Implementation Guide › Diagnose Implementation Issues

Diagnose Implementation Issues

Diagnose Issues Introduced

The problems you can encounter during a CA SiteMinder® implementation vary and are unique to each environment. Problems can be related to the deployment of individual components to the overall performance of the environment.

The following sections detail:

• How to diagnose common implementation issues
• How to work with Support to resolve issues efficiently
• Where to locate additional CA SiteMinder® documentation to help troubleshoot issues
• Some tools that you can use to measure CA SiteMinder® performance

Policy Server/Policy Store Connection Issues

Various problems are associated with connecting a Policy Server with a properly configured policy store. These problems can range from an incorrectly configured policy store to network and database connections.

Use the following flowchart to diagnose problems:

Consider the following:

• Using a packet sniffer on the Policy Server host system lets you record error messages that the policy store sends to the Policy Server. If a connection request contains an error message stating that the connection was refused, the database or directory server functioning as the policy store is preventing the connection.
• Reviewing the Policy Server logs lets you identify information about the connections the Policy Server is attempting to make. Common reasons the connections fail include:
  • The Policy Server is using invalid administrator credentials to access the policy store.
  • The administrator account that the Policy Server is using does not have read access.

  Note: Policy Server logs are located in siteminder_home/log.

  siteminder_home

  Specifies the Policy Server installation location.

Work with Support

If you require assistance from the CA SiteMinder® Support team, there is specific information you can gather and include when opening a Support ticket. Including as much information as possible helps to reduce the amount of time it takes the Support team to resolve the issue.

Environment Information

Gather as much of the following information as possible and include it when you open a Support ticket:

• The operating system on which the Policy Server is installed, including service pack level.

  Example: Windows 2008 SP2

• The web server on which the CA SiteMinder® Agent is installed.

  Example: Windows 2008 SP2, IIS 7.0

• The version, including the service pack and the cumulative release (CR), of the Policy Server.

  Example: r12.0 SP2 CR1

• The version, including the service pack and the CR, of the CA SiteMinder® Agents communicating with the Policy Server.

  Example: r12.0 SP2 CR1

• The policy store type (LDAP/ODBC) and the specific vendor and version.

  Example: Oracle 10g R2

• The specific vendor and version of other CA SiteMinder® data stores.
• If applicable, any other CA products, or third–party products integrated with CA SiteMinder®.
• Any custom code or third–party authentication schemes that are deployed in the environment. Custom code includes code provided by Global Solutions Engineering (GSE) or code developed by your organization.
• Any changes that were recently made to the environment, such as an upgraded CA SiteMinder® component or new hardware.
• When the problem started.

Note: You can use the CA SiteMinder® Platform Support Matrix to verify that the issue is not related to an operating system or third–party product that CA SiteMinder® does not support. For more information, see the CA SiteMinder® Platform Support Matrix.

More information:

Locate the Platform Support Matrix

Log Files

Depending on the problem you are experiencing, Support may request one or more of the following log files:

Consider the following:

• All Policy Server logs are located in ps_home\log.

  ps_home

  Specifies the Policy Server installation path.

  Note: For more information about configuring the Policy Server profiler, see the Policy Server Administration Guide. For more information about auditing, see the Policy Server Administration Guide.

• Web and WSS Agent logs have no default location or default names.

  Note: For more information about configuring Web Agent logging, see the Web Agent Configuration Guide. For more information about configuring WSS Agent logging, see the appropriate WSS Agent Guide.

Policy Server Crash

If the Policy Server has crashed, the following lists the information that helps Support probe for additional details. This information is not required to open a Support ticket, but is information that Support is likely to request. If you provide this information initially, it can reduce the amount of time it takes Support to resolve the issue.

1. Provide environment information.
2. Describe the problem in as much detail as possible. For example:
   • How often the process is crashing.
   • The number of times the crash has occurred.
   • A description of what was happening on the server when it crashed.
   • The steps to reproduce the crash.
3. Attach the UNIX core file or Windows dump file. If you are attaching these files, consider the following:
   • (UNIX) If possible, provide a packaged core.
   • (Windows) Be sure that this file is a full dump file and not mini dumps produced by a program error debugging tool.
4. Attach the policy store data.
5. Attach the Policy Server log and the Policy Server audit log.
6. Modify the Policy Server trace log output.
7. Attach the Policy Server profiler log.

   Note: If you are attaching log files, be sure that the set of files matches. Also ensure that all the files are from the same time as when the issue occurred.

More information:

Environment Information

Log Files

Attach the Policy Store Data

Support is better able to identify the problem by examining the policy store data. Export the policy store and attach the CA SiteMinder® data information file (smdif) to the ticket.

Note: For more information about exporting the policy store, see the Policy Server Administration Guide.

Modify the Policy Server Trace Log

Support is better able to identify the problem by examining the Policy Server trace log. If the Policy Server is crashing, you can use the Policy Server profiler to capture the problem.

Note: If the Policy Server is hung, it may not be possible to capture the problem. Instead of using the Policy Server profiler, force a core dump.

The Policy Server profiler uses a default configuration file to log Policy Server actions to a trace log. The default settings include information about components and data:

• Components represent logical groups of actions that the Policy Server executes.
• Data represents the actual pieces of data that the Policy Server must trace.

CA SiteMinder® Support uses component and data settings that are not included in the default configuration file to begin the troubleshooting process. Modify the default settings before submitting the Policy Server trace log.

Note: For more information about configuring the Policy Server profiler, see the Policy Server Administration Guide.

