This chapter describes runtime issues that are known to be problems.
The following runtime bug descriptions have been added to this chapter since this document was published on the Solaris 9 4/03 Documentation CD and in the Installation Kiosk on the Solaris 9 4/03 Installation CD.
If ocfserv terminates and the display is locked, the system remains locked even when a smart card is inserted or removed.
Workaround: Perform the following steps to unlock your system.
Perform a remote login to the machine on which the ocfserv process terminated.
Become superuser.
Kill the dtsession process by typing the following in a terminal window.
# pkill dtsession |
The Edit Config File menu item in the Smartcards Management Console does not edit smart card configuration files that are located in /etc/smartcard/opencard.properties. If the menu item is selected, a warning is displayed that indicates not to continue unless requested by technical support.
Workaround: Do not use the Edit Config File menu item in the Smartcards Management Console. For information on smart card configuration, see the Solaris Smartcard Administration Guide.
If you install any of the following European or Russian Unicode/UTF-8 locales, and do not also install the American English, Chinese, or Korean Unicode/UTF-8 locales, the mp print command fails.
de_DE.UTF-8
fr_FR.UTF-8
it_IT.UTF-8
es_ES.UTF-8
sv_SE.UTF-8
ru_RU.UTF-8
The mp print command will abort the print job and display the following error message:
mp: config file line: 46, cannot stat font file (/usr/openwin/lib/locale/zh.GBK/X11/fonts/TrueType/songti.ttf) |
This error also occurs in other CDE desktop applications: dtmail and dtpad, for example.
For more information about the mp print command, see the mp(1) man page.
Workaround: Choose from one of the following workarounds.
For a new installation or upgrade to the Solaris 9 4/03 operating environment, select and install one or more of the following American English, Chinese, or Korean Uniocde/UTF-8 locales:
en_US.UTF-8
zh_CN.UTF-8
zh_HK.UTF-8
zh_TW.UTF-8
ko_KR.UTF-8
If you have already completed the installation or upgrade, manually add the SUNWgttf package that is located on the the Solaris 9 4/03 Software 1 of 2 CD or netimage. Complete the following steps:
Log in to the system as superuser.
Insert the Solaris 9 4/03 Software 1 of 2 CD.
Change to the /cdrom/sol_9*/s0/Solaris_9/Product directory.
# cd /cdrom/sol_9*/s0/Solaris_9/Product |
Add the SUNWgttf package.
# pkgadd -d . SUNWgttf |
If you start a Common Desktop Environment (CDE) desktop session on a SunTM LX50 in a Chinese locale, CDE applications that execute at startup might come up with the root-window input method style, instead of the expected over-the-spot input method style.
Workaround: Add the line, sleep 1, at the end of the /usr/dt/config/Xsession.d/0020.dtims script and start a new CDE desktop session.
The Removable Media auto run capability in the CDE desktop environment has been temporarily removed from the Solaris 9 4/03 operating enviroment.
Workaround: To use the auto run function for a CD-ROM or another removable media volume, you must do one of the following:
Run the volstart program from the top level of the removable media file system.
Follow the instructions that are included with the CD for access from outside of CDE.
dtmail crashes after connecting with the IMAP server if the FontList option is specified when dtmail is launched from the command line. See the following example.
/usr/dt/bin/dtmail -xrm "Dtmail*FontList: -*-r-normal-*:" |
The following error message is displayed.
Segmentation Fault |
This problem occurs in both the C and ja locales.
Workaround: Do not specify the FontList option when you launch dtmail from the command line.
If you try to read an email message with many long lines in any of the Solaris 9 4/03 Unicode or UTF-8 locales, CDE Mailer (dtmail) appears to hang. The message does not display immediately.
Workaround: Choose one of the following workarounds.
Enlarge the dtmail Mailbox window to accommodate 132 columns.
Disable the Complex Text Layout feature by following these steps.
Become superuser.
Change directories to your system's locale directory.
# cd /usr/lib/locale/locale-name |
In the previous example, locale-name refers to the name of your system's Solaris 9 4/03 Unicode or UTF-8 locale.
Rename the locale layout engine category.
# mv LO_LTYPE LO_LTYPE- |
Rename the category for the locale layout engine to the original name (LO_LTYPE) before you apply any patches to the locale layout engine.
After you delete the last item from the desktop, the item is restored from the handheld device to the desktop when you synchronize your handheld device. Examples of items that you might delete, and then have restored, are the last appointment in your Calendar or the last address in the Address Manager.
Workaround: Manually delete the last entry from the handheld device prior to synchronization.
If you exchange multibyte data between a PDA device and Solaris CDE, the data might be corrupted in both environments.
Workaround: Back up your data on your personal computer with the PDA backup utility before you run the SolarisTM PDASync application. If you accidentally exchange multibyte data and corrupt that data, restore your data from the backup.
If you upgrade from the Solaris 9 9/02 or Solaris 9 12/02 release to the Solaris 9 4/03 operating environment, and then create a new user account, the home directory for that account is not created.
