRW0962E CLFRW0847E CLFRW0303E CLFRW0283E

[18/09/13 10:31:00:332 CEST] 00000092 WorkScheduler E com.ibm.connections.search.index.process.WorkScheduler processFinishedCrawlingWorkItems CLFRW0962E: Certaines entrées pour activities n'ont pas été indexées avec succès.
[18/09/13 10:31:00:348 CEST] 00000338 ServerToServe E com.ibm.connections.httpClient.ServerToServerHttpClient checkResultsForRetry SONATA: Internal Server Error @'https://srvconnect1.alteca.fr/news/seedlist/myserver?Start=0&Action=GetDocuments&Format=xml&Timestamp=AAABQScgwuw%3D&SeedlistId=SeedlistId&useLocalFS=true&Range=500'
[18/09/13 10:31:00:348 CEST] 00000338 SeedlistFetch E com.ibm.connections.search.seedlist.crawler.impl.SeedlistFetcher tryFetchFromURL CLFRW0847E: Réponse à l'erreur (Code d'état HTTP 500) à cette adresse URL de liste de départ https://srvconnect1.alteca.fr/news/seedlist/myserver?Start=0&Action=GetDocuments&Format=xml&Timestamp=AAABQScgwuw%3D&SeedlistId=SeedlistId&useLocalFS=true&Range=500. Vérifiez les adresses URL d'interservice LotusConnections-config.xml ou l'override d'URL de liste de départ search-config.xml. Si les URL sont correctes, vérifiez que le serveur cible est en cours de fonctionnement.
[18/09/13 10:31:00:348 CEST] 00000338 CrawlingWork  E com.ibm.connections.search.index.process.work.CrawlingWork run CLFRW0303E: La recherche a rencontré un problème lors du balayage de status_updates. La liste de départ finale est inaccessible. Le balayage de status_updates n'a pas pu aboutir.
[18/09/13 10:31:00:348 CEST] 00000338 CrawlingWorkL E com.ibm.connections.search.index.process.work.CrawlingWorkListener workCompleted CLFRW0283E: La recherche a rencontré un problème lors du balayage.
[18/09/13 10:31:00:348 CEST] 00000338 CrawlingWorkL I com.ibm.connections.search.index.process.work.CrawlingWorkListener workCompleted CLFRW0294I: La recherche a fini de balayer le composant status_updates.
[18/09/13 10:31:00:348 CEST] 00000339 ServerToServe E com.ibm.connections.httpClient.ServerToServerHttpClient checkResultsForRetry SONATA: Internal Server Error @'https://srvconnect1.alteca.fr/communities/calendar/seedlist/myserver?Start=0&Action=GetDocuments&Format=xml&Timestamp=AAABQScgw0o%3D&SeedlistId=SeedlistId&useLocalFS=true&Range=500'
[18/09/13 10:31:00:348 CEST] 00000339 SeedlistFetch E com.ibm.connections.search.seedlist.crawler.impl.SeedlistFetcher tryFetchFromURL CLFRW0847E: Réponse à l'erreur (Code d'état HTTP 500) à cette adresse URL de liste de départ https://srvconnect1.alteca.fr/communities/calendar/seedlist/myserver?Start=0&Action=GetDocuments&Format=xml&Timestamp=AAABQScgw0o%3D&SeedlistId=SeedlistId&useLocalFS=true&Range=500. Vérifiez les adresses URL d'interservice LotusConnections-config.xml ou l'override d'URL de liste de départ search-config.xml. Si les URL sont correctes, vérifiez que le serveur cible est en cours de fonctionnement.
[18/09/13 10:31:00:348 CEST] 00000339 CrawlingWork  E com.ibm.connections.search.index.process.work.CrawlingWork run CLFRW0303E: La recherche a rencontré un problème lors du balayage de calendar. La liste de départ finale est inaccessible. Le balayage de calendar n'a pas pu aboutir.
[18/09/13 10:31:00:348 CEST] 00000339 CrawlingWorkL E com.ibm.connections.search.index.process.work.CrawlingWorkListener workCompleted CLFRW0283E: La recherche a rencontré un problème lors du balayage.
[18/09/13 10:31:00:348 CEST] 00000339 CrawlingWorkL I com.ibm.connections.search.index.process.work.CrawlingWorkListener workCompleted CLFRW0294I: La recherche a fini de balayer le composant calendar.
[18/09/13 10:31:00:348 CEST] 00000092 WorkScheduler E com.ibm.connections.search.index.process.WorkScheduler processFinishedCrawlingWorkItems CLFRW0962E: Certaines entrées pour status_updates n'ont pas été indexées avec succès.
[18/09/13 10:31:00:348 CEST] 00000092 WorkScheduler E com.ibm.connections.search.index.process.WorkScheduler processFinishedCrawlingWorkItems CLFRW0962E: Certaines entrées pour calendar n'ont pas été indexées avec succès.
[18/09/13 10:31:00:348 CEST] 00000092 IndexCreation



Index For FNCS


SEARCH_INDEX_DIR is at C:\IBM\Connections\data\local\search\index. I deleted and recreated the index. Now the number of error diminished. All the reminder error is related to FNCS, it seems. As I have not configured FNCS yet, this might be ok. Most of my indexing seem to work fine now.

