IBM Connections 5.0: Problems with Cognos reports

Issues:

Empty page in Community metrics reports

[codesyntax lang=”text”]

Error "SRVE0293E: [Servlet Error]-[icmetricsjobservice]: com.ibm.ws.webcontainer.webapp.WebAppErrorReport: Client Error SONATA: Internal Server Error @'http://host.example.com/cognos/icmetricsjobservice'

[/codesyntax]

[codesyntax lang=”text”]

RSV-CM-0005 Content Manager hat für den angeforderten Suchpfad /content/folder[@name='IBMConnectionsMetrics']/package[@name='Metrics']/folder[@name='global']/folder[@name='overview']/report[@name='main']' kein Objekt zurückgegeben.

[/codesyntax]

[codesyntax lang=”text”]

Failure RSV-CM-0005 Content Manager did not return an object for the requested search path /content/folder[@name='IBMConnectionsMetrics']/package[@name='Metrics']/folder[@name='global']/

[/codesyntax]

CM-REQ-4342 An error occurred with the client.

CM-REQ-4335 An error occurred while updating the object

CM-REQ-4341 You do not have adequate permissions to make this request

QE-DEF-0288 Unable to find the data source ‘METRICS_CUBE_DS’ in the content store.

 

Solution:

  1. Verified the password for the JC2 alias “cognosAdmin”
  2. In the Cognos Admin Console added “Anonymous” and “Everyone” to the “IBMConnectionsMetricsAdmin” role.
  3. Re-run “cognos-configure-update.sh”
  4. Changed “IBMConnectionsMetricsAdmin” role back so that only the Cognos admin is included in that role.
  5. Restarted the Cognos cluster
  6. Re-run a “build.all”
  7. —> Everything works again

Elektronischer Bilderrahmen

Nachdem meine Mutter sich immer wieder beschwert hat, dass mein Vater sie nicht informiert, wenn wir Bilder per Mail geschickt oder über Facebook gepostet haben (sie selber hat mit Technik nix am Hut und  nimmt keinen PC, Tablet etc. in die Hand :-)), haben wir ihr einen vor einiger Zeit einen elektronischen Bilderrahmen geschenkt.

Die Hauptanforderungen:

  • Man darf nichts “bedienen” müssen. Er muss irgendwo aufgestellt werden und dann einfach funktionieren.
  • Egal was passiert, er muss sich möglichst wieder selbständig “reparieren” (wenn doch jemand mal damit rumgespielt hat :-))
  • Mehrere Personen müssen über das Internet neue Bilder auf den Bilderrahmen senden können bzw. diese auch wieder löschen.

Früher gab es ja mal solche Bilderrahmen z.B. von Kodak. Mittlerweile scheint es keine fertigen Lösungen mehr zu geben. Aber wozu gibt es denn mittlerweile relative günstige Tablets?

Umgesetzt haben wir das Ganze mit einem Lenovo A7-50 17,8 cm (7 Zoll IPS) Tablet (der Preis ist leider mittlerweile von 89 auf 99 EUR gestiegen …)  sowie ein paar zusätzlichen Android-Apps:

Digitaler Fotorahmen Premium
https://play.google.com/store/apps/details?id=be.wyseur.photo.buy&hl=de

Das ist das Hauptprogramm, welches Bilder, die in einer Ordnerstruktur auf dem internen Speicher vorhanden sind, als Diashow darstellt.

DropSync
https://play.google.com/store/apps/details?id=com.ttxapps.dropsync&hl=de

Hiermit werden die Fotos regelmäßig vom Dropbox-Account auf den lokalen Speicher synchronisiert. Für alle Personen, die Bilder hochladen dürfen (z.B. wir, meine Schwester, meine Neffen …), habe ich einen eigenen Ordner auf Dropbox freigegeben, den die Person verwalten kann (Bilder hinzufügen und wieder löschen)

Llama
https://play.google.com/store/apps/details?id=com.kebab.Llama&hl=de

Von diesem Programm wird nur ein Bruchteil der Funktionalität genutzt. Aber damit konnte ich sicherstellen, dass der Bilderrahmen und DropboxSync automatisch gestartet werden sobald das Tablet neu bootet oder das Stromkabel angeschlossen wird.