Example: Modified Components

Modify the default trace configuration to include the following components:

• Server

  The Server component includes additional subcomponents. After you add the Server component, remove the following subcomponents:

  • Policy_Object
  • Policy_Object_Cache
  • Administration
  • Audit_Logging
• Tunnel_Service
• JavaAPI

Example: Modified Data Types

Modify the default trace configuration to include the following data types.

Important! The order in which the data types are listed determine the order in which the data is logged. Be sure that the data types are listed in the following order.

• Date
• Time
• Precise Time
• Pid
• Tid
• SrcFile
• Function
• AgentName
• TransactionName
• TransactionID
• Resource
• Realm
• Rule
• Domain
• Group
• Policy
• User
• Directory
• AgentType
• ReturnValue
• ErrorString
• ErrorValue
• AuthStatus
• AuthReason
• AuthScheme
• ClusterID
• RequestIPAddr
• Returns
• Result
• Message

Agent Crash

If an agent has crashed, the following lists the information that helps Support probe for more details. This information is not required to open a Support ticket, but is information that Support is likely to request. If you provide this information initially, it can reduce the amount of time it takes Support to resolve the issue.

1. Gather environment information.
2. Describe the problem in as much detail as possible. For example:
   • How often the process is crashing.
   • The number of times the crash has occurred.
   • A description of what was happening on the server when it crashed.
   • The steps to reproduce the crash.
3. Attach the UNIX core file or Windows dump file. If you are attaching these files, consider the following items:
   • (UNIX) If possible, provide a packaged core.
   • (Windows) Be sure that this file is a full dump file and not a mini dump that has been produced by a program error debugging tool.
4. Attach the agent log and the web or application server error log.

   Note: If you are attaching log files, be sure that the set of files matches. Also ensure that all the files are from the same time as when the issue occurred.

5. Attach a tar or zip of the web server binary directory.

   Note: This step does not apply to agents running on an IIS web server.

6. For Web Agents or WSS Agents for Web Servers, attach the Web Agent trace log and the web server access log.

More information:

Environment Information

Log Files

Resource Leaks

If a system resource, such as memory, file handles, network connections, sockets, or disk space, is not being released, the following lists the information that helps Support probe for additional details. This information is not required to open a Support ticket, but is information that Support is likely to request. If you provide this information initially, it can reduce the amount of time it takes Support to resolve the issue.

1. Gather environment information.
2. Describe the problem in as much detail as possible. Include at least the following:
   • The frequency of the resource leak.
   • The size of the resource leak. Measure the resource leak over a time period with a tool that can show the resource allocation, such as prstat.
   • The tool that you used to measure the resource leak.
   • The effect the resource leak has on the system.

     Example: The system crashes or hangs.

   • The steps to reproduce the resource leak or a reproduction test based on the application traffic.
3. Attach logs:
   • (Policy Server) If you are experiencing a Policy Server issue, attach the Policy Server log and the Policy Server audit log.
   • (CA SiteMinder® Agent) If you are experiencing an Agent issue, attach the Agent log and the web server or application server error log.

   Note: If you are attaching log files, be sure that the set of files matches. Also ensure that all the files are from the same time as when the issue occurred.

More information:

Environment Information

Log Files

Functional Issues

A functional issue is defined as an issue where CA SiteMinder® is not performing as detailed by the documentation. If you are experiencing a functional issue, the following lists the information that helps Support probe for additional details. This information is not required to open a Support ticket, but is information that Support is likely to request. If you provide this information initially, it can reduce the amount of time it takes Support to resolve the issue.

1. Gather environment information.
2. Describe the problem in as much detail as possible, including the steps to reproduce the issue.
3. Attach logs:
   • (Policy Server) If you are experiencing a Policy Server issue, attach the Policy Server log and the Policy Server audit log.
   • (CA SiteMinder® Agent) If you are experiencing an Agent issue, attach the Agent log and the corresponding web server or application server error log.

   Note: If you are attaching log files, be sure that the set of files matches. Also ensure that all the files are from the same time as when the issue occurred.

4. Export the policy store to a CA SiteMinder® data information file (smdif) and attach the file.

   Note: For more information about exporting the policy store, see the Policy Server Administration Guide.

5. Attach logs:
   • (Policy Server) If you are experiencing a Policy Server issue, attach the Policy Server profiler log.
   • (CA SiteMinder® Agent) If you are experiencing an Agent issue, attach all Agent logs and the web server or application server access log.

More information:

Environment Information

Log Files

Random Issues

A random issue is defined as an issue that occurs sporadically, and although functional in nature, does not have a pattern that can be reproduced. If you are experiencing a random issue, the following lists the information that helps Support probe for additional details. This information is not required to open a Support ticket, but is information that Support is likely to request. If you provide this information initially, it can reduce the amount of time it takes Support to resolve the issue.

1. Gather environment information.
2. Describe the problem in as much detail as possible. For example:
   • When the issue started.
   • The frequency of the issue.
   • The effect the issue has on the system.

     Example: Transactions are taking more time than usual.

3. Attach logs:
   • (Policy Server) If you are experiencing a Policy Server issue:
     • attach the Policy Server log with the point of failure, the Policy Server audit log with the point of failure, and the Policy Server profiler log with the point of failure.
     • attach the Policy Server profiler log with the system functioning correctly.
   • (CA SiteMinder® Agent) If you are experiencing an Agent issue:
     • attach all Agent logs with the points of failure.
     • attach all Agent log with the system functioning correctly.

   Note: If you are attaching log files, be sure that the set of files matches. Also ensure that all the files are from the same time as when the issue occurred.

More information:

Environment Information

Log Files