This error CLFRW0394E : This is a general error message logged when there is a problem creating a local Search index.
IndexCreation E com.ibm.connections.search.admin.lucene.IndexCreationWorkListener workCompleted CLFRW0394E: L'indexation de recherche des services [profiles, dogear, communities, activities, blogs, forums, wikis, ecm_files, files, status_updates, calendar, ] dans le répertoire C:\IBM\Connections\data\local\search\index a échoué. Vous devez examiner les journaux pour détermine le motif de l'incident et corriger ce dernier.
CLFRW0303E: La recherche a rencontré un problème lors du balayage de ecm_files.



SSL Error

[20/09/13 09:55:23:453 CEST] 00000091 SSLHandshakeE E   SSLC0008E: Impossible d'initialiser une connexion SSL.  L'accès a été refusé ou les paramètres de sécurité ont expiré.  L'exception est javax.net.ssl.SSLException: Received fatal alert: bad_certificate
at com.ibm.jsse2.o.a(o.java:12)
at com.ibm.jsse2.SSLEngineImpl.a(SSLEngineImpl.java:9)
at com.ibm.jsse2.SSLEngineImpl.a(SSLEngineImpl.java:464)
at com.ibm.jsse2.SSLEngineImpl.j(SSLEngineImpl.java:269)
at com.ibm.jsse2.SSLEngineImpl.b(SSLEngineImpl.java:71)
at com.ibm.jsse2.SSLEngineImpl.a(SSLEngineImpl.java:49)
at com.ibm.jsse2.SSLEngineImpl.unwrap(SSLEngineImpl.java:104)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:14)
at com.ibm.ws.ssl.channel.impl.SSLUtils.handleHandshake(SSLUtils.java:1016)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.readyInbound(SSLConnectionLink.java:566)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.ready(SSLConnectionLink.java:295)
at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.sendToDiscriminators(NewConnectionInitialReadCallback.java:214)
at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.complete(NewConnectionInitialReadCallback.java:113)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:165)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1690)

http://wiing.fr/websphere-application-server-ssl-error/

This did not help as my certificates were up to date.

I noticed that CMSKeyStore was not created under "Key Store and Certificates"

This is linked to my plugin-key.kdb missing

So I used this procedure which actually helped me a lot. Basically I just created it by hand.


HTTP Plugin Log


Some related errors in C:\IBM\WebSphere\Plugins\logs\webserver1\http_plugin.log

[Fri Sep 20 18:02:20 2013] 00001740 000013d8 - ERROR: ws_common: websphereHandleRequest: Failed to handle request
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414) PARTNER CERTIFICATE DN=CN=SRVCONNECT1.alteca.fr,OU=SRVCONNECT1Cell01,OU=SRVCONNECT1CellManager01,O=IBM,C=US, Serial=00:fb:da:62:24:40:a4
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereGetStream: Could not open stream
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414) PARTNER CERTIFICATE DN=CN=SRVCONNECT1.alteca.fr,OU=SRVCONNECT1Cell01,OU=SRVCONNECT1CellManager01,O=IBM,C=US, Serial=00:fb:da:62:24:40:a4
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereGetStream: Could not open stream
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereExecute: Failed to create the stream
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereHandleRequest: Failed to execute the transaction to 'SRVCONNECT1Node01_connections_server'on host 'SRVCONNECT1.alteca.fr'; will try another one
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereWriteRequestReadResponse: Failed to find an app server to handle this request
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ESI: getResponse: failed to get response: rc = 2
[Fri Sep 20 18:02:22 2013] 00001740 00001e24 - ERROR: ws_common: websphereHandleRequest: Failed to handle request

I have another environment of Connections 4.5 which is working correctly. Let's compare the certificates Trust and Key Stores. Into menu Security\SSL certificates and Key management\Manage endpoint security configuration :


Local Topology with inbound and outbound configuration. I'm interested in Node 01
I have 1 differences between the 2 environments : Inbound - CellDefaultTrustStore - signer certificate

For reference, here is the different certificates for my working connections Node :
CellDefaultKeyStore, signer certificates : none
CellDefaultKeyStore, personal certificates : default
CellDefaultTrustStore, signer certificates : root, websphere_ssl
CellDefaultTrustStore, personal certificates : none
NodeDefaultKeyStore, signer certificates : none
NodeDefaultKeyStore, personal certificates : default
NodeDefaultTrustStore, signer certificates : root
NodeDefaultTrustStore, personal certificates : none


Security.xml is in C:\IBM\WebSphere\AppServer\profiles\Dmgr01\config\cells\SRVCONNECT1Cell01 and similarly in the AppSrv.

Webserver Definition

I finally found the the werver had not been defined into IHS Node but into Srvconnect1Node01. I recreated it and my CMS keystore.

Conclusion

No more information on this particular case. I learned a lot about Websphere Trust Store but in order to clear all my malipulations I desintalled and resintalled Websphere.


No comments:

Post a Comment