DataPower Buddy 2.3.2 Bug Fix Release

Release 2.3.2 of dpbuddy fixes a single but significant issue preventing copying files (using dp:copy command) to the hard disk array. RAID is mounted under local: filesystem on the device; the name of the mount point can be found under Administration/Storage Devices/Hard Disk Array in WebGUI.

SOMA "CreateDir" action errors out when it is used to re-create the RAID mount directory. In this release of dpbuddy logic was added to ignore the error.

The updated DPBuddy package can be downloaded from dpbuddy download page.

Security Hardening of WebSphere Application Server Installations

It is a known fact that an out of the box WAS installation with security enabled is not entirely secure. There is a number of steps that has to be taken in order to "harden" the installation. Most of the steps are documented in the WebSphere hardening guide, which should be closely studied and followed by any WAS administrator or developer. The hardening guide, however, is a little light on the specifics regarding how to secure WAS at the OS level. For example, hardening should normally include changing file and directory permissions to restrict access to sensitive configuration files.

Why bother hardening the installation at the OS level? This helps defend against external threats, i.e., a server hosting the installation is compromised and against internal threats, i.e., an unauthorized access from inside.

Here are some of the things you can do to secure your installation on a Unix/Linux platform:

Read the rest of this post »

WebSphere Application Server Tutorial and FAQ — WAS in 5 Minutes

If you're developing applications for WAS and you're new to it, this is what you need to know:

  • What is the default URL of the admin console: https://$hostname:9043/ibm/console.
  • What are the default ports: HTTP: 9080, HTTPS: 9443.
  • How to locate the logs: Logs can be found under $install_root/profiles/$profile_name/logs/$server_name. The default profile name is AppSrv01 and the default server name is server1. Example:/usr/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/server1. SystemOut.log is the file containing everything that was logged to standard out. Logs can also be viewed from the admin console by navigating to Troubleshooting/Logging and Tracing/server_name/Runtime.
  • How to start/stop a server: If you're dealing with a "Network Deployment" type of installation (multiple application servers running under the control of the "deployment manager"), your can start/stop a server from the console (Server/Server Types/WebSphere application servers). Otherwise you have to do it from command line. Go to install_root/bin and run ./ server_name, e.g., ./ server1 (this assumes that your installation has only one profile defined, otherwise you may need to "cd" to the profile_name/bin directory). Make sure that you run all commands using the appropriate system account. To stop the server, run ./ server_name -username user_name -password password. user_name and password is the credentials of an admin account, typically the same one you use to login to the console.
  • How to deploy an application: In admin console, navigate to Applications/Application Types/WebSphere enterprise applications, click on "Install new application", select "Fast path", accept all the defaults except that on "step 2" make sure that you targeted correct servers (if you have multiple servers/clusters in your environment). Note that you can deploy a WAR file directly, you don't have to build an EAR. In this case, make sure that you set a context root on "step 4" screen of the wizard.
  • How to change context root of a Web application: Go to Applications/Application Types/WebSphere enterprise applications/application_name/Context Root For Web Modules in the console. Re-start the application after the change.
  • How to change the order of classloaders: If you're getting a ClassNotFoundException when you're starting the app, changing the order of classloaders is the first thing you may want to try. Go to Applications/Application Types/WebSphere enterprise applications/application_name/Manage Modules/module_name and make the appropriate selection in the "Class loader order" drop-down (this assumes you're doing it for a WAR module).
  • How to enable dynamic class reloading: If you need to frequently update your deployed application (e.g., you use a local WAS installation for development), enabling dynamic reloading could be a huge time saver. Go to your application in the console, "Class loading and update detection", set "Override class reloading settings ..." and set polling interval to 2 seconds. See this post for more details on how to configure your development environment to support class reloading.
  • How to find a host name and a port of the server: Go to Server/Server Types/WebSphere application servers. You'll find the host name in the Host Name column. To find a port, click on your server, and expand Ports. WC_defaulthost is the HTTP port and WC_defaulthost_secure is the HTTPS port.
  • How to kill a JVM: If the normal "stop" routine failed to stop the server in a reasonable amount of time, you may need to kill it. In a "Network Deployment" environment, simply navigate to the list of servers, select the server and click "Terminate". A node agent will kill the JVM for you. To achieve the same from command line (the only option if you're running standalone), cd to install_root/profiles/profile_name/logs/server_name, and kill the process ID contained in the file On Unix, you can simply do kill -9 `cat` (assuming server1 is your server name). Use task manager or taskkill /PID on Windows.
  • How to browse JMS messages: Go to Buses/Your bus name/Destinations/Your destination/Queue points/Your queue point/Runtime/Messages.
  • Where to find configuration files: WAS has many configuration files, most of them are in XML/XMI format. The files are located under $install_root/profiles/$profile_name/config/cells/$cell_name.

