16 Diagnosing Problems

This chapter contains the following sections:

Diagnosing Problems with Oracle WSM Policy Manager

The Oracle WSM Policy Manager manages all Oracle WSM policies and needs to be running to use the Oracle WSM policy framework. You can check the current state of the Policy Manager and review its response time, load, and other data from the Oracle WSM Policy Manager page, shown in the following figure.

Figure 16-1 Oracle WSM Policy Manager Page

Description of Figure 16-1 follows
Description of "Figure 16-1 Oracle WSM Policy Manager Page"

To view the Oracle WSM Policy Manager page:

  1. In the navigator pane, expand Application Deployments.

  2. Expand Internal Applications.

  3. Click wsm-pm.

    The Oracle WSM Policy Manager home page is displayed.

  4. Perform one or more of the following tasks:

    • Check the current state of the Policy Manager and identify the server to which it is deployed.

    • View the response time and current load.

    • Click the Test Point URL to validate the Policy Manager. Click the Validate Policy Manager link. If operational, a list of the predefined policies is displayed with descriptions.

      Note:

      You can navigate to the Test Point URL by entering the following URL into a browser: http://host:port/wsm-pm/validator.

The following lists the signs that indicate the Oracle WSM Policy Manager is not running. You can restart the wsm-pm application, as described in "Starting and Stopping Applications Using Fusion Middleware Control" in Oracle Fusion Middleware Administrator's Guide.

Diagnosing Problems Using Logs

Oracle Fusion Middleware components, including Web services, generate log files containing messages that record all types of events, including startup and shutdown information, errors, warning messages, access information on HTTP requests, and so on. Each log message includes specific information such as time, component ID, and user to assist you in pinpointing and diagnosing problems that arise.

You can review log messages to diagnose problems with specific components, such as Web services. There are two categories of log files that you can reference to assist in diagnosing problems with Web services:

For more information about logging in Oracle Fusion Middleware, see "Managing Log Files and Diagnostic Data" in Oracle Fusion Middleware Administrator's Guide.

The following sections describe how to use diagnostic and message logs to diagnose problems. A set of sample logs is provided at the end of this section.

Using Diagnostic Logs for Web Services

Diagnostic logs enable you to access diagnostic data about specific feature components in Oracle Fusion Middleware.

The following sections describe how to view and manage diagnostic log files:

Setting the Log Level for Diagnostic Logs

You set the logging level for Web service and Oracle WSM components at the WebLogic Server level, using the Log Configuration page.

In addition, you can override the log levels set at the server level for a specific Web service endpoint from the Web Service Endpoint page. The logging level set at the Web service endpoint level must be "finer grained" than the level set at the WebLogic Server level. Otherwise, the logging level set at the WebLogic Server level will be used.

The following procedures describe how to set the log level for diagnostic logs at the WebLogic Server and Web service endpoint levels. For more information, see "Setting the Level of Information Written to Log Files" in Oracle Fusion Middleware Administrator's Guide.

To set the log level for diagnostics logs at the WebLogic Server level:

  1. Navigate to the WebLogic Server for which you want to configure a logger.

    1. In the navigator pane, expand WebLogic Domain.

    2. Expand the domain.

    3. Select the desired server from the list.

      The WebLogic Server home page is displayed.

  2. From the WebLogic Sever menu, select Logs > Log Configuration.

    The Log Configuration page is displayed.

  3. Select the Log Levels tab.

    The list of loggers is displayed, as shown in Figure 16-4.

    The Log Levels page shows the name of the logger, the current logging level, which you can edit, and the associated log file (for example, olh-handler). For information about configuring the log files, see "Configuring Log Files for a Web Service".

    Figure 16-4 Log Levels Page

    Description of Figure 16-4 follows
    Description of "Figure 16-4 Log Levels Page"

  4. Expand Root Logger.

  5. Expand oracle.

  6. Set the logging level for one or more of the following components:

    • oracle.webservices—Web service components.

    • oracle.wsm—Oracle WSM components.

    You can fine tune the logging level by expanding either of the above components and specifying the logging level at the subcomponent level.

    To change the logging level for a logger, navigate to the logger in the Logger Name column and select the desired logging level from the Oracle Diagnostic Logging Level (Java Level) dropdown menu.

    For example, select TRACE:32 from the dropdown menu associated with the oracle.wsm logger.

    By default, the logging levels are inherited from the parent and set to NOTIFICATION: 1 (INFO) for the Web service and Oracle WSM components and subcomponents.

  7. Click Apply to store the new logging level.

To set the log level for diagnostic logs at the Web service endpoint level:

  1. Navigate to the Web Service Endpoint page, as described in "Viewing the Details for a Web Service Endpoint".

  2. Click the Configuration tab.

  3. Set the Logging Level field to one of the following settings: Severe, Warning, Information, Configuration, Fine, Finer, Finest or NULL.