If you use the smuser command-line interface (CLI) to create the user account, a "null" error is displayed in the terminal window immediately following completion of the CLI execution.
If you created the user account by using the Solaris Management Console graphical user interface (GUI), no error message is displayed.
Workaround: After you upgrade to the Solaris 9 4/03 operating environment, complete the following steps to reregister the jar file.
You will need to delete and re-create any user accounts that were added after the system was upgraded to this release.
You can delete the user account before or after you reregister the jar file. However, before creating any new user accounts, you must complete the workaround.
Become superuser.
Reregister the jar file.
# /usr/sadm/bin/smcregister library -n VUserMgrLib.jar \ /usr/sadm/lib/usermgr/VUserMgrLib.jar \ /usr/sadm/lib/usermgr/VUserMgrLib_classlist.txt ALL |
Stop the WBEM server.
# /etc/init.d/init.wbem stop |
Restart the WBEM server.
# /etc/init.d/init.wbem start |
After you complete this workaround, the home directory, typically /export/home/username, is successfully created when you add a new user account.
For more information, see the smuser(1M) man page.
If you use Solaris Management Console to perform operations on a User or Group account on a system that serves as a DNS server, and the /etc/named.conf file exists on that system, errors occur.
The following errors occur when you perform these operations from the GUI or when you use smuser and smgroup, which are command-line interfaces for the console.
The console launches a new dialog box or the smuser command exits with the following error messages when operated on a User:
"The attempt to view Users or Roles has failed due to an unexpected error. This was caused by the following error: CIM_ERR_FAILED." |
The console launches a new dialog box or the smgroup command exits with the following error message when operated on a Group:
"Attempted Read of Group IDs failed with unexpected CIM error: CIM_ERR_FAILED."operations from the GUI or command-line interface. |
Workaround: Choose from one of the following workarounds.
To solve this problem by restarting the DNS server, follow these steps:
Become superuser.
Move the named.conf file to a different directory. For example:
# mv /etc/named.conf /var/named/named.conf |
Restart the DNS server.
# pkill -9 in.named |
# /usr/sbin/in.named /var/named/named.conf |
To solve this problem by restarting the WBEM server, follow these steps:
Become superuser.
Using a text editor, edit the /usr/sadm/lib/wbem/WbemUtilityServices.properties file.
Replace the /etc/named.conf string with /tmp/new-filename.
Ensure that the file name that you choose does not already exist on the system.
Stop WBEM server.
# /etc/init.d/init.wbem stop |
Start the WBEM server
# /etc/init.d/init.wbem start |
For more information, see the smuser(1M) and the smgroup(1M) man pages.
You are booting a Sun LX50 which has a Service partition and the Solaris 9 4/03 (x86 Platform Edition) operating environment is installed. You are given the option of pressing the F4 function key to boot the Service partition. However, pressing F4 causes the screen to go blank and the system fails to boot the Service partition.
Workaround: Do not press the F4 key when the BIOS Bootup Screen is displayed. After a time-out period, the Current Disk Partition Information screen is displayed. Select the number in the Part# column that corresponds to type=DIAGNOSTIC and press the Return key. The system boots the Service partition.
In the Solaris 9 4/03 operating environment, on UltraSPARC II based systems, the CP Event message that accompanies some Uncorrectable Memory Error messages is not always produced. These systems include the Sun EnterpriseTM 10000 and Sun Enterprise 6500/6000/5500/5000/ 4500/4000/3500/3000 systems. The result is that some information needed to identify a failing CPU might not always be present.
Workaround: For the latest information regarding this issue, check the SunSolve Web site at http://sunsolve.sun.com.
The Solaris WBEM Services 2.5 daemon cannot locate providers that are written to the com.sun.wbem.provider interface or to the com.sun.wbem.provider20 interface. Even if you create a Solaris_ProviderPath instance for a provider that is written to these interfaces, the Solaris WBEM Services 2.5 daemon does not locate the provider.
Workaround: To enable the daemon to locate such a provider, stop and restart the Solaris WBEM Services 2.5 daemon.
# /etc/init.d/init.wbem stop # /etc/init.d/init.wbem start |
If you use the javax
API to develop
your provider, you do not need to stop and restart the Solaris WBEM Services
2.5 daemon. The Solaris WBEM Services 2.5 daemon dynamically recognizes javax
providers.
If you choose to use the com.sun application programming
interface rather than the javax
application programming interface to develop your WBEM software, only CIM
remote method invocation (RMI) is fully supported. Other protocols, such as
XML/HTTP, are not guaranteed to work completely with the com.sun application programming interface.
The following table lists examples of invocations that execute successfully under RMI but fail under XML/HTTP.
Method Invocation |
Error Message |
---|---|
CIMClient.close() |
NullPointerException |
CIMClient.execQuery() |
CIM_ERR_QUERY_LANGUAGE_NOT_SUPPORTED |
CIMClient.getInstance() |
CIM_ERR_FAILED |
CIMClient.invokeMethod() |
XMLERROR: ClassCastException |
The Solaris Management Console Mounts and Shares tool cannot modify mount options on system-critical file systems such as / (root), /usr, and /var.
