In IS, 400 Bad Request while accessing Error and Security logs in Admin page

While accessing Error and security logs, we are getting the below error.
Can someone please assist on this case ?

Http failure response for https://kmv.corp.b2b.com:19110/admin/log/error?pageNumber=0&pageSize=20&
sortColumn=auditTimestamp&descending=true&numLines=65535&startDate=2023-10-09%2003:41:16&endDate=2023-10-09%2004:41:16: 400 Bad Request

Server logs:

[8599863] at com.webMethods.sc.auditing.queue.AuditQueueWorker.run(AuditQueueWorker.java:88) [wm-scg-audit.jar:10.15.0.0001-0343]
[8599862] at com.webMethods.sc.auditing.queue.AuditQueueWorker.processEvent(AuditQueueWorker.java:184) [wm-scg-audit.jar:10.15.0.0001-0343]
[8599861] at com.webMethods.sc.auditing.destination.WmDirectoryDestination.logEvent(WmDirectoryDestination.java:245) ~[wm-scg-audit.jar:10.15.0.0001-0343]
[8599860]2023-10-08 21:59:04 PDT [WmAuditingSC.queue.2406E] (tid=253) [2406] AuditQueueWorker for queue ‘SecurityQueue’ failed to log event to destination ‘AuditFSDest’; reason ‘Destination ‘AuditFSDest’ is not open’; stack trace follows com.webMethods.sc.auditing.API.destination.WmAuditDestinationException: Destination ‘AuditFSDest’ is not open

Thanks

@Holger_von_Thomsen Can you please assist

What is your wM IS version and Core Fix level?
I see that there was an issue and it was fixed on 10.15 a few months ago.

Do you see an error when you click on “Test” the AuditFSDest under Settings → JDBC Pools?

KM

3 Likes

Hi @Venkata_Kasi_Viswanath_Mugada1 ,

Yes its 10.15, In JDBC pools i cant see any function name with AuditFSDest

Thank you

@Venkata_Kasi_Viswanath_Mugada1 , can you please assist on this case ?

Hi,

looks like Audit logging is configured to file system.

Did you check your FileSystem where IS is installed for proper read/write permissions and capacity, please?
There should be a more detailed error message why the destination could not be opened.

Regards,
Holger

1 Like

Hi @Holger_von_Thomsen

We have the proper read / write permissions as well good storage around 200GB is free.
drwxr-xr-x. 14 kmv kmv 233 Oct 9 10:48 wm1015_kmv_com

Whenever i click on the error logs this is the error message we are capturing from the server log

2023-10-12 07:10:17 PDT [WmAuditingSC.queue.2406E] (tid=250) [2406] AuditQueueWorker for queue ‘SecurityQueue’ failed to log event to destination ‘AuditFSDest’; reason ‘Destination ‘AuditFSDest’ is not open’; stack trace follows com.webMethods.sc.auditing.API.destination.WmAuditDestinationException: Destination ‘AuditFSDest’ is not open
at com.webMethods.sc.auditing.destination.WmDirectoryDestination.logEvent(WmDirectoryDestination.java:245) ~[wm-scg-audit.jar:10.15.0.0001-0343]
at com.webMethods.sc.auditing.queue.AuditQueueWorker.processEvent(AuditQueueWorker.java:184) [wm-scg-audit.jar:10.15.0.0001-0343]
at com.webMethods.sc.auditing.queue.AuditQueueWorker.run(AuditQueueWorker.java:88) [wm-scg-audit.jar:10.15.0.0001-0343]

Thanks

Hi Varun,

can you check the error logs then, please?

Eventually you will get a more detailed error message there.

Another place to look at will be the wrapper.log in the profiles directory for the affected IS instance.

Addendum:
When using a database for the IS most of the logging options will be configured to use the database pools assigned to the proper JDBC functions in IS Admin under Settings. Usually, only server.log will be redirected to a log file in this case.

Can you share a screenshot of your JDBC Pools and Logging Destinations pages (both available under Settings in IS Admin)?