    Note:

    You can also set the log level at the Web service endpoint using the setWebServiceConfiguration WLST command. Set the loggingLevel property of the itemProperties argument to one of the following settings: SEVERE, WARNING, INFO, CONFIG, FINE, FINER, FINEST, or NULL. For details about using this command, see "Using WLST" in "Configuring the Web Service Endpoint".

Viewing Diagnostic Logs

You can view the diagnostic log files for an ADF and WebCenter Web service endpoint from the Log Messages page.

To view diagnostic logs for a Web service endpoint:

Navigate to the Web Service Endpoint page, as described in "Viewing the Details for a Web Service Endpoint", and in the Quick Links section of the Web Services Endpoint page (top right), click Diagnostic Logs.

Note:

You can view a summary of all faults incurred by the Web services in your application. For more information, see "Monitoring the Performance of Web Services".

The Log Messages page is displayed, as shown in the following figure.

Figure 16-5 Log Messages Page

Description of Figure 16-5 follows
Description of "Figure 16-5 Log Messages Page"

Click on a message in the message area to view more details at the bottom of the page. If desired, you can export a message to a text, XML, or CSV file by selecting the messages on the list and clicking Export Messages to File.

You can control the message content displayed using the following controls:

  • Search—Modify the search criteria. For more information, see "Filtering Diagnostic Logs".

  • View menu—Select the columns to display in the table. Click on a particular column to sort contents up or down.

  • Show menu—Group messages by type or ID, or view them in chronological order.

  • View Related Messages—View messages related to those selected on the list.

  • Broaden Target Scope—Broaden the scope of messages displayed. You can broaden the scope to include all messages for the domain, WebLogic Server, or Farm.

  • Refresh menu—Specify an automatic or manual refresh rate.

To view the contents of a generated log file:

  • Click the log file icon associated with a message to view the contents of that log file.

  • Click Target Log Files... to display the Log Files page and view or download the contents of all generated log files.

For more information, see "Searching and Viewing Log Files" in Oracle Fusion Middleware Administrator's Guide.

Filtering Diagnostic Logs

By default, the Log Messages page displays a summary of diagnostic messages logged over the last hour.

To filter diagnostic logs:

  1. Filter the messages that are displayed by updating the search criteria using the following fields:

    • Date Range—Set the date range to one of the following:

      • Most Recent—Set the amount of time to define the duration.

      • Time Interval—Set the start and end dates to define the interval.

    • Message Types—Select the message types that you want to display.

    • Add Fields—Add other message fields to your search criteria, such as Message ID, Component, and so on.

  2. Click Search once you have set the fields, as desired.

    The messages area is updated with the filtered results.

For more information, see "Searching and Viewing Log Files" in Oracle Fusion Middleware Administrator's Guide.

Logging Oracle WSM Debug Messages

To debug Oracle WSM, pass one of the following properties when starting WebLogic Server, as required. For more information, see "Starting and Stopping Servers" in Managing Server Startup and Shutdown for Oracle WebLogic Server.

Note:

Enabling one or more of these properties may negatively impact performance for very large messages. When enabled, Oracle WSM creates temporary buffers which will result in additiona load on the Java garbage collector.

Table 16-1 Startup Properties for Logging Oracle WSM Debug Messages

Startup Property Description

-Dxml.debug.verify=true

Logs the sequence of bytes produced during a signature verification failure. Verification errors are output to stderr and the diagnostic log file when the log level is set to at least ERROR.

-Dxml.debug.digest=true

Verifies that the sequence of bytes produced during signature generation canonicalization and signature verification match. Verification errors are output to stderr and the diagnostic log file when the log level is set to at least FINE.

-Dxml.debug.decrypt

Logs the sequence of bytes produced following a decrytion failure before XML parsing. Verification errors are output to stderr and the diagnostic log file.

Using Message Logs for Web Services

Message logs enable you to access the contents of the SOAP message requests and responses for ADF and WebCenter Web services and clients. Messages logs are stored in a log file separate from the diagnostic messages, by default.

The following sections describe how to view and manage message log files:

Configuring Message Logs

You configure message logs for a Web service or client in one of the following ways:

  • Attach a policy that contains a logging assertion to the Web service or client.

    There is one predefined logging assertion template: oracle/security_log_template, described in "oracle/security_log_template". This template is configured to log the entire SOAP message for the Web service request and response. By default, all predefined Web service security policies use this logging assertion to capture the entire SOAP message before and after the primary security assertion is executed. By default, the log assertion is not enforced. You must enable it in order for the SOAP message to be logged in message logs, as described in "Enabling or Disabling Assertions Within a Policy". It is recommended that the logging assertion be enabled for debugging and auditing purposes only.