Workaround: Choose one of the following workarounds.
Use the remount option with the mount command.
# mount -F file-system-type -o remount,additional-mount-options \ device-to-mount mount-point |
Mount property modifications that are made by using the -remount option with the mount command are not persistent. In addition, all mount options that are not specified in the additional-mount-options portion of the previous command inherit the default values that are specified by the system. See the man page mount_ufs(1M) for more information.
Edit the appropriate entry in the /etc/vfstab file to modify the file-system mount properties, then reboot the system.
The following error message is displayed when memory is low:
CIM_ERR_LOW_ON_MEMORY |
You cannot add more entries when the Common Information Model (CIM) Object Manager is low on memory. You must reset the CIM Object Manager Repository.
Workaround: To reset the CIM Object Manager Repository, follow these steps.
Become superuser.
Stop the CIM Object Manager.
# /etc/init.d/init.wbem stop |
Remove the JavaSpacesTM log directory.
# /bin/rm -rf /var/sadm/wbem/log |
Restart the CIM Object Manager.
# /etc/init.d/init.wbem start |
When you reset the CIM Object Manager Repository, you lose any proprietary definitions in your data store. You must recompile the MOF files that contain those definitions by using the mofcomp command. See the following example.
# /usr/sadm/bin/mofcomp -u root -p root-password your-mof-file |
If you have a Solaris Volume Manager mirrored root (/) file system in which the file system does not start on cylinder 0, all submirrors you attach must also not start on cylinder 0.
If you attempt to attach a submirror starting on cylinder 0 to a mirror in which the original submirror does not start on cylinder 0, the following error message is displayed.
can't attach labeled submirror to an unlabeled mirror |
Workaround: Choose one of the following workarounds.
Ensure that both the root file system and the volume for the other submirror start on cylinder 0.
Ensure that both the root file system and the volume for the other submirror do not start on cylinder 0.
By default, the JumpStart installation process starts swap at cylinder 0 and the root (/) file system somewhere else on the disk. Common system administration practice is to start slice 0 at cylinder 0. Mirroring a default JumpStart installation with root on slice 0, but not cylinder 0, to a typical secondary disk with slice 0 that starts at cylinder 0, can cause problems. This mirroring results in an error message when you attempt to attach the second submirror. For more information about the default behavior of Solaris installation programs, see the Solaris 9 Installation Guide.
The metahs -e command might fail if you encounter the following circumstances.
A hot-spare device encounters a problem, such as an induced error, when using the metaverify test utility.
Solaris Volume Manager software attempts to activate the hot spare when an error occurs on a metadevice. The hot spare is marked broken.
The system is brought down. The failed disk that contains the hot spare is replaced with a new disk at the same location.
When the system is booted, Solaris Volume Manager software does not recognize the new hot spare.
The metahs -e command is used to enable the hot spare on the new disk.
The following message is displayed.
WARNING: md: d0: open error of hotspare (Unavailable) |
The failure occurs because the Solaris Volume Manager software does not internally recognize the new hot-spare disk that was swapped into the same physical location. The Solaris Volume Manager software continues to display the device ID of the disk that is no longer in the system.
This failure is not known to occur on a Photon or storage enclosures where the device number changes when a disk is replaced.
Workaround: Choose one of the following workarounds.
Follow these steps to update the device ID for the hot-spare disk in the Solaris Volume Manager state database.
Become superuser.
Type the following command to update the device ID for the hot-spare disk.
# metadevadm -u logical-device-name |
Type the following command to make the new hot-spare disk available.
# metareplace -e logical-device-name |
Follow these steps to manage hot spares and hot-spare pools on the system.
Become superuser.
Type the following command to delete the entry for the hot-spare slice.
# metahs -d hsphot-spare-pool-number logical-device-name |
Type the following command to create a new entry for the hot-spare slice at the same location with the correct device ID.
# metahs -a hsphot-spare-pool-number logical-device-name |
You cannot replace a failed drive with a drive that has been configured with the Solaris Volume Manager software. The replacement drive must be new to Solaris Volume Manager software. If you physically move a disk from one slot to another slot on a Photon, the metadevadm command fails. This failure occurs when the logical device name for the slice no longer exists. However, the device ID for the disk remains present in the metadevice replica. The following message is displayed.
Unnamed device detected. Please run 'devfsadm && metadevadm -r to resolve. |
You can access the disk at the new location during this time. However, you might need to use the old logical device name to access the slice.
Workaround: Physically move the drive back to its original slot.
If you remove and replace a physical disk from the system, and then use the metarecover -p -d command to write the appropriate soft partition specific information to the disk, an open failure results. The command does not update the metadevice database namespace to reflect the change in disk device identification. This condition causes an open failure for each such soft partition that is built on top of the disk. The following message is displayed.
Open Error |
Workaround: Create a soft partition on the new disk instead of using the metarecover command to recover the soft partition.
