Think Middleware

Configuring Common Secure Interoperability Version 2 (CSIV2) - PCI Compliance

noreply@blogger.com (Anonymous) — Thu, 15 Sep 2016 11:44:00 +0000

TL;DR

To enable CSIv2 for inbound and outbound launch the wsadmin tool with -lang jython and issue the following command:

AdminTask.configureCSIOutbound('[-transportLayer 'SSL-required']')
AdminTask.configureCSIInbound('[-transportLayer 'SSL-required' ]')
AdminConfig.save()

Using the console:

Set the inbound and outbound transports in the administrative console. Make sure that administrative security is enabled.

WebSphere Application Server Version 7.0: Click Security > Global Security > RMI/IIOP Security > CSIv2 inbound [outbound[ communications. Change the transport type under the CSIv2 Transport Layer to SSL-Required.

Transport values:

TCP/IP
SSL-required
SSL-supported

CSIv2 stands for the Common Secure Interoperability Version 2 (CSIV2) and can be found in the inbound and outbound communication settings.

FIPS Compliance-Part III. enableFips using wsadmin and jython jacl

noreply@blogger.com (Anonymous) — Mon, 29 Aug 2016 16:49:00 +0000

TL;DR

To enable FIPS140-2, launch the wsadmin tool with -lang jython and issue the following command:

AdminTask.enableFips("[-enableFips true -fipsLevel FIPS140-2]")

or use Jacl:

$AdminTask enableFips {-enableFips true -fipsLevel transition }

Result:

fipsLevel values:

FIPS140-2

transition

SP800-131

Details:

Or you can save even more time by scripting this. I wrote the following script to do the job for me (my actual script is longer as now it supports different fipsLevel values).

Example jython script:

import sys, java
def enableFIPS(fipsLevel):
  AdminTask.enableFips("[-enableFips true -fipsLevel FIPS140-2)
  AdminConfig.save()
def disableFIPS():
  AdminTask.enableFips("[-enableFips false)
  AdminConfig.save()
if sys.argv[0].lower()=="enable":
  print 'Enabling the FIPS140-2'
  enableFIPS("FIPS140-2")
elif sys.argv[0].lower()=="disable"
  disableFIPS()

FIPS Compliance-Part II. IBMJCEFIPS not found for IBMSecureRandom

noreply@blogger.com (Anonymous) — Tue, 16 Aug 2016 16:49:00 +0000

TL;DR

Add the following lines to the java.security ([java_homedir]/jre/lib/security/java.security) file:

security.provider.1=com.ibm.securerandom.provider.IBMSecureRandom
security.provider.2=com.ibm.crypto.provider.IBMJCE

Explanation of the issue:

After enabling the FIPS compliance you might encounter the following errors in the log file once you try to restart the Application server:

Log details:

com.ibm.websphere.ssl.JSSEHelper.getSSLContext 704
com.ibm.ws.security.orbssl.WSSSLServerSocketFactoryImpl.createSSLServerSocket 459
com.ibm.ws.orbimpl.transport.WSTransport.createServerSocket 1439
com.ibm.ws.orbimpl.transport.WSTransport createServerSocket P=312105:O=0:CT ORBX0390E: Cannot create listener thread.
Exception=[ org.omg.CORBA.INTERNAL: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_SERVER_SOCKET,
Exception=com.ibm.websphere.ssl.SSLException:
java.lang.RuntimeException: Provider IBMJCEFIPS not found for IBMSecureRandom
vmcid: 0x49421000 minor code: 77 completed: No - received while attempting to open server socket on port 1072 ].
com.ibm.ws.orbimpl.transport.WSTransport.startListening 805
com.ibm.ws.orbimpl.transport.WSTransport.createListener 724

The easiest way to fix it is by adding the missing IBM SecureRandom provider into the list before the IBM JCE provider inside the java.security ([java_homedir]/jre/lib/security/java.security):

security.provider.1=com.ibm.securerandom.provider.IBMSecureRandom
security.provider.2=com.ibm.crypto.provider.IBMJCE

FIPS Compliance-Part I. How to enable the FIPS

noreply@blogger.com (Anonymous) — Mon, 15 Aug 2016 13:21:00 +0000

How to Enable the FIPS in WebSphere Application Server?

Login to the web console (http[s]://[hostname]:port/ibm/console) and navigate to:

Security > SSL certificate and key management.

Go to Manage FIPS

Select the check box to Use the United States Federal Information Processing Standard (FIPS 140-2) algorithms

Click Apply.

Save the configuration changes.