This post is part of the series on WebSphere Application Server administration. Please subscribe to our blog if you'd like to receive updates.

We offer professional services in the area of WebSphere architecture, implementation and operations. If you're looking for help with any of these tasks, please let us know.

Keeping Multiple DataPower Devices in Sync

Most DataPower installations in production contain two DataPower devices with identical or similar configuration.
It is actually quite easy to keep the two devices in sync using Apache Ant and DPBuddy administration tool.
DPBuddy supports a notion of an environment prefix. The prefix groups together connectivity properties for each device:


The above property list defines dp.username, dp.password and dp.domain properties that are common to all environments and two XML management URLs for our DataPower cluster.

Then the Ant target for importing configuration into both devices could look like this:

    <dp:import envPrefix="prod1" file="${import.file}" overwriteFiles="true" overwriteObjects="true" />
    <dp:import envPrefix="prod2" file="${import.file}" overwriteFiles="true" overwriteObjects="true" />

Note that for speed we chose to execute both imports in parallel; it is perfectly save to do it with dpbuddy as all of its tasks are thread-safe.

If your "dp:import" tasks is more complex (e.g. because of use of deployment policies), you may want to create an Ant macro for each task to avoid duplicating parameters.

MyArch, Inc. offers paid support for dpbuddy, including implementing custom enhancements. If you're interested, please contact us as info at

Message Acknowledgement or Transacted Session?

JMS is one of the oldest Java EE specifications (JMS 1.0 specification is dated 11/1999), however, questions about the difference between message acknowledgement and transacted session still come up. The difference is especially subtle when programmatic client acknowledgement (Session.CLIENT_ACKNOWLEDGE) is used since Message.acknowledge() and Session.recover() are similar to Session.commit() and Session.rollback(). So how are these APIs different?

The bottom line is that there is no difference if you deal only with a single resource (Queue or Topic) within a session. If all you do is consuming messages from a single queue, it does not matter whether you use acknowledgements or transacted sessions (although in my opinion it is more intuitive to use Session.commit/rollback). Session.commit() invokes Message.acknowledge() under the covers and Session.rollback() invokes recover().

However, if you're dealing with multiple JMS resources withing the same session (or multiple consumers/producers), the transacted session mechanism is what you want to use. For example, you may consume messages from one queue and then put messages on a different queue using the same JMS session. The transacted session will treat all consumed and produced messages as part of a single transaction and will commit or rollback all messages at once. Message acknowledgement on a non-transacted session will "commit" consumed messages independently of the produced ones.

Transacted sessions are limited to JMS resources; container-managed transactions and JTA is required to managed JMS and non-JMS resources (e.g., getting a message from a queue and updating a database).

As a summary, the different mechanisms discussed here differ in terms of the types of resources managed as part of transactions:

  • Message acknowledgement: messages consumed from a single destination.
  • Transacted session: multiple JMS resources within the same JMS session.
  • Container-managed transactions: multiple JMS and non-JMS resources.

For a more in-depth discussion of different transaction mechanisms, refer to this article.

Note: We offer professional services in the area of WebSphere architecture, implementation and operations. If you're looking for help with any of these tasks, please let us know.

Tips for Developing JMS Client for WebSphere Application Server

Following are some tips for developing a JMS client for WAS.

  • First, we need to put the right jar files on the client's classpath. Following jars are required:<WAS version>.jar,<WAS version>.jar. If you're using Oracle/Sun JDK, you'll also need<WAS version>.jar as IBM libraries rely on IBM ORB implementation. IBM JDK has it built-in but Oracle's obviously does not. These jars are available from the "runtimes" directory of your WAS installation. It is a good idea to make sure that the version of your client jars matches the version of your target WAS installation, including the fixpack level. You may want to update your client jars every time a new fixpack is installed.
  • If you're not using DNS, you'll need to add the host name of the WAS server to the host file on your client machine, otherwise you're bound to get a cryptic ORB error message. You can find WAS host name by going to Server/Server types/ WebSphere Application Servers in admin console.
    By the way, most ORB error messages are cryptic; it is very rare to see the root cause of the problem in the message. The way to deal with it is to enable ORB tracing. Add to your JDK parameters; other debug/tracing parameters are explained here.
  • Another frequent source of errors is a missing bootstrap property in the connection factory configuration. It is specified in the "provider endpoint" field and has a form of <host>:<SIB_Port>:BootstrapBasicMessaging. If this is not provided, WAS will attempt to bootstrap the messaging engine using localhost.
  • Most JMS examples use JNDI lookup in order to get a queue object. It is more efficient to use session.crerateQueue() method. Note that in this case you need to provide the name of the JMS destination as opposed to the queue JNDI name. This is the "Queue name" parameter on the queue configuration screen in WAS admin console.
  • Finally, not all developers are aware that WAS admin console has a built-in JMS queue/topic browser. It takes a few steps to get to it from the console: Buses/Your bus name/Destinations/Your destination/Queue points/Your queue point/Runtime/Messages.