If the soft partition is part of a mirror or RAID 5, use the metareplace command without the -e option to replace the old soft partition with the new soft partition.
# metareplace dx mirror or RAID 5 old_soft_partition new_soft_partition |
If you configure multiple IP tunnels between two IP nodes, and enable ip_strict_dst_multihoming or other IP filters, packet loss might result.
Workaround: Choose one of the following workarounds.
First, configure a single tunnel between the two IP nodes. Add addresses to the tunnel by using the ifconfig command with the addif option.
Do not enable ip_strict_dst_multihoming on tunnels between two IP nodes.
If you unlock a locked CDE session, all your cached Kerberos version 5 (krb5) credentials might be removed. The result is you might not be able to access various system utilities. This problem occurs under the following conditions.
In the /etc/pam.conf file, the dtsession services for your system are configured to use the krb5 module by default.
You lock your CDE session, and then try to unlock the session.
If this problem occurs, the following error message is displayed.
lock screen: PAM-KRB5 (auth): Error verifying TGT with host/host-name: Permission denied in replay cache code |
Workaround: Add the following non-pam_krb5 dtsession entries to the /etc/pam.conf file.
dtsession auth requisite pam_authtok_get.so.1 dtsession auth required pam_unix_auth.so.1 |
With these entries in the /etc/pam.conf file, the pam_krb5 module does not run by default.
In the Solaris 9 4/03 operating environment, locked accounts are treated in the same way as expired or nonexistent accounts. As a result, the cron, at, and batch utilities cannot schedule jobs on locked accounts.
Workaround: To enable locked accounts to accept cron, at, or batch jobs, replace the password field of a locked account (*LK*) with the string NP, for no password.
If you try to perform various tasks with Veritas Volume Manager on a system that is running the Solaris 9 4/03 operating environment, the vxddladm addjob or vxddladm addsupport utilities might produce a core dump.
Workaround: Follow these steps.
Become superuser.
Verify that the /var/ld/ld.config file and /usr/bin/crle utility exist on the system.
Type the following commands in a terminal window.
# /usr/bin/cp /var/ld/ld.config /var/ld/ld.config.save # /usr/bin/crle -E LD_LIBRARY_PATH=/usr/lib # appropriate-vxddladm-command # /usr/bin/mv /var/ld/ld.config.save /var/ld/ld.config |
In the iPlanetTM Directory Server 5.1 Collection (Solaris Edition), links titled DocHome and links between separate books do not work. If you select these links, your browser displays a Not Found error.
Workaround: To navigate between iPlanet Directory Server 5.1 documents on your system, go to the iPlanet Directory Server 5.1 Collection (Solaris Edition) page at http://docs.sun.com. Click the link to the document you want to view.
If you remove the SUNWsdocs package, then try to remove other documentation packages, the removal fails. This problem occurs because the SUNWsdocs package is installed with any collection and provides the browser entry point.
Workaround: If you removed the SUNWsdocs package, reinstall the SUNWsdocs package from the documentation media and then remove the other documentation packages.
In the Solaris 9 4/03 operating environment, and other UNIX-based systems, PDF documents on the Solaris 9 4/03 Documentation 1 of 2 CD are not accessible in the following European locales.
de (German)
es (Spanish)
fr (French)
it (Italian)
sv (Swedish)
This problem occurs because of a limitation with Adobe Acrobat Reader. For more information on this problem, see the Adobe Technote site at http://www.adobe.com:80/support/techdocs/294de.htm.
Workaround: Choose one of the following workarounds.
In the Solaris 9 4/03 operating environment, and other UNIX-based systems, set the environment variable LC_ALL to C acroread. For example, in the C shell, type the following command in a terminal window.
% env LC_ALL=C acroread |
Upgrade to Adobe Acrobat Reader 5.0 or later version.
Some Solaris 9 4/03 documentation collections might be unexpectedly removed from your system if the following occurs.
You install both the Solaris 9 4/03 Documentation 1 of 2 and 2 of 2 CDs on your system.
You then use the prodreg utility or the Solaris 9 4/03 Documentation CD installer program to remove certain documentation packages.
The Solaris 9 4/03 Documentation CD 1 of 2 and 2 of 2 have three collections in common. If you remove the packages that contain these collections from either of the Solaris 9 4/03 Documentation 1 of 2 or 2 of 2 CD installations, the package is removed for both installations.
The following table lists the packages that might be removed unexpectedly.
Table 2–1 Solaris 9 4/03 Documentation Packages Contained on Both Solaris 9 4/03 Documentation CDs
HTML Package Names |
PDF Package Names |
Collection Description |
---|---|---|
SUNWaadm |
SUNWpaadm |
Solaris 9 System Administrator Collection |
SUNWdev |
SUNWpdev |
Solaris 9 Developer Collection |
SUNWids |
SUNWpids |
iPlanet Directory Server 5.1 Collection |
Workaround: Choose one of the following workarounds.