Next, set the environment variable to restrict the IBMJSSE2 provider to FIPS-compliant algorithms:

Servers > Application servers, and choose your application server

In the 'Configuration' tab, select the Server Infrastructure field

Click on the Java and Process Management > Process Definition

In the Additional Properties field, click Java Virtual Machine

Inside the Generic JVM Arguments field add the value: -Dcom.ibm.jsse2.usefipsprovider=true

Or, add the -Dcom.ibm.jsse2.usefipsprovider=true property to the jvm.options file

Finding the WebSphere Admin Console Port

noreply@blogger.com (Anonymous) — Fri, 12 Aug 2016 09:14:00 +0000

TL;DR

locations of the files with all the ports including the ibm/console ports:

$WAS_HOME/profiles/[profileName]/config/cells/[cellName]/virtualhosts.xml

$WAS_HOME/profiles/[profileName]/config/cells/[cellName]/nodes/[dmgrName]/serverindex.xml

serverindex.xml

After the default installation of the WAS (Websphere Application Server) you can find the console located under the following URLs:

http://[hostname]:9060/ibm/console

or the SSL (secure connection) under the following URL:

https://[hostname]:9043/ibm/console

These ports are defined inside the virtualhosts.xml and serverindex.xml files that can be found in the following locations:

$WAS_HOME/profiles/[profileName]/config/cells/virtualhosts.xml
$WAS_HOME/profiles/[profileName]/config/cells/[cellName]/nodes/[dmgrName]/serverindex.xml

IBM Websphere Application Server how to

noreply@blogger.com (Anonymous) — Tue, 19 Jul 2016 11:22:00 +0000

Below, bunch of very useful links regarding the IBM Websphere Application Server.

Here you can find information regarding the software installation, installation manager, policies, development, JEE specifications, compare IBM Websphere products, get the technical overview as well as the Update and the New features guide, tunning and performance tips, migration and upgrade guides.

Enjoy!

System administration in WebSphere Application Server V8.5, Part 1:An overview of new administrative features and enhancements

http://www.ibm.com/developerworks/websphere/techjournal/1206_cheng/1206_cheng.html

System administration in WebSphere Application Server V8.5, Part 2:Using the Centralized Installation Manager

http://www.ibm.com/developerworks/websphere/techjournal/1206_wong/1206_wong.html

System administration in WebSphere Application Server V8.5, Part 3:High Performance Extensible Logging (HPEL)

http://www.ibm.com/developerworks/websphere/techjournal/1208_bourne/1208_bourne.html

System administration in WebSphere Application Server V8.5, Part 4:Using pluggable SDK 7

http://www.ibm.com/developerworks/websphere/techjournal/1209_hall/1209_hall.html

IBM Techdocs Whitepapers on WAS Migration case studies, including other IBM products

http://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101455

Migrating to Version 7.0 - zOS

http://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101329

WAS z/OS Migration Performance Study

http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101589

Case study: Tuning WebSphere Application Server V7 for performance

http://www.ibm.com/developerworks/websphere/techjournal/0909_blythe/0909_blythe.html

WebSphere Application Server V7 Migration Guide

http://www.redbooks.ibm.com/redpieces/abstracts/redp4635.html

Changing host names and migrating profiles

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-ndmp&topic=tagt_hostname

http://www.ibm.com/developerworks/websphere/techjournal/0905_webcon/0905_webcon.html

IBM Techdocs Whitepapers on WAS Migration case studies, including other IBM products

http://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101455

Migrating to Version 7.0 - zOS

http://www-03.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101329

WAS z/OS Migration Performance Study

http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101589

Case study: Tuning WebSphere Application Server V7 and V8 for performance

http://www.ibm.com/developerworks/websphere/techjournal/0909_blythe/0909_blythe.html

WebSphere Application Server V7 Migration Guide

http://www.redbooks.ibm.com/redpieces/abstracts/redp4635.html

WebSphere Application Server V8.5 Migration Guide

http://www.redbooks.ibm.com/abstracts/sg248048.html

Changing host names and moving profiles

http://www.ibm.com/developerworks/websphere/techjournal/0905_webcon/0905_webcon.html

Migrating cell configurations to new host machines

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nddist&topic=tmig_migrate_remote_commandline

Migration – Application Installation problems

http://www-01.ibm.com/support/docview.wss?uid=swg27008724&aid=13

Rational Application Developer Performance Tips

http://www.redbooks.ibm.com/abstracts/sg246449.html

WDT and WAS Application Server for Development

http://www.ibm.com/developerworks/downloads/ws/wasdevelopers/

JDK Compatibility

http://www.oracle.com/technetwork/java/javase/8-compatibility-guide-2156366.html

http://www.oracle.com/technetwork/java/javase/compatibility-417013.html

http://www.oracle.com/technetwork/java/javase/compatibility-137541.html

J2EE class loading

http://www.ibm.com/developerworks/websphere/library/techarticles/0112_deboer/deboer.html

Migration from Apache SOAP to WebServices

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-basedist&topic=rwbs_migrate

JavaServer Pages specific Web container custom properties

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-ndmp&topic=rweb_jsp_custom_props

JMS Listener to Message Driven Bean migration

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-ndmp&topic=tmj_adm32_

JDK 5/6/7 Tuning

http://www.ibm.com/support/docview.wss?uid=swg27013824

Using Spring and Hibernate with WebSphere Application Server

http://www.ibm.com/developerworks/websphere/techjournal/0609_alcott/0609_alcott.html