Note: We offer professional services in the area of WebSphere architecture, implementation and operations. If you're looking for help with any of these tasks, please let us know.

DPBuddy — Tool For DataPower Administrators and Developers

We're pleased to announce the release of our new product, DataPower Buddy (dpbuddy). "dpbuddy" a free command-line tool for automating administration, management and deployment of IBM WebSphere DataPower appliances. The tool supports export/import, file transfer, backups and many other functions.

dpbuddy is implemented as a set of custom tasks for the popular build tool, Apache Ant.

Here is a quick example of dpbuddy in action:

<dp:copy cleanDirectories="true">
    <dpFileset prefix="/apps/services" 
               dir="services" includes="**/*.wsdl **/*.xsd"/>

This Ant task will remove remote directories if they exist, reproduce the local directory tree (all folders under "services") on the device and upload the necessary files based on the "includes" pattern.

dpbuddy is completely free; it can be downloaded from the dpbuddy product page

dpbuddy provides many cool features, including:

  • Response from the device is presented in a human-readable form as opposed to raw SOAP/XML messages. dpbuddy makes it easy to understand error and status messages.
  • Powerful remote "copy" command that automatically reproduces local directory tree on the device.
  • Tight integration with Ant. Ant variables can be used inside deployment policies and configuration files.
  • Easy-to-use alternative to deployment policies based on XPath.
  • Ability to remotely "tail" device logs. It is even possible to automatically get new log messages similarly to Unix "tail -f" command. "tail" task can also check for error patterns.
  • "Export" based on naming patterns. You don't need to know types ("classes") of DataPower objects; simply specify a regexp pattern and dpbuddy will export all objects matching this pattern.
  • Support for self-signed certificates. No need to add DataPower certificates to the JDK store.
  • Support for arbitrary SOMA requests. You can use Ant variables inside a request.
  • Parsing of all commands on the client. In case of XML errors, DataPower returns cryptic "internal error" message. The actual error then has to be extracted from the device logs. dpbuddy on the other hand validates management XML commands on the client and displays error messages right away.

Go to dpbuddy product page to learn more.

PAnt 2.0.1 is Released

PAnt 2.0.1 contains an important bug fix that was preventing using certain Ant tasks from python. Specifically, the bug affected all tasks that utilize addConfigured method to handle nested elements. This included the "manifest" task and several others.

You can download PAnt 2.0.1 from the PAnt project page

WebSphere 7 Business Level Applications

Application management, including deployment, has remained mostly unchanged since WAS 5.

WAS 7, however, introduced a new concept -- "Business Level Applications" (BLA). It would be more accurate to use the term "composite application" because this is what BLAs are -- it's a composition of Java EE applications (WARs or EARs) or other "assets".

Unfortunately, the term "composite application" is already used in a different context by IBM.

The word "asset" is another confusing and terribly overused term. In WAS7 it's a "catch all" word for any kind of artifact, including jar, zip, and, with the introduction of OSGi support, an OSGi bundle (you need to have a beta OSGI feature pack installed to be able to use OSGi).

BLAs are created by combining applications and assets together either using admin console or scripting. BLA configuration is saved under $profile_root/config/cells/$cell_name/blas. Assets are saved under $profile_root/config/cells/$cell_name/assets.

I can see two use cases for BLAs:

  • BLAs can be used to start and stop multiple Java EE applications at once. This might be useful if operationally several applications have to be treated together or if there are run-time dependencies between applications. This is especially the case if scripting is used; AdminTask.startBLA and AdminTask.startBLA provide an easy way to restart several "regular" applications.
  • BLAs can be used to manage shared libraries. There is no way to deploy "traditional" shared libraries ("Environment/Shared Libraries") using Deployment Manager; you have to use scp or ftp to copy binaries to target servers. With BLA you can simply import "assets" (e.g., a jar file) using AdminTask.importAsset command. You can then reference the jar file using "SharedLibRelationship" option of AdminApp install/update commands. This will automatically create a classloader for this library (note--this might require server restart, at least for me it did). Being able to use regular administration APIs for managing shared libraries is certainly a welcome feature.