If the uninstall process unexpectedly removed these documentation packages, and you want these packages on your system, reinstall the packages from the Solaris 9 4/03 Documentation 1 of 2 or 2 of 2 CDs.
To avoid this problem, use the pkgrm utility to remove the packages that you want to eliminate from your system.
Software support for three additional keyboard layouts have been added to the Solaris 9 software for this release: Estonian keyboard Type 6, French Canadian keyboard Type 6, and Polish programmers keyboard Type 5.
This software gives users in Estonia, Canada, and Poland greater flexibility for keyboard input by modifying standard U.S. keyboard layouts to their own language needs.
Currently, no hardware is available for the three additional keyboard layout types.
Workaround: To take advantage of this new keyboard software, modify the /usr/openwin/share/etc/keytables/keytable.map file in one of the following ways:
For the Estonian Type 6 keyboard:
Change the US6.kt entry to Estonia6.kt in the /usr/openwin/share/etc/keytables/keytable.map file. The modified entry should read as follows:
6 0 Estonia6.kt |
Add the following entries to the /usr/openwin/lib/locale/iso8859-15/Compose file:
<scaron> |
: "/xa8" |
scaron |
<scaron> |
: "/xa6" |
scaron |
<scaron> |
: "/270" |
scaron |
<scaron> |
: "/264" |
scaron |
Reboot the system for the changes to take effect.
For the French Canadian Type 6 keyboard:
Change the US6.kt entry to Canada6.kt in the /usr/openwin/share/etc/keytables/keytable.map file. The modified entry should read as follows:
6 0 Canada6.kt |
Reboot the system for the changes to take effect.
If you are using the existing Polish Type 5 keyboard layout:
Change the Poland5.kt entry to Poland5_pr.kt in the /usr/openwin/ share/etc/keytables/keytable.map file. The modified entry should read as follows:
4 52 Poland5_pr.kt |
If you are using a keyboard with dip-switches, make sure the switches are set to the correct binary value for the Polish keytable entry (binary 52) before rebooting the system.
If you are using a standard U.S. Type 5 keyboard, change the US5.kt entry to Poland5_pr.kt in the /usr/openwin/share/etc/keytables/keytable.map file. The modified entry should read as follows:
4 33 Poland5_pr.kt |
Reboot the system for the changes to take effect.
To generate the diacritic character in Arabic locales, type the Arabic character, then Shift-U.
Sorting in the European UTF-8 locales does not work properly.
Workaround: Before you attempt to sort in a FIGGS UTF-8 locale, set the LC_COLLATE variable to the ISO–1 equivalent.
# echo $LC_COLLATE > es_ES.UTF-8 # LC_COLLATE=es_ES.IS08859-1 # export LC_COLLATE |
Then start sorting.
When you attempt to use the Sun ONE Application Server Administrative UI with the Solaris 9 4/03 operating environment default browser, the following error message is displayed:
Unsupported Browser: Netscape 4.78 It is recommended that you upgrade your browser to Netscape 4.79 or Netscape 6.2 (or later) to run the Sun One Application Server Administrative UI. Those who choose to continue and not upgrade may notice degraded performance or unexpected behavior. |
If you are running the version of Sun ONE Application Server Administrative UI that is included in the Solaris 9 4/03 operating environment, you will need to use Netscape 4.79 or Netscape 7.0.
Workaround: Use /usr/dt/appconfig/SUNWns/netscape instead of /usr/dt/bin/netscape.
Sun ONE Application Server Access Control List (ACL) editing is not supported on some versions of Netscape NavigatorTM. If you attempt to edit ACL entries while using either Netscape Navigator version 6.x or Netscape Navigator version 7.x, you might encounter intermittent problems.
For example:
The browser window disappears.
The ACL edit screen does not display when launched.
Workaround: Choose one of the following workarounds.
Use the supported 4.79 version of Netscape Navigator or Microsoft Internet Explorer, version 6.0.
Manually edit the ACL file. For details on ACL file formatting, see the Sun ONE Application Server 7 Administrator's Guide.
If you use an Oracle® 9.2 client to access an Oracle 9.1 database, data corruption might occur when a number column follows a timestamp column.
The problem might be caused by using the ojdbc14.jar file with an Oracle 9.1 database. Applying the patch might assist in addressing the situation on Solaris 32-bit machines, that run an Oracle 9.1 database. This JDBCTM driver is for Oracle working with JDKTM 1.4.
Workaround: Obtain the patch that Oracle might make available from the Oracle Web site for Bug 2199718 and apply it to your server.
A verifier error is reported for a Persistence Manager Factory resource that was created by using the command-line interface. The following error is displayed when the resource is viewed in the Sun ONE Application Server Administration interface.
ArgChecker Failure: Validation failed for jndiName: object must be non-null |
Workaround: Perform the following steps to create a new Persistence Management Factory resource.
Create a jdbc-connection pool with data source information to connect to a database.
Create a jdbc-resource to make the connection pool available via a Java Naming and Directory InterfaceTM (J.N.D.I.) lookup.
Create a persistence-management resource with the jdbc-resource that was created in Step 2.