WebSphere Application Server Migration Toolkit

http://www.ibm.com/developerworks/websphere/downloads/migtoolkit/index.html

https://developer.ibm.com/wasdev/docs/migration/

https://developer.ibm.com/wasdev/docs/migration-toolkit-application-binaries/

https://developer.ibm.com/wasdev/downloads/#asset/tools-WebSphere_Application_Server_Migration_Toolkit

https://developer.ibm.com/wasdev/downloads/#asset/tools-Migration_Toolkit_for_Application_Binaries

Using other WebService engines in WAS

http://www.ibm.com/developerworks/websphere/library/techarticles/1001_thaker/1001_thaker.html

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-ndmp&topic=twbs_thirdparty

JSF Migration

http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-ndmp&topic=cweb_jsfmigrate

WebSphere Application Server V8.5 Migration Guide

http://www.redbooks.ibm.com/redpieces/abstracts/sg248048.html

Resolving Open Source issues

http://www-01.ibm.com/support/docview.wss?uid=swg21639407

UrbanCode Deploy

https://developer.ibm.com/urbancode/products/urbancode-deploy/

https://developer.ibm.com/urbancode/plugin/websphere-application-server-configure/

Introducing the Visual Configuration Explorer

http://www.ibm.com/developerworks/websphere/techjournal/0710_supauth/0710_supauth.html

http://www.ibm.com/developerworks/forums/forum.jspa?forumID=1139

IBM Support Assistant

https://www-01.ibm.com/software/support/isa/

Best Practices for Configuring and Managing Large WebSphere Topologies

http://www.ibm.com/developerworks/websphere/library/techarticles/0710_largetopologies/0710_largetopologies.html

wsadmin Primer

http://www.ibm.com/support/techdocs/atsmastr.nsf/WebIndex/WP101014

IBM SDK, Java Technology Edition

http://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/welcome/welcome_javasdk_version.html

http://www.ibm.com/support/knowledgecenter/SSYKE2_7.1.0/welcome/welcome_javasdk_version.html

JACL to Jython conversion assistant

http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24012144

CurrentFunctionPath - resolving function and stored procedure references

noreply@blogger.com (Anonymous) — Mon, 04 Jul 2016 09:08:00 +0000

Whenever you are getting the error for trying to access particular function via stored procedure, and you get the error, most probably the CurrentFunctionPath does not include the valid (or contains not enough) schema names.

The CurrentFunctionPath is a property, and can contain one or more schema names, separated by commas and enclosed in double quotation marks. Also, the order of the defined schemas determines the orders in which the function and procedure names are resolved.

The default value is the default CURRENT PATH (or CURRENT_PATH) special register setting at the database server.

Git commands for the beginners. Part I

noreply@blogger.com (Anonymous) — Tue, 14 Jun 2016 09:57:00 +0000

To create a new repository:

git init

To checkout from the existing repository, use:

git clone username@host:/path/to/repository

To create a copy of the existing local repository:

git clone /path/to/repository

Use: https://github.com

unix list files opened by process application

noreply@blogger.com (Anonymous) — Thu, 15 May 2014 21:19:00 +0000

How to list files being used by the application

When you need to know which files are being used by the application un unix/linux, you could try using the lsof command:

$ lsof -p <pid number>

But sometimes there is no lsof installed. In that case you can you the awk command:

$ pid=1337$ awk '!/\[/&&$6{_[$6]++}END{for(i in _)print i}' /proc/$pid/maps

SOA Web Services Security Testing

noreply@blogger.com (Anonymous) — Sun, 02 Mar 2014 16:35:00 +0000

Today, while I was searching for some information regarding SOA and security in web services, I found this article written by one of my colleagues.

Here is the link to the article:

http://ipsec.pl/web-application-security/2013/web-services-security-testing.html

How to create new domain in Weblogic using gui or console mode

noreply@blogger.com (Anonymous) — Sun, 16 Feb 2014 19:29:00 +0000

How to create a new domain in Weblogic?

There are couple options when you want to create/ extend a domain in Weblogic:

Configuration Wizard in either GUI/ or console ( text-mode mode)
WLST
Create the files manually
Copy the domain from another project :)

1a.Using the GUI mode:

in the shell go to the WLS binaries directory:

${WLS_HOME}/common/bin

and run the following script:

./config.sh

${WLS_BIN}/common/bin/config.sh

If the system can not support GUI mode, Configuration Wizard will start text-based mode.

1b. Using the console ( text-based ) mode:

in the shell go to the WLS binaries directory:

${WLS_HOME}/common/bin

and run the following script:

./config.sh -mode=console

${WLS_BIN}/common/bin/config.sh -mode=console

2. Using WLST mode

http://docs.oracle.com/cd/E13222_01/wls/docs92/config_scripting/domains.html

What are MBeans JavaBeans and JMX

noreply@blogger.com (Anonymous) — Tue, 11 Feb 2014 17:58:00 +0000

What are MBeans JavaBeans and JMX

What are MBeans?