Regards,
Holger

Hi @Holger_von_Thomsen ,

  1. I am not able to check the error logs, the actual problem persists here, whenever i click on the error logs or security logs i am getting the below 400 error

Http failure response for https://kmv:19110/admin/log/error?pageNumber=0&pageSize=20&sortColumn=auditTimestamp&descending=true&numLines=65535&startDate=2023-10-13%2013:40:55&endDate=2023-10-13%2014:40:55: 400 Bad Request

From wrapper logs →

INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.183 PDT|X509Authentication.java:328|kmv_is_prod private or public key is not of EC algorithm
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.317 PDT|Alert.java:238|Received alert message (
INFO | jvm 1 | 2023/10/13 07:44:20 | “Alert”: {
INFO | jvm 1 | 2023/10/13 07:44:20 | “level” : “warning”,
INFO | jvm 1 | 2023/10/13 07:44:20 | “description”: “close_notify”
INFO | jvm 1 | 2023/10/13 07:44:20 | }
INFO | jvm 1 | 2023/10/13 07:44:20 | )
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.317 PDT|SSLSocketImpl.java:578|duplex close of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.317 PDT|SSLSocketImpl.java:1736|close the underlying socket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.317 PDT|SSLSocketImpl.java:1755|close the SSL connection (passive)
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.317 PDT|SSLSocketImpl.java:834|close inbound of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|WARNING|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.318 PDT|SSLSocketImpl.java:596|SSLSocket duplex close failed (
INFO | jvm 1 | 2023/10/13 07:44:20 | “throwable” : {
INFO | jvm 1 | 2023/10/13 07:44:20 | java.net.SocketException: Socket is closed
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/java.net.Socket.shutdownInput(Socket.java:1549)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.BaseSSLSocketImpl.shutdownInput(BaseSSLSocketImpl.java:216)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.shutdownInput(SSLSocketImpl.java:849)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.bruteForceCloseInput(SSLSocketImpl.java:799)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.duplexCloseInput(SSLSocketImpl.java:776)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.close(SSLSocketImpl.java:590)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.app.b2b.server.Dispatch.closeSocket(Dispatch.java:228)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.app.b2b.server.Dispatch.run(Dispatch.java:984)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.util.pool.PooledThread.run(PooledThread.java:127)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/java.lang.Thread.run(Thread.java:829)}
INFO | jvm 1 | 2023/10/13 07:44:20 |
INFO | jvm 1 | 2023/10/13 07:44:20 | )
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.616 PDT|X509Authentication.java:328|kmv_is_prod private or public key is not of EC algorithm
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.649 PDT|X509Authentication.java:328|kmv_is_prod private or public key is not of EC algorithm
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.746 PDT|Alert.java:238|Received alert message (
INFO | jvm 1 | 2023/10/13 07:44:20 | “Alert”: {
INFO | jvm 1 | 2023/10/13 07:44:20 | “level” : “warning”,
INFO | jvm 1 | 2023/10/13 07:44:20 | “description”: “close_notify”
INFO | jvm 1 | 2023/10/13 07:44:20 | }
INFO | jvm 1 | 2023/10/13 07:44:20 | )
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.747 PDT|SSLSocketImpl.java:578|duplex close of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.747 PDT|SSLSocketImpl.java:1736|close the underlying socket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.747 PDT|SSLSocketImpl.java:1755|close the SSL connection (passive)
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.747 PDT|SSLSocketImpl.java:834|close inbound of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|WARNING|03 D1 17|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.747 PDT|SSLSocketImpl.java:596|SSLSocket duplex close failed (
INFO | jvm 1 | 2023/10/13 07:44:20 | “throwable” : {
INFO | jvm 1 | 2023/10/13 07:44:20 | java.net.SocketException: Socket is closed
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/java.net.Socket.shutdownInput(Socket.java:1549)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.BaseSSLSocketImpl.shutdownInput(BaseSSLSocketImpl.java:216)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.shutdownInput(SSLSocketImpl.java:849)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.bruteForceCloseInput(SSLSocketImpl.java:799)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.duplexCloseInput(SSLSocketImpl.java:776)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.close(SSLSocketImpl.java:590)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.app.b2b.server.Dispatch.closeSocket(Dispatch.java:228)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.app.b2b.server.Dispatch.run(Dispatch.java:984)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.util.pool.PooledThread.run(PooledThread.java:127)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/java.lang.Thread.run(Thread.java:829)}
INFO | jvm 1 | 2023/10/13 07:44:20 |
INFO | jvm 1 | 2023/10/13 07:44:20 | )
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.781 PDT|Alert.java:238|Received alert message (
INFO | jvm 1 | 2023/10/13 07:44:20 | “Alert”: {
INFO | jvm 1 | 2023/10/13 07:44:20 | “level” : “warning”,
INFO | jvm 1 | 2023/10/13 07:44:20 | “description”: “close_notify”
INFO | jvm 1 | 2023/10/13 07:44:20 | }
INFO | jvm 1 | 2023/10/13 07:44:20 | )
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.781 PDT|SSLSocketImpl.java:578|duplex close of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.781 PDT|SSLSocketImpl.java:1736|close the underlying socket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.781 PDT|SSLSocketImpl.java:1755|close the SSL connection (passive)
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|DEBUG|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.781 PDT|SSLSocketImpl.java:834|close inbound of SSLSocket
INFO | jvm 1 | 2023/10/13 07:44:20 | javax.net.ssl|WARNING|03 D1 15|HTTP Handler 10.110.204.103|2023-10-13 07:44:20.782 PDT|SSLSocketImpl.java:596|SSLSocket duplex close failed (
INFO | jvm 1 | 2023/10/13 07:44:20 | “throwable” : {
INFO | jvm 1 | 2023/10/13 07:44:20 | java.net.SocketException: Socket is closed
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/java.net.Socket.shutdownInput(Socket.java:1549)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.BaseSSLSocketImpl.shutdownInput(BaseSSLSocketImpl.java:216)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.shutdownInput(SSLSocketImpl.java:849)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.bruteForceCloseInput(SSLSocketImpl.java:799)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.duplexCloseInput(SSLSocketImpl.java:776)
INFO | jvm 1 | 2023/10/13 07:44:20 | at java.base/sun.security.ssl.SSLSocketImpl.close(SSLSocketImpl.java:590)
INFO | jvm 1 | 2023/10/13 07:44:20 | at com.wm.app.b2b.server.Dispatch.closeSocket(Dispatch.java:228)