The any value in the address attribute of the iiop-listener element in the server.xml file allows for listening on all interfaces that are available on a system. This support includes both IPv4 and IPv6 interfaces. However, the Sun ONE Application Server default configuration uses an address value of 0.0.0.0 in the iiop-listener element. This default configuration does not listen on IPv6 interfaces. The configuration only listens on all IPv4 interfaces on a system.
Workaround: Use the :: value in the address attribute of the iiop-listener element in the server.xml file to listen on all IPv4 and IPv6 interfaces on a system.
If you attempt to restart the Sun ONE Application Server after installing a certificate and enabling security, the restart fails. A message indicates that the server failed to receive a password.
When SSL is not enabled, passwords are not cached, which results in the failure of restart. The restart command does not support the transition from non-SSL to SSL enabled mode.
This problem only occurs the first time the server is restarted. Subsequent restarts work fine.
Workaround: Choose one of the following workarounds.
If you have encountered this problem. click the Start button.
To avoid this problem, perform the following steps instead of clicking the Restart button.
Click the Stop button.
Click the Start button.
If an application has many Enterprise JavaBeansTM components, the server might crash during dynamic reloading of the application. The dynamic reloading feature is used in the development environment to quickly test minor changes to an application. The crash is caused by attempting to use more file descriptors than are available.
Workaround: Follow these steps.
Increase the file descriptors limit by adding lines, in this format, to the /etc/system file.
set rlim_fd_max=8192
set rlim_fd_cur=2048
Depending on the size of the application, the values can be set higher or lower.
Reboot the system.
If the system's default encoding is not UTF-8, the Application Server's output might cause multibyte characters to display incorrectly.
Workaround: Open the server.log file in your browser.
If you install an external certificate through the Sun ONE Application Administration interface, a problem is encountered when you attempt to enable SSL for the http-listener by using the certificate that is installed on the external cryptographic module. Although the installation of the certificate is successful, the certificate nickname does not display in the Administration interface.
Workaround: Complete the following steps.
Log in to the system where the Sun ONE Application Server software is installed as an Administrative User.
Link the http-listener to the certificate that is installed on the external cryptographic module by using the asadmin command. For more information on the asadmin command, see the asadmin(1AS) man page.
# asadmin create-ssl --user admin user--password password --host host name \ --port port --type http-listener --certname nobody@apprealm:Server-Cert \ --instance instance --ssl3enabled=true \ --ssl3tlsciphers +rsa_rc4_128_md5 http-listener-1 |
The previous command establishes the link between the certificate and the server instance. The command does not install the certificate. The certificate was installed through the Administration interface.
Although the certificate is linked with http-listener, the http-listener will be listening in non SSL mode.
Enable the http-listener to listen in SSL mode. Use the following command.
# asadmin set --user admin user --password password --host host name \ --port port server1.http-listener.http-listener-1.securityEnabled=true |
The previous command switches the server instance listening state from non-SSL to SSL. After you complete the previous steps, the certificate is displayed in the Administration interface.
You can now use the Administration interface to edit the http-listener as needed.
If you are running the Sun ONE Application Server software in the Solaris 9 4/03 operating environment, and you use the flexanlg command from /usr/appserver/bin, the following open failure error is displayed.
ld.so.1: /usr/appserver/bin/flexanlg: fatal: libplc4.so:open failed: No such file or directory killed |
Workaround: Complete these steps.
Add the following entry to the LD_LIBRARY_PATH file.
/usr/lib/mps
Run the flexanlg command.
% /usr/appserver/bin/flexanlg
If IPv6 is not used in your network, this problem does not apply to you.
By default, the Sun ONE Application Server 7 instances and Admin Server instances use IPv4. IPv4 is supported by all operating environments on which the Sun ONE Application Server is available. On platforms where IPv6 is supported, the Sun ONE Application Server configuration changes are required for conformance.
If these configuration changes are to be made, you must be absolutely sure of IPv6 support. If the IPv6 related configuration is applied to a system that has only IPv4 support, Application Server instances might not start.
Workaround: Perform the following configuration changes:
Start the Admin Server.
Start the Admin Console by connecting to the Admin Server HTTP host or port in a browser.
Select the server instance to configure for IPv6, for example, server1.
Expand the HTTP Listeners node in the tree view.
Select the HTTP Listener to configure for IPv6, for example, http-listener1.
Change the value of the IP Address field to ANY in the General section.
In the Advanced section, change the value of the Family field to INET6.
Setting the Family field to INET6 does not disable IPv4 functionality unless an IPv6 address is selected for IP address. Selecting an IP address of ANY matches any IPv4 or IPv6 address.
Click Save.
Select your server instance from the left pane.
Click Apply Changes.
Click Stop.
Click Start.
The server restarts and implements your changes.
If users attempt to deploy a sample more than once after making small changes and repackaging the application, the following error message is displayed.
Already Deployed |
This issue affects most of the samples because they use the Ant utility and the common.xml file, which have the deploy target. Thus, this combined use mixes deployment of applications with registration of resources.