MBeans Objects are type of JavaBean, created (mostly) with the Dependency Injection

What is inside the MBean?

MBeans represent current state/ resource of a running parts of the application, and expose the management interface containing:

getters / setters – in order to set or get specific values on the particular items
ability to perform more advanced operations
provide self description mechanism

MBeans structure:

So basically MBeans can hold information like statistics, current configuration, or simply act as a key-value store.

MBeans are registeresd to the MBean Server and are used in the JMX (Java Management Extensions technology).

JMX:

JMX (Java Management Extensions) – allows co connect to the currently running JVM to monitor/ manager running applications through MBeans.

JMX can communicate with the MBeans through a connector (RMI, IIOP, JMS…)that talk with the MBean Server via API. MBean Server is a bridge between the connector and MBeans.

The JMX specification defines following types of MBeans:

Standard MBeans

Dynamic MBeans

Open MBeans

Model MBeans

MXBeans

Resources:

http://docs.jboss.org/jbossas/jboss4guide/r4/html/jbosscache.chapt.html https://blogs.oracle.com/jmxetc/entry/what_is_jmx

How to disable remote shutdown in Tomcat (secure)

noreply@blogger.com (Anonymous) — Tue, 11 Feb 2014 17:47:00 +0000

How to disable remote shutdown in Tomcat

Examples:

change the port number from default to different one (not recommended)
change the shutdown command (partially recommended)
change port number to -1 (recommended)

By default Tomcat listens on port 8005 for SHUTDOWN command. When such message is received, all applications within this context are shutdown. By default it is bound to loopback interface, though not accessible from external network. For security reasons I’d strongly advise to disable this functionality if it is not needed, just in case some user might shutdown the service on purpose or by accident.

We can find this definition in the server.xml file

$CATALINA_HOME/conf/server.xml

<Server port="8005" shutdown="SHUTDOWN">

You might have ‘address’ variable in this line. This indicates possible usage of multiple NIC (http://en.wikipedia.org/wiki/Network_interface_controller

We can prevent shutting down on specific port by changing these values.

EXAMPLE 1:

Change the settings in the server.xml file from:

<Server port="8005" shutdown="SHUTDOWN">

To:

<Server port="8008" shutdown="SECRETCOMMAND">

From now on, only SECRETCOMMAND command will shutdown the instance. All other commands (including SHUTDOWN) will fail.

Result:

[me@me ~]$ telnet 192.168.1.3 8005

Trying 192.168.1.3...

Connected to 192.168.1.3.

Escape character is '^]'.

SHUTDOWN

Connection closed by foreign host.

Response (by default- catalina.out file) :

WARNING: StandardServer.await: Invalid command 'SHUTDOWN' received

EXAMPLE 2:

Change the settings in the server.xml file from:

<Server port="8005" shutdown="SHUTDOWN">

<Server port="8001" shutdown="SHUTDOWN">

From now on only SHUTDOWN command issued on port 8001 (if not used by other application) will shutdown the instance. Port 8005 will not be used by this instance.

Result:

[me@me ~]$ telnet 192.168.1.3 8005

Trying 192.168.1.3...

telnet: connect to address 192.168.1.3: Connection refused

EXAMPLE 3 (recommended):

Change the settings in the server.xml file from:

<Server port="8005" shutdown="SHUTDOWN">

<Server port="-1" shutdown="SHUTDOWN">

This will disable SHUTDOWN service/ command for good :)

Result:

[me@me ~]$ telnet 192.168.1.3 8005

Trying 192.168.1.3...

telnet: connect to address 192.168.1.3: Connection refused

AJP (Liferay/ Tomcat) no response fix

noreply@blogger.com (Anonymous) — Tue, 11 Feb 2014 09:24:00 +0000

https://github.com/wheelq/AJP.Stats

Description of the issue

When using Liferay on Tomcat + Apache/nginx you might experience a small Denial Of Service from time to time. In the most cases the issue is in Tomcat's configuration, well to be more precise - in lack of the configuration ;)

When defining an AJP connector on port 8009:

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="10.0.1.2" URIEncoding="UTF-8">

People often miss one important setting -connectiontimeout andkeepAlivetimeout.

Solution

connectiontimeout - is the number of milliseconds Connector will wait, after accepting a connection, for the request URI to be presented. If no value is defined, then the value becomes: -1 (i.e. infinite).

KeepAliveTimeout - is the number of milliseconds Connector will wait for another AJP request before closing the connection. The default value is to use the value that has been set for the connectiontimeout attribute.

Lack of this configuration might cause the DOS (Denial Of Service) of the application itself. Once you have fixed this problem be defining the settings mentioned above you might want to monitor number of connections to your application/Liferay and see if there is a high number of connections maintained or not.