  • JDBC Screenshot Attached

  • Logging configuration attached

UPDATE - I just noticed in your latest reply that you’re using the Embedded Database. Try mapping the “ISCoreAudit” Function to the “Embedded Database Pool” and restart the IS.

I’ve checked a few things and cannot narrow down the cause for “Destination ‘AuditFSDest’ is not open”. You can try the following -
1. Shutdown the IS, take a backup of your DB schema, re-execute the DB scripts via DB Configurator and ensure that you have the right DB components installed, startup the IS
2. Create a support ticket

KM

1 Like

Hi Varun,

as error logger is configured to use a file you should have a WMERROR log file in the same directory as the server log.
Same applies to the security logger with WMSECURITY log file.

Additionally:
As you are already using an Oracle DB for your TN database, you might want to consider to reconfigure your JDBC functions to another schema on the same database equipped with the products “BPM” and “IntergrationServer” from DB Configurator.
You can then reconfigure most of the file based loggers to use the new JDBC Pool then.
Remember to create an extra schema for archiving operations.
See Monitor Users Guide for how to set up this schema correctly.

Most likely this will require a MWS instance with its own schema equipped with DB product “MyWebmethodsServer”, which then should be configured for Central Users function.

Can you check the reason for SSL handshake issue shown in the wrapper.log:

Regards,
Holger

1 Like

hi @Venkata_Kasi_Viswanath_Mugada1 @Holger_von_Thomsen

To be more precise, Actually we have migrated our hosts from lapp300 to new host i.e kmv.
I have created a tar for working directory from lapp300 and placed in new server and generated the IS certs and placed, started the new server.
The same approach we followed for UAT servers, there we didnt faced this issue. But in this environment we are getting 400 Bad Request while accessing Error and Security logs in Admin page.

Error Information:
Could not create a connection to ISCoreAudit JDBC Pool Alias.
Http failure response for https://kmv.corp.com:19110/admin/monitor/service/summary?fromDate=1698802080000&toDate=1698805680000&isAnd=TRUE&customIntervals=20: 400 Bad Request
Http failure response for https://kmv.corp.com:19110/admin/monitor/service?pageNumber=0&pageSize=20&sortColumn=LASTTIME&sortAscending=FALSE&fromDate=1698802080000&toDate=1698805680000&isAnd=TRUE: 400 Bad Request
java.sql.SQLException: Could not create a connection to ISCoreAudit JDBC Pool Alias.

1 Like

Hi Varun,

please check if the old database can be reached from the new server.
If not, prepare a new database and update the jdbc pool config under config/jdbc directory for your IS instance to point to the new database. Restart IS afterwards.

Regards,
Holger

Hi @Holger_von_Thomsen

yes the old database we can connect from the new server.

Regards
K M, Varun

Hi Varun,

are there more informations available in the logs why the jdbc connection cannot be created?

Any chance to check for differences between UAT and this instance?

Regards,
Holger

This needs a closer investigation, Varun - I recommend that you create a support ticket.
This seems something to do with the WmAdmin package, as opposed to your database.

KM

There is an problem with the AuditConfig.xml
In that xml AuditFSDest parameter destination is pointing to our old directory.
After updating the correct details.
Restarted the server, it worked

Thanks for your responses @Venkata_Kasi_Viswanath_Mugada1 @Holger_von_Thomsen