Workaround: Choose one of the following workarounds.
For the majority of the sample applications that use the Ant utility build.xml files, which include the common.xml file, type the following command.
% asant deploy_common |
For all other sample applications, type the following commands.
% asant undeploy % asant deploy |
The Local Transaction Manager does not support transactions with definite timeouts. If you set the timeout-in-seconds attribute in the transaction-service element to a value greater than 0, all local transactions are processed as global transactions. A timeout value of 0 means that the transaction manager waits indefinitely if it does not hear from a participating data source.
If the Data source driver does not support global transactions, a local transaction might fail.
Workaround: Reset the timeout-in-seconds value to its default of 0.
To utilize Oracle JDBC optimizations with Container-Managed Persistence (CMP) beans, the classes12.zip must be specified in the classpath-suffix attribute of the server.xml file. Do not place the classes12.zip file in the instance/lib/ directory, the default for third-party libraries.
Workaround: Add the classes12.zip file to the classpath-suffix attribute of the server.xml file.
If the Admin Server is owned by root and the server instance is owned by a nonroot user, permission problems might occur during dynamic reloading and invocation of applications.
Workaround: After deploying and redeploying the module or application (with or without the precompile option), change the directory owner from root to the nonroot user for the following directories. The nonroot user is the same as the instance owner.
The directory ownership change should be applied recursively to each of the directories, based on application type, in the following list:
domain-root/server-instance/applications/j2ee-apps/application-name
domain-root/server-instance/applications/j2ee-modules/module-name
domain-root/server-instance/generated/ejb/j2ee-apps/application-name
domain-root/server-instance/generated/jsp/j2ee-apps/application-name
domain-root/server-instance/generated/jsp/j2ee-modules/module-name
Become superuser.
Type the following command for each of the directories that apply to your situation.
# chown -R non-root-instance-owner directory-name |
If a DNS lookup for an IPv6 address fails, clients of Remote Method Invocation-Internet Inter-ORB Protocol (RMI-IIOP) do not work for IPv6 addresses.
Workaround: Domain Name Service (DNS) should be set up at the deployment site, in order to look up an IPv6 address.
If the user types multibyte characters in the Only show entries with field and searches the event log, the value in the Only show entries with field becomes corrupted when the search result is displayed. The problem is caused by the conversion of the message format from UTF-16 to UTF-8.
Workaround: None.
Several issues are associated with Application Server startup when the Sun ONE Application Server is installed as part of a Solaris installation:
All application server and administrative server instances are started automatically during Solaris system startup. In many environments, not all the instances are expected to be started automatically during Solaris system startup. Starting every defined instance can adversely impact the memory available on a system.
When application server instances and administrative server instances are started automatically, the startup script for each instance is executed as root. Execution of nonroot-owned instance startup scripts can give nonroot user's access to the root user through modification of the instance-level startup scripts.
During the installation of the Sun ONE Application Server, the /etc/init.d/appserv script and symbolic links to the S84appserv and K05appserv scripts in the /etc/rc*.d/ directories are installed. These scripts cause all application server instances and administrative server instances, defined as part of the application server installation, to be started and stopped automatically during Solaris system startup and shutdown.
The /etc/init.d/appserv script contains the following section of code.
case "$1" in 'start') /usr/sbin/asadmin start-appserv ;; 'stop') /usr/sbin/asadmin stop-appserv ;;
Execution of the asadmin start-appserv command causes the administration server instance and all application server instances, defined in all administrative domains, to be started during Solaris system startup. Because the system startup and shutdown scripts are executed as root, the startup script for each application server and administrative server instance is also executed as root. The instance-level startup script is named startserv and is located at instance-dir/bin/startserv. Because instances can be owned by users other than root, the startserv scripts could be modified by the nonroot user to execute commands as the root user.
If an instance is using a privileged network port, the instance's startserv script must be executed as root. However, run as user is typically set in the instance's configuration to force the instance to run as the specified user after the instance has been initially started by the root user.
Workaround: Perform one of the following workarounds, depending on your environment.
If your environment does not require all application server and administrative server instances to be started as root, then comment out execution of the asadmin start-appserv and asadmin stop-appserv commands in the /etc/init.d/appserv script.
If your environment requires starting either specific administrative domains or specific instances within one or more administrative domains, you can modify or create a script to automate that process. Note that “specific administrative domains” include the administrative server instance and all application server instances of each domain.
Perform one of the following steps.
Modify the /etc/init.d/appserv script to start the domains or instances of interest.
Define new /etc/rc*.d/ scripts that conform to the needs of your environment.
Startup Considerations: When modifying the Solaris operating environment startup scripts to automatically start either specific application server administrative domains or specific application server instances, consider the following.