AJP.Stats

That is why I have created small, not really intelligent, very slow, but working script to make your life easier :)

ENJOY! :)

https://github.com/wheelq/AJP.Stats

mod_unique_id unable to find IPv4 address - IBM HTTP Server not starting

noreply@blogger.com (Anonymous) — Sun, 09 Feb 2014 22:48:00 +0000

There might be several causes of this issue, why after starting the IHS there is no process running in the system.

# ./apachectl start
#ps -ef | grep httpd
#

No errors thrown, no process running. Even config test runs fine:

$./apachectl configtest

Syntax OK

We could check if it is SELinux issue, but we will check the logs first:

#tail error_log

[Sun Feb 09 17:31:40 2014] [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "test0"

The main reason for that is most probably your hostname is not defined in the /etc/hosts file.

Either you have to change your hostname to "localhost" or add the "test0" to the /etc/hosts file.

Garbage Collectors - IBM JVM

noreply@blogger.com (Anonymous) — Tue, 27 Aug 2013 10:21:00 +0000

TL;DR

-Xgcpolicy:gencon (default in V8)-Xgcpolicy:optthruput (previously default)
-Xgcpolicy:optavgpause
-Xgcpolicy:balanced

Details:

Garbage collector in IBM JVM, just as other GCs collects unused, dead, objects from the heap in order to recover some memory so it is able to allocate new objects on the heap. IBM JVM provides several GC algorithms:

-Xgcpolicy:gencon

Unused objects are removed, and the survivors are allocated in survivor spaces. After some time it is promoted to the Tenure space.

-Xgcpolicy:optthruput (previously default)

This algorithm works as MSC (Mark-Sweep-Compact). This means in the first run collector marks live objects, in the second run sweeps unused objects, and compacts the free space. This is being done in parallel. MSC process differs between different JVMs.

-Xgcpolicy:optavgpause

This policy can be used when the application can't tolerate long pauses in exchange for overall throughput. System tries to determine when next GC would be needed and then runs concurrent GC. before allocating new objects, some GC would be done.

-Xgcpolicy:balanced

This is a new in V8 collector policy. different regions of a heap map are dealt individually. More information soon

Garbage Collection Options and Functions

noreply@blogger.com (Anonymous) — Tue, 27 Aug 2013 10:19:00 +0000

Garbage collection options:

In addition to one of the previous posts regarding memory management options in various JVMs, now it is time to present some options for the GC (Garbage Collector)

Select specific collector:

-XX:+UseSerialGC
-XX:+UseParallelGC
-XX:+UseParallelOldGC (combine with -XX:+UseParallelGC)
-XX:+UseConcMarkSweepGC
-Xnoclassgc is to disable garbage collection for permanent generation

Tune the Parallel GC:

-XX:ParallelGCThreads=n - limit parallel threads by 'n'

-XX:MaxGCPauseMilis=n - limit pause in miliseconds

-XX:GCTimeRatio=n - throughput (percentage of CPU time spent on application

Increase debug level:

-XX:+PrintGC - get basic information

-XX:+PrintGCDetails - get verbose information

-XX:+PrintGCTimeStamps - add timestamps

-XX:+HeapDumpOnOutOfMemoryError very useful :)

JVM 64-bit OutOfMemory / Compressed references

noreply@blogger.com (Anonymous) — Fri, 19 Apr 2013 12:25:00 +0000

If you are running on 64-bit OS and JRockit JVM 64-bit has the heap < 4GB in size and you experience OutOfMemory errors, try disabling compressed references by using the following option in your scripts:

-XXcompressedRefs[=[true|1|false|0]]

-XXcompressedRefs:parameter=value

where 1/true stands for enabling the option.

You can also use the following format, when using different heap sizes:

-XXcompressedRefs:enable=true

-XXcompressedRefs:size=4GB for Xmx <=2g
-XXcompressedRefs:size=32GB for Xmx <=25g
-XXcompressedRefs:size=64GB for Xmx <=57g

What compressed references does, it limits all pointers (to classes, objects, threads) stored on the heap to 32bits, hence less usage of the heap.

Define Heap Size/ Memory management

noreply@blogger.com (Anonymous) — Thu, 18 Apr 2013 17:20:00 +0000

Define Heap Size/ Memory management

HotSpot		JRockit	Function
-Xmx:[size]			Xmx sets the maximum size of the heap. Maximum value should be the maximum available, but in such a way that it does not cause any error, or about 75% of the system physical memory (depends on the OS).
-Xms:[size]			Xms sets the minimum & initial size of the heap. Recommended to set the same value as the Xmx to minimize allocation overhead of the heap.
-Xmn, -XXNewSize, -XXMaxNewSize	-Xns		Xns sets the size of the Young/ Nursery generation heap. This is the place where new objects land in the first place before being promoted to the other space. XX:NewSize - Use this option to set the New generation Java heap size. Can be set to be one-fourth the size of the maximum heap size. Increase the value of this option for larger numbers of short-lived objects. -XX:MaxNewSize - Use this option to set the maximum New generation Java heap size.
-verbose:gc	-Xverbose:memory		Prints the additional information
-XX:+AggressiveHeap	XXaggressive:memory		Configures the memory system for memory-intensive workloads and sets an expectation to enable large amounts of memory resources to ensure high throughput. The JRockit JVM will also use large pages, if available.
XX:+UseConcMarkSweepGC	Xgc:singlecon		Sets the garbage collector to use a concurrent strategy
XX:+UseParallelGC	Xgc:parallel		Sets the garbage collector to use a parallel strategy
	-XgcPrio		Specifies what to prioritize: even pause times or maximum throughput
	-XpauseTarget		Specifies a suitable pause time for the application
-XX:MaxPermSize			Define Maximum heap for the Perm Genaration. . (Permanent generation) (non-heap) Stores classes, methods and other meta data