Unfortunately, BLAs also have limitations:

  • I was not able to find a way to create an asset consisting of multiple jars. This severely limits the usefulness of utilizing BLAs for managing shared libraries since a library will almost always consist of multiple jars. It is possible to import jars individually, but this is tedious and difficult to manage.
  • It is not possible to deploy multiple Java EE applications using BLAs. You still have to deploy applications individually.
  • There is no support for version information in BLA assets. This is unfortunate. I wish IBM though about integrating BLA assets with Maven repositories and supporting true dependency management (e.g., version resolution, transitive dependencies, etc.). As of right now the only way to import multiple version of the same asset is to append a version number to the asset's file name.

To summarize, the BLA idea has some promise but its current implementation is too limited to be truly useful. I'm sure IBM will be evolving BLA in future WAS releases.

You can find more information about BLA in this article .

This post is part of the series on WebSphere Application Server administration. Please subscribe to our blog if you'd like to receive updates.

Note: We offer professional services in the area of WebSphere architecture, implementation and operations. If you're looking for help with any of these tasks, please let us know.

WebSphere Adminstration: Getting Started with WebSphere Application Server Scripting

If you're a WebSphere administrator or if you're trying to automate some tasks around the IBM WebSphere line of products, you'll inevitably be using WAS scripting (a.k.a. "wsadmin"). For the record, it is also possible to use Java and JMX-based APIs for automation, but it's is more complex and less documented. So "wsadmin" scripting tool is the primary tool of trade for any WebSphere administrator.

There are several things that you need to do in order to be successful with wsadmin:

  • Learn Python. Wsadmin uses Python as a language (JACL was deprecated a long time ago and should not be used) and relies on jython. Jython provides full implementation of Python language sans some libraries. Needless to say that good knowledge of Python is essential for developing wsadmin scripts. Most WebSphere admins have Java background. In my opinion (and speaking from personal experience), knowing Java does more harm than good for a Python developer. Java people usually speak Python "with accent" and have a hard time properly utilizing all python capabilities such as closures, list comprehensions and even modules and packages. It's no wonder, the two languages are very different. For example, in Java everything is a class and in most cases a class resides in its own file. In Python a module can encompass multiple classes and classes themselves are completely optional. Learning how to properly use modules and classes takes some mental shift.
  • Invest in designing your scripts. I'm not even sure if "scripting" is the right word to use in this context. Scripts are usually relatively simple. Wsadmin scripts are anything but. A seemingly simple task of application deployment may require many lines of code if you want to do it right. Unless you're really trying to do something unsophisticated (e.g., setting heap size), you'll be developing a full-blown python application. Therefore, you'll need to think about its design. Python has excellent support for modules. You'll have at least one module in your application. Do not put any logic into the "main" file that you'll be calling from wsadmin. Instead, define appropriate functions and classes in your modules and call them from the main file.
  • Invest in setting up your development environment. Notepad or vi are not going to cut it. Remember, Python lacks compiler, so the only way to find out if your code is even syntactically correct is to execute it. That is, unless you use an IDE, such as PyDev. The latest version of PyDev is very good at detecting syntax errors and many other issues, such as uninitialized variables. It also has very decent (for a dynamic language) code completion.
    You will also need to setup your wsadmin shell script to supply python path (using -javaoption "-Dpython.path=your_path"). Do not forget to put python libraries (the ones that come with jython) on the python path. I prefer using thin administration client as this is more flexible. I also use 2.2.1 version of jython since jython 2.1 that comes with wsadmin is just too old and misses a lot of important language features.
    Another practical piece of advice is to never use "wsadmin -f" to test your scripts. Wsadmin takes eternity to come up, so running it every time you want to run your scripts is simply counterproductive. Instead, load it once and then run your script using Python "execfile" function. Don't forget to call reload function for all modules that are part of your applications, otherwise you won't see the changes until your re-start wsadmin.
  • Help function is your best friend, so learn how to use it. I'm talking about the "help" function available for all key wsadmin modules (AdminConfig, AdminControl, etc). Wsadmin APIs, in my opinion, are poorly organized and difficult to learn. Ten thousand options available for AdminApp.install function is an example of that. Also, "lists of lists" data structures used by AdminTask and AdminApp are truly baffling. In any event, I usually run a separate wsadmin window that I use solely for consulting "help". This is much faster than searching for the same information in InfoCenter.
  • Finally, you will need a testing environment. You can do some development using a standalone WAS installation but eventually you'll need to test your code against a Network Deployment environment with deployment manager and, ideally, multiple servers and multiple nodes. In other words, your test environment should resemble the target environments where you're going to run your scripts. There are many things that are impossible to test with just a standalone profile, one such example is node synchronization.

This post is part of the series on WebSphere Application Server administration. Please subscribe to our blog if you'd like to receive updates.

Note: We offer professional services in the area of WebSphere architecture, implementation and operations. If you're looking for help with any of these tasks, please let us know.