  • Attach the oracle/log_policy policy to the Web service or client. For more information, see "oracle/log_policy".

  • Ceate your own logging policy or assertion template to further refine the elements of the SOAP message that are logged for the Web service request and response.

    For example, you may wish to view only the SOAP body of the request message. To create a new policy, following the procedure described in "Creating Web Service Policies". You may wish to create a copy of the oracle/security_log_template assertion template and configure it for use in the new policy. For more information about creating a new assertion template, see "Creating an Assertion Template".

Viewing Message Logs

You can view the message log files for an ADF and WebCenter Web service endpoint from the Log Messages page.

To view message logs for a Web service endpoint:

Navigate to the Web Service Endpoint page, as described in "Viewing the Details for a Web Service Endpoint", and in the Quick Links section of the Web Services Endpoint page (top right), click Message Logs.

The Log Messages page is displayed, similar to Figure 16-5. For more details about the contents of the Log Messages page, see "Viewing Diagnostic Logs".

Filtering Message Logs

By default, the Log Messages page displays a summary of SOAP messages logged over the last hour. You can filter the messages that are displayed by updating the search criteria. The process is the same as for diagnostic logs; for more information, see "Filtering Diagnostic Logs".

By default, the Component and Module message fields are included as part of the Search criteria for message logs. The Component field is set to the WebLogic Server name; the Module field is set to oracle.wsm.msg.logging, which is the name of the message logging component.

Reviewing Sample Logs

The following sections provide excerpts from sample logs, demonstrating how to diagnose specific problems using the log entries.

Sample Log: Oracle WSM Policy Manager Not Available

The following sample log excerpt indicates that the Oracle WSM Policy Manager is down. To resolve this issue, restart the wsm-pm application, as described in "Starting and Stopping Applications Using Fusion Middleware Control" in Oracle Fusion Middleware Administrator's Guide.

2009-02-16 16:21:28,029 [[ACTIVE] ExecuteThread: '4' for queue:
 'weblogic.kernel.Default (self-tuning)'] 
 ERROR policymgr.PolicyManagerModelBean logp.251 - 
 Service lookup failed with URL:t3://stadk13.us.oracle.com:7001/wsm-pm
 oracle.wsm.policymanager.PolicyManagerException: WSM-02118 : 
 The query service cannot be created.
...

Sample Log: Security Keystore Not Configured

The following sample log excerpt indicates that an Oracle WSM security policy with message protection was applied, but the keystore was not configured. To resolve this security fault, configure the keystore, as described in "Setting up the Keystore for Message Protection".

Feb 16, 2009 5:29:56 PM oracle.wsm.common.logging.WsmMessageLogger logSevere 
 SEVERE: The specified Keystore file /scratch/sbollapa/stage131/user_projects/domains/sai131_domain/config/fmwconfig/default-keystore.jks 
 cannot be found; it either does not exist or its path is not included in the 
 application classpath.
 Feb 16, 2009 5:29:56 PM oracle.wsm.common.logging.WsmMessageLogger logSevere
 SEVERE: Keystore is not properly configured in jps config.
 Feb 16, 2009 5:29:56 PM oracle.wsm.common.logging.WsmLogUtil log
 SEVERE: failure in OWSM Agent processRequest, category=security,
 function=agent.function.client, application=default, composite=pe3test3,
 modelObj=Service1, + policy=null, policyVersion=null, assertionName=null
 oracle.wsm.common.sdk.WSMException: WSM-00101 : The specified Keystore file 
 /scratch/sbollapa/stage131/user_projects/domains/sai131_domain/config/fmwconfig/default-keystore.jks cannot be found; 
 it either does not exist or its path is not included in the application classpath.
...

Sample Log: Certificate Not Available

The following sample log excerpt indicates that an Oracle WSM security policy with message protection was applied that required a security certificate that was not available in the keystore. To resolve this security fault, configure the keystore with a certificate, as described in "Setting up the Keystore for Message Protection".

[2009-04-15T04:07:02.821-07:00] [jrfServer] [ERROR] [WSM-000062]
 [oracle.wsm.resources.security] [tid: [ACTIVE].ExecuteThread: '0' for 
queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] 
 [ecid: 0000I2dTFG7DScT6uBe9UH19tRyv000000,0:1] [WEBSERVICE_PORT.name:
 NonCAAsCAMessageProtectionPolicyPort] [APP: jaxwsservices] 
 [J2EE_MODULE.name: NonCAAsCAMessageProtectionPolicy] [WEBSERVICE.name:
 NonCAAsCAMessageProtectionPolicyService] [J2EE_APP.name: jaxwsservices] 
 [arg: oracle.wsm.security.SecurityException: WSM-00062 : 
 The path to the certificate used for the signature is invalid.] 