Other settings:

-Xss - If the thread stack size (-Xss) has not been set the default value depends on the threading system and the platform you are running on. When using thin threads the minimum thread stack size is 8 kilobytes and the default is 64 kilobytes. When using native threads the minimum thread stack size is 16 kilobytes. For Windows the default thread stack size when using native threads is 64 kilobytes and for Linux it is 128 kilobytes.

-XX:SurvivorRatio - The New generation area is divided into several sub-areas: Eden, Survival Space I and Survival Space II. Use the -XX:SurvivorRatio=X option to configure the ratio of the Eden/Survivor Space size. When it is 1:x Eg., -XX:SurvivorRatio=6 - each survivor space will be 1/8 the young generation).

–XX:NewRatio=n is used divide heap into old and new generation. If we use. -- XX:NewRatio=5, then you create an old-to-new ratio of 5:1; the old generation occupies 5/6 of the heap while the new generation occupies 1/6 of the heap (-XX:NewRatio=3 - the young generation will occupy 1/4 the overall heap).

Tables were taken from the Oracle website, and changed to suit the blog.

JRockit vs HotSpot JVM Difference

noreply@blogger.com (Anonymous) — Thu, 18 Apr 2013 16:10:00 +0000

Jrockit was developed by Appeal Virtual Machines and acquired by BEA Systems, and later on acquired by Oracle.

HotSpot is a Java Virtual Machine (JVM) currently hold by Oracle Corporation.

JRockit is based on the HotSpot JVM by Sun Microsystems, and now Oracle. It has been developed in order to make HotSpot more reliable, and faster to used in server side environment. Jrockit has a slightly bit different heap organisation, garbage collector methods, and optimisations. More information about GC for HotSpot can be found here.

Although JRockit is supposed to have more optimised functions, it is not the rule. Some applications might run faster under HotSpot, and some can be tuned more for JRockit. You don't know it until you try it :)

Additional information:

http://en.wikipedia.org/wiki/JRockit
http://stackoverflow.com/questions/8068717/jrockit-jvm-versus-hotspot-jvm
http://www.oracle.com/technetwork/middleware/jrockit/overview/index.html

http://weblogicserveradministration.blogspot.com/2010/11/differences-between-bea-jrockit-sdk-and.html

Garbage Collectors - JRockit

noreply@blogger.com (Anonymous) — Thu, 18 Apr 2013 15:10:00 +0000

TL;DR

Dynamic (default one)

Throughput – for maximum throughput (default): –XgcPrio:throughput

Pausetime – for short and even pause times: –XgcPrio:pausetime

Deterministic – for very short and deterministic pause times (requires Oracle JRockit Real Time)

Static (1x Generational, 2x Concurrent, 1x Parallel)

Generational

Generational Copy: -Xgc:gencopy

Concurrent

Single-spaced mostly concurrent: –Xgc:singlecon

Generational mostly concurrent: –Xgc:gencon

Parallel

General parallel: –Xgc:genpar

Details:

Static:

Generational Copy:

best to use with small heap and for testing purposes
splits heap into generations

Generational parallel collector:

causes longer pauses/ stop-the-world
multiple threads to speed up the process
segments the heap into nursery and tenured generations (objects that survive two cycles are promoted from nursery to tenured generation)
use when the application has many short lived objects

Concurrent:

Single-spaced mostly concurrent collector:

almost no pauses
works concurrently
uses entire heap
will not pause the application as long as it can collect dead objects

Generational mostly concurrent collector:

frequent stop-the-world
splits the heap -> parallel on nursery, concurrent on tenured generation
shorter nursery will cause more objects in tenured, hence more stop-the-world

Parallel:

Single-spaced parallel collector:

causes longer pauses/ stop-the-world
multiple threads to speed up the process
does not segment heap into multiple generations
use when the application has more long lived objects

Dynamic:

Throughput:

"The higher the memory throughput the shorter is the time between the two events. Moreover, the higher the memory throughput the smaller the heap you will need."

PauseTime:

" The longer the pause, the more unresponsive your system will be. The worst pause time and the average pause time are the two most interesting values you can use for tuning the system."