Starting a specific domain – If you want to start the administrative server instance and all application server instances of a specific administrative domain as the root user, modify the /etc/rc*.d/ scripts as follows.
case "$1" in 'start') /usr/sbin/asadmin start-domain --domain production-domain ;; 'stop') /usr/sbin/asadmin stop-domain --domain production-domain ;;
Starting a specific application server instance as a nonroot user – Modify the /etc/rc*.d/ scripts to use the su command with the -c option.
case "$1" in 'start') su - usera -c "/usr/sbin/asadmin start-instance --domain test-domain instance-a" su - userb -c "/usr/sbin/asadmin start-instance --domain test-domain instance-b" ;; 'stop') su - usera -c "/usr/sbin/asadmin stop-instance --domain test-domain instance-a" su - userb -c "/usr/sbin/asadmin stop-instance --domain test-domain instance-b" ;;
See the Sun ONE Application Server 7 Administrator's Guide for more information on the startup and shutdown commands that are available through the asadmin command-line interface.
When typing Distinguished Names during installation, use the UTF-8 character set encoding. Other encodings are not supported. Installation operations do not convert data from local character set encoding to UTF-8 character set encoding. LDIF files that are used to import data must also use UTF-8 character set encoding. Import operations do not convert data from local character set encoding to UTF-8 character set encoding.
The schema provided with the Sun Open Net Environment (Sun ONE) Directory Server (formerly iPlanet Directory Server) 5.1 differs from the schema that is specified in RFC 2256 for the groupOfNames and groupOfUniquenames object classes. In the schema provided, the member and uniquemember attribute types are optional. RFC 2256 specifies that at least one value for these types must be present in the respective object class.
The aci attribute is an operational attribute that is not returned in a search unless you explicitly request the attribute.
Multimaster replication over WAN is currently not supported.
Sun ONE Directory Server 5.1 provides the UID Uniqueness plug-in. By default, the plug-in is not activated. To ensure attribute uniqueness for specific attributes, create a new instance of the Attribute Uniqueness plug-in for each attribute. For more information on the Attribute Uniqueness plug-in, refer to the iPlanet Directory Server 5.1 Administrator's Guide at http://docs.sun.com.
The Referential Integrity plug-in is now off by default. To avoid conflict resolution loops, the Referential Integrity plug-in should only be enabled on one master replica in a multimaster replication environment. Before enabling the Referential Integrity plug-in on servers that issue chaining requests, analyze your performance resource, time, and integrity needs. Integrity checks can consume significant memory and CPU resources.
The nsRoleDN attribute is used to define a role. This attribute should not be used for evaluating role membership in a user's entry. When evaluating role membership, look at the nsrole attribute.
If VLV indexes encompass more than one database, the VLV indexes do not work correctly.
If you launch the Sun ONE Directory Server 5.1 Console and create a new user or new role as inactive, the newly created user or newly created role is not inactivated. Users and roles cannot be created through the Console as inactive.
Workaround: To create an inactive user or inactive role, follow these steps:
Create the new user or new role.
Double-click the newly created user or newly created role, or select the newly created user or newly created role. Click the Properties item from the Object menu.
Click the Account tab.
Click the Inactivate button.
Click OK.
The newly created user or newly created role is inactivated.
If you specify a base DN that contains a space, for example, o=U.S. Government,C=US at Sun ONE Directory Server 5.1 configuration time, the resulting DN is truncated to Government,C=US. At configuration time, the DN should be typed as o=U.S.%20Government,C=US.
Workaround: To correct the base DN entry, follow these steps.
Select the top directory entry in the left side of the navigation pane of the Servers and Applications tab on the Console.
Edit the suffix in the User directory subtree field.
Click OK.
If you update a nonmaster directory server with password policy information, the information is not replicated to all other servers. This information includes account lockouts.
Workaround: Manage password policy information manually on each server.
If Account Lockout is effective and the user password is changed, Account Lockout remains effective.
Workaround: Reset the accountUnlockTime, passwordRetryCount, and retryCountResetTime lockout attributes to unlock the account.
If you install the Sun ONE Directory Server 5.1, start the console, initialize the directory with an LDIF file, and then back up the server, the Console reports the backup was successful. However, the backup has actually failed.
Workaround: Perform the following tasks from the Console after you initialize the database:
Stop the server.
Restart the server.
Perform the backup.
You cannot use the LDAP naming services to create automount path names that are identical, except for case results in nonunique path names. The directory server does not allow creation of entries if the naming attribute is defined with case-sensitive syntax and an entry already exists with the same name but a different case.
/home/foo and /home/Foo paths cannot coexist.
For example, if entry attr=foo,dc=mycompany,dc=com exists, the server does not allow the creation of attr=Foo,dc=mycompany,dc=com. A corollary of this problem is that when LDAP naming services are used, automount path names have to be unique, regardless of their case.
Workaround: None.
If the server is stopped during export, backup, restore or index creation, the server crashes.
Workaround: Do not stop the server during these types of operations.
If you attempt to configure replication over Secure Socket Layer (SSL) with certificate-based authentication, replication does not work if either of the following conditions exist:
The supplier's certificate is self-signed.
The supplier's certificate is only capable of behaving as an SSL server certificate that is unable to play the role of the client during an SSL handshake.
Workaround: None.