[2009-04-15T04:07:02.810-07:00] [jrfServer] [NOTIFICATION] []
 [oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor] 
 [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default
 (self-tuning)'] [userId: <anonymous>] 
[ecid: 0000I2dTFG7DScT6uBe9UH19tRyv000000,0:1] 
[WEBSERVICE_PORT.name: NonCAAsCAMessageProtectionPolicyPort] 
[APP: jaxwsservices] [J2EE_MODULE.name: NonCAAsCAMessageProtectionPolicy]
 [WEBSERVICE.name: NonCAAsCAMessageProtectionPolicyService] [J2EE_APP.name:
 jaxwsservices] Certificate path validation failed for signing certificate

[2009-04-15T04:07:02.821-07:00] [jrfServer] [ERROR] [WSM-00006]
 [oracle.wsm.resources.security] [tid: [ACTIVE].ExecuteThread: '0' for queue:
 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] 
[ecid: 0000I2dTFG7DScT6uBe9UH19tRyv000000,0:1] [WEBSERVICE_PORT.name:
 NonCAAsCAMessageProtectionPolicyPort] [APP: jaxwsservices] 
[J2EE_MODULE.name: NonCAAsCAMessageProtectionPolicy] [WEBSERVICE.name:
 NonCAAsCAMessageProtectionPolicyService] [J2EE_APP.name: jaxwsservices] 
[arg: oracle.wsm.security.SecurityException: WSM-00062 : The path to the
 certificate used for the signature is invalid.] Error in receiving the request:
 oracle.wsm.security.SecurityException: WSM-00062 : The path to the certificate
 used for the signature is invalid.

Configuring Log Files for a Web Service

To further organize your logging data, you can configure the log files for a Web service. You can configure log files for SOA, ADF, and Web Center services.

The following table defines the default log files that are relevant to Oracle WSM.

Table 16-2 Default Log Files for Oracle WSM

Default Log File Description

odl-handler

Logs general diagnostic data for the Java EE components in the server.

owsm-message-handler

Logs SOAP messages as per Oracle WSM logging policies.

The following procedure describes how to set the log level for diagnostic logs at the WebLogic Server and Web service endpoint levels. For more information, see "Setting the Level of Information Written to Log Files" in Oracle Fusion Middleware Administrator's Guide.

To configure the log files for a Web service:

  1. Navigate to the WebLogic Server for which you want to configure a logger.

    1. In the navigator pane, expand WebLogic Domain.

    2. Expand the domain.

    3. Select the desired server from the list.

      The WebLogic Server home page is displayed.

  2. From the WebLogic Sever menu, select Logs > Log Configuration.

    The Log Configuration page is displayed.

  3. Select the Log Files tab.

    The current list of log files is displayed, as shown in Figure 16-6. The Log Configuration page shows the currently configured log path, file format, and rotation policy.

    Figure 16-6 Current Log Files

    Description of Figure 16-6 follows
    Description of "Figure 16-6 Current Log Files"

  4. If you wish to edit the log policy configuration, select the log file in the list and click Edit Configuration . . ..

    The Edit Log File page is displayed.

    Figure 16-7 Edit Log File Page

    Description of Figure 16-7 follows
    Description of "Figure 16-7 Edit Log File Page"

  5. Edit the log file information, as required.

    Table 16-3 Fields in Edit Log File Page

    Field Description

    Log Path

    Path to the log file. This field is required.

    Log File Format

    Format of the log file. Valid values are text or XML.

    Log Level

    Default log level for the logger. Select a log level from the list. Valid values include:

    • INCIDENT_ERROR:1 (SEVERE+100)

    • ERROR:1 (SEVERE)

    • WARNING:1 (WARNING)

    • NOTIFICATION:1 (INFO)

    • NOTIFICATION:16 (CONFIG)

    • TRACE:1 (FINE)

    • TRACE:16 (FINER)

    • TRACE:32 (FINEST)

    Use Default Attributes

    Flag that specifies whether to use default attributes for the logger.

    Supplemental Attributes

    Supplemental attributes required.

    Loggers to Associate

    Components to associate with the logger.

    Rotation Policy

    Specify whether you wish to rotate log files based on file size of length of time. For more information, see "Configuring Log File Rotation" in Oracle Fusion Middleware Administrator's Guide.

    If Size Based is selected as the rotational policy, Maximum Log Files Size is a required field. If Time Based is selected as the rotational policy, Frequency is a required field.

  6. Click OK to edit the log file configuration.