Garbage Collectors - HotSpot

noreply@blogger.com (Anonymous) — Tue, 16 Apr 2013 23:06:00 +0000

TL;DR

Types of Garbage Collectors in HotSpot:

Serial
Parallel
Concurrent (CMS)

Young Generation Collectors:

-XX:+UseSerialGC
-XX:+UseParallelGC (Use parallel for Young, Serial for Old)
-XX:+UseParNewGC

Old Generation Collectors:

-XX:+UseParallelOldGC (Parallel Young and Old)

-XX:+UseConcMarkSweepGC –XX:-UseParNewGC (Concurrent Mark Sweep with Serial Young)

-XX:+UseConcMarkSweepGC –XX:+UseParNewG (Concurrent Mark Sweep + Parallel Young)

Additional note:

-XX:+DisableExplicitGC - prevent calls to System.gc()

Details:

Serial collector:

-XX:+UseSerialGC

Serial Collector - runs in single thread. No communication overhead between the threads. Used for mini data sets (<100MB). This collector is quick but suited for single CPU machines.

Parallel collector:

-XX:+UseParallelGC

and (optionally) enable parallel compaction with

-XX:+UseParallelOldGC

-XX:+UseParNewGC

This type of collector is similar to the serial collector, but runs with multiple threads and does the minor collection in these threads. Be default:

N garbage collector threads = N CPUs on the host.

We can take the control over the number of threads by using the following option:

-XX:ParallelGCThreads=[number of threads]

Concurrent collector:

-XX:+UseConcMarkSweepGC

One thread is used during initial mark and remark phase. For the concurrent marking and sweeping, CMS thread runs along the application threads. Used when the short pauses and response time are crucial.

In this collector parallel version of the young generation collector is used. For the Old/ Tenured generation, serial collector is used.

Concurrent low pause collector:

-Xincgc ™ or -XX:+UseConcMarkSweepGC

This collector is used to collect Old Generation and is done concurrently with the running application, however application is still paused for short amounts of time during the collection.. A parallel version of the young generation copying collector is used with the concurrent collector.

Incremental low pause collector:

-XX:+UseTrainGC

This is currently not under the development, and has not changed since the J2SE Platform version 1.4.2

Note:

ParallelGC partially implies the -XX:+UseConcMarkSweepGC and should not (this doesn't mean you can't use it ;) ) be used in the same cmd line.

Garbage Collection (GC)

noreply@blogger.com (Anonymous) — Tue, 16 Apr 2013 17:08:00 +0000

Garbage Collection is integral part of the JVM (Java Virtual Machine) and it is used to reclaim memory occupied by the unused objects.

When the application runs, it creates objects. Once the object is created it occupies some memory. When the object is not used/ referenced it can be considered as unused and will remain in the memory until the garbage collector claims the memory occupied by this object.

Objects at first are created and put in the Young Generation space. After some time can be moved (Partial/ Minor Garbage Collection) into the Old Generation space. Once the Young and Old Generation is FULL, Full Garbage Collection is run.

This operation might impact the flow of the application, as it might take a very long time to complete. During this operation application becomes unresponsive.

To avoid this, we can tune the JVM Heap/ other settings. Different JVMs have different GC policy algorithms which will be discussed in the next posts.

Examples:

If we add the following option to the command line for the JVM:

-verbose:gc

we will get the information about the heap and result of the garbage collection for each collection.

[GC 325407K->83000K(776768K), 0.2300771 secs]
[GC 325816K->83372K(776768K), 0.2454258 secs]
[Full GC 267628K->83769K(776768K), 1.8479984 secs]

In this scenario we can see two minor GC and one Full/ Major GC.

First numbers stand for the size of live objects before and after the GC.

Numbers in parentheses represent memory space usable for java objects (perm/ survivor spaces not included).

Secs stands for the amount of time in seconds that was taken to perform the action

[GC [DefNew: 64575K->959K(64576K), 0.0457646 secs] 196016K->133633K(261184K), 0.0459067 secs]

Here the second numbers represent the heap usage reduction (196016K -> 133633K(261184K)

If we want to get even more details on the GC results we can add the following options:

-XX:+PrintGCDetails

If we add:

-XX:+PrintGCTimeStamps

we will get additional information regarding timestamps when the GC occurred Based on such results we can see how often GC occurs.

What is - EJB - Enterprise Java Bean

noreply@blogger.com (Anonymous) — Tue, 09 Apr 2013 17:02:00 +0000

TL;DR

EJB - Enterprise Java Beans is a server-side components written in Java programming language that encapsulate business logic of an application.

Types of EJBs: Session, Entity, Message-Driven

Details:

Properties of EJBs:

EJB has distributable and deployable business logic to clients

EJB is reusable across application servers

EJB executed within container that provides management and control services

EJB Modules contain: class files for enterprise beans, and EJB DD (Deployment Descriptors). Such modules are packed as JAR files.

There are three types of EJBs:

Session
Entity
Message-driven (v 2.0)

Session EJBs

Session EJB is an object, non-persistent, that lives only between client and EJB. If the user fails to remove the session EJB, it will be removed after a period of time. In order to share the sessions between the clients, we have two types of session EJBs:

Stateful - addressed for particular client
Stateless - shared among all the clients

Entity EJBs (deprecated)

Entity EJBs are for persistent objects. These are mainly used for mapping DBs with applications.

Its persistence is delegated to the EJB container or is managed on its own.

In EJB 3.0, entity beans were superseded by the Java Persistence API (which was subsequently completely separated to its own spec as of EJB 3.1). Entity Beans have been marked as a candidate forpruning as of Java EE 6 [1][2] and are therefore considered a deprecated technology.

Source: http://en.wikipedia.org/wiki/Entity_Bean

Message-Driven EJBs

Message driven beans collect/ retrieve messages in asynchronous mode. When message arrives it usually triggers particular function. Clients can subscribe to specific topics and be informed upon message arrival.

what is JavaBean

noreply@blogger.com (Anonymous) — Tue, 09 Apr 2013 16:23:00 +0000

TL;DR

JavaBeans are reusable compo nents for Java.

JavaBeans are classes with objects encapsulated into single object that is a Bean.

Details:

JavaBeans are:
- serializable objects

- have public 0-argument constructor
- allow access to private properties using just getter and setter methods.

More information: http://stackoverflow.com/questions/3295496/what-is-a-java-bean-exactly

Think Middleware

Configuring Common Secure Interoperability Version 2 (CSIV2) - PCI Compliance

TL;DR

To enable CSIv2 for inbound and outbound launch the wsadmin tool with -lang jython and issue the following command:

Using the console:

Transport values:

FIPS Compliance-Part III. enableFips using wsadmin and jython jacl

TL;DR

To enable FIPS140-2, launch the wsadmin tool with -lang jython and issue the following command:

Result:

fipsLevel values:

Details:

Example jython script:

FIPS Compliance-Part II. IBMJCEFIPS not found for IBMSecureRandom

TL;DR

Add the following lines to the java.security ([java_homedir]/jre/lib/security/java.security) file:

Explanation of the issue:

Log details:

FIPS Compliance-Part I. How to enable the FIPS

How to Enable the FIPS in WebSphere Application Server?

Login to the web console (http[s]://[hostname]:port/ibm/console) and navigate to:

Next, set the environment variable to restrict the IBMJSSE2 provider to FIPS-compliant algorithms:

Finding the WebSphere Admin Console Port

TL;DR

locations of the files with all the ports including the ibm/console ports:

IBM Websphere Application Server how to

Supported hardware and software information

IBM Support Policies

Installation Manager and Managing Repositories

The Ideal WebSphere Development Environment

Web Server plug-in technotes and Merge tool

WebSphere supported Specification levels and pointers to JEE specifications

WebSphere AppServer API Deprecations, removals and stabilizations

Changes in Default behavior

WebSphere Application Server V8.5 Concepts, Planning, and Design Guide

Migrating WebSphere Compute Grid or Feature Pack for Modern Batch

Webcast replay: WebSphere Application Server V61 for z/OS Exit Plan

WebSphere Training and Technical Enablement

IBM Education Assistant

What's new in WebSphere Application Server v7.0

What’s new in WebSphere Application Server v8.0

What's new in WebSphere Application Server V8.5

WebSphere Application Server V8.5.5 Technical Overview

WebSphere Application Server: New Features in V8.5.5

WebSphere Application Server V9 Update

Properties based configuration

System administration in WebSphere Application Server V8.5, Part 1:An overview of new administrative features and enhancements

System administration in WebSphere Application Server V8.5, Part 2:Using the Centralized Installation Manager

System administration in WebSphere Application Server V8.5, Part 3:High Performance Extensible Logging (HPEL)

System administration in WebSphere Application Server V8.5, Part 4:Using pluggable SDK 7

IBM Techdocs Whitepapers on WAS Migration case studies, including other IBM products

Migrating to Version 7.0 - zOS

WAS z/OS Migration Performance Study

Case study: Tuning WebSphere Application Server V7 for performance

WebSphere Application Server V7 Migration Guide

Changing host names and migrating profiles

IBM Techdocs Whitepapers on WAS Migration case studies, including other IBM products

Migrating to Version 7.0 - zOS

WAS z/OS Migration Performance Study

Case study: Tuning WebSphere Application Server V7 and V8 for performance

WebSphere Application Server V7 Migration Guide

WebSphere Application Server V8.5 Migration Guide

Changing host names and moving profiles

Migrating cell configurations to new host machines

Migration – Application Installation problems

Rational Application Developer Performance Tips

WDT and WAS Application Server for Development

JDK Compatibility

J2EE class loading

Migration from Apache SOAP to WebServices

JavaServer Pages specific Web container custom properties

JMS Listener to Message Driven Bean migration

JDK 5/6/7 Tuning

Using Spring and Hibernate with WebSphere Application Server

WebSphere Application Server Migration Toolkit

Using other WebService engines in WAS

JSF Migration

WebSphere Application Server V8.5 Migration Guide

Resolving Open Source issues

UrbanCode Deploy