Ultimate Rotation Control
https://play.google.com/store/apps/details?id=nl.fameit.rotate&hl=de

Dieses kleine Tool habe ich nachträglich noch mit eingebaut, um sicherzustellen, dass der Bilderrahmen immer im Querformat angezeigt wird, auch wenn man ihn in die Hand nimmt und versehentlich kippt.

Skype
https://play.google.com/store/apps/details?id=com.skype.raider
Skype haben wir zusätzlich noch mit installiert, damit wir mit ihr auch von unterwegs Videotelefonate führen können.

Das Tablet wird morgens automatisch hochgefahren und dabei die Bilderrahmen-App und DropSync automatisch gestartet. Die Bilderrahmen-App ist so konfiguriert, dass sie sofort damit beginnt, die Bilder anzuzeigen. Zu einer bestimmten Zeit, fährt das Tablet automatisch wieder komplett herunter. Im Hintergrund werden die Bilder aus der Dropbox regelmäßig lokal synchronisiert.

Sobald jemand versehentlich die App beendet oder in den Hintergrund stellt, reicht es aus, den Stromstecker kurz zu ziehen und wieder einzustecken. Dadurch wird der Bilderrahmen wieder gestartet bzw. in den Vordergrund geholt. Wenn jemand noch mehr kaputt machen sollte, sollte spätestens am nächsten Tag (nach dem Neustart des Tablet) wieder alles ok sein.

Ansonsten habe ich alles Icons außer dem Bilderrahmen vom Startscreen des Tablet verbannt, so dass man nicht versehentlich irgendwo anders draufklickt, wenn man mal mit dem Teil herumspielt.

Mittlerweile haben wir zusätzlich noch Skype aktiviert, damit wir sie auch von unterwegs aus mit Video anrufen können. Wenn ein Anruf kommt, kommt Skype automatisch in den Vordergrund und sie muss nur den Ruf annehmen. Wenn wir wieder auflegen, kommt automatisch wieder der Bilderrahmen in den Vordergrund.

Ich hatte zuerst ein wenig bedenken, ob meine Mutter nicht von vorneherein den Bilderrahmen ablehnt, weil halt doch “technisches Spielzeug”. Aber ich wurde positiv überrascht. Sie freut sich immer, wenn wir von unterwegs neue Bilder von uns schicken. Und lässt niemanden ran, damit auch nix kaputt geht :-))

Bislang funktioniert auch alles einwandfrei, es gab noch keinen Erste Hilfe-Einsatz weil die Bilder nicht mehr dargestellt wurden. Und in der Zwischenzeit haben wir sogar noch ein zweites Exemplar bei Sabines Eltern im Einsatz …

Cognos (IBM Connections ): security.authz.AccessException

When accessing the Metrics application first time after login, an com.ibm.websphere.wim.security.authz.AccessException is thrown for each user in SystemOut.log of the Cognos server. The exception is thrown when accessing “Global Metrics” (using an authorized user) as well as “Community Metrics” (using any community owner). The functionality of Metrics application seems to be not affected negatively.

Exception trace looks like:

[codesyntax lang="text"]
[05/10/15 14:35:03:273 UTC] 00000210 exception E com.ibm.websphere.wim.security.authz.AccessException CWWIM2008E The principal 'cn=xxx,ou=xxx,ou=xxx,ou=xxx,o=xxx' is not authorized to perform the operation 'GET PersonAccount' on 'cn=xxx,ou=xxx,ou=xxx,ou=xxx,o=xxx'
[05/10/15 14:35:03:274 UTC] 00000210 exception E com.ibm.websphere.wim.security.authz.AccessException com.ibm.websphere.wim.security.authz.AccessException: CWWIM2008E The principal cn=xxx,ou=xxx,ou=xxx,ou=xxx,o=xxx' is not authorized to perform the operation 'GET PersonAccount' on 'cn=xxx,ou=xxx,ou=xxx,ou=xxx,o=xxx'
at com.ibm.ws.wim.env.was.JACCAuthorizationService.checkAccessResult(JACCAuthorizationService.java:1320)
at com.ibm.ws.wim.env.was.JACCAuthorizationService.checkPermission_GET(JACCAuthorizationService.java:578)
at com.ibm.ws.wim.security.authz.ProfileSecurityManager.checkPermission_GET(ProfileSecurityManager.java:188)
at com.ibm.ws.wim.ProfileManager.getImpl(ProfileManager.java:1860)
at com.ibm.ws.wim.ProfileManager.genericProfileManagerMethod(ProfileManager.java:365)
at com.ibm.ws.wim.ProfileManager.get(ProfileManager.java:418)
at com.ibm.websphere.wim.ServiceProvider.get(ServiceProvider.java:410)
at com.ibm.websphere.wim.client.LocalServiceProvider.get(LocalServiceProvider.java:364)
at com.ibm.tivoli.reporting.advanced.cognos.auth.service.AdminProvider$2.run(AdminProvider.java:343)
at com.ibm.tivoli.reporting.advanced.cognos.auth.service.AdminProvider$2.run(AdminProvider.java:339)
at java.security.AccessController.doPrivileged(AccessController.java:373)
at javax.security.auth.Subject.doAs(Subject.java:573)
at com.ibm.websphere.security.auth.WSSubject.doAs(WSSubject.java:195)
at com.ibm.websphere.security.auth.WSSubject.doAs(WSSubject.java:152)
at com.ibm.tivoli.reporting.advanced.cognos.auth.service.AdminProvider.get(AdminProvider.java:339)
at com.ibm.tivoli.reporting.advanced.cognos.auth.service.AdminProvider.getUserGroups(AdminProvider.java:106)
[/codesyntax]

This exception is raised if a user, who has no administrator rights in Websphere, is accessing Cognos metrics.

The following steps had solved the problem here:

On Deployment Manager:

[codesyntax lang=”bash”]

cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin 
./wsadmin.sh -lang jacl -username <wasadmin> -password <wasadmin password>

[/codesyntax]

On WSADMIN prompt:

[codesyntax lang=”python”]

$AdminTask mapIdMgrGroupToRole {-roleName IdMgrReader -groupId ALLAUTHENTICATED} 
$AdminConfig save 
exit

[/codesyntax]

Full Sync of all nodes

Stop and restart Cognos Server

For testing:

Login to eteaming as a normal user (not part of the Metrics Admin Group)

Open Metrics link in a Community

Check SystemOut.log of Cognos server and verify that the error message no longer appears.

Google kicked me out of the index …

Since the beginning of October Google seems to have kicked me out of their index. At least most pages, including the startpage, are no longer listed. To be honest I have no glue what has happened. I do not see any issues in the Google Webmaster Tools Dashboard. It seems that they are crawling my pages correctly but do not index most of them.

I have now removed some of my WordPress plugins which might have had an influence but I am still unsure if I found the root cause.

So if you are relying on Google to find new content on my pages, I recommend to directly call my page from time to time to make sure that you do not miss anything.

In the meantime I can only wait and hope that Google will add my pages again after some weeks.

Update 28.10.2015:

Just realized that SSLv3 was active again in my SSL configuration. No idea when that happened. So maybe that was why Google banned my site (which is HTTPS only) from the index. Corrected that now, and I get an A+ grade again from SSLLabs 🙂

IBM Connections Cognos: build-all.bat failed after migrating from Connections 4.5 CR5 to 5.0 CR2

Customer upgraded Connections from 4.5 CR5 to 5.0 CR2 and also introduced Cognos with the new environment. After migrating the data I tried to run the “build-all.bat” script to recreate all cube data. However that script failed without any meaningful error message.

I then ran the “config-installation-verify.bat” script and I got a failed message for the Transformer component. This time I got the following error in the transformer verify log:

[codesyntax lang=”text”]

Tue 30 Jun 2015 4:54:41 PM 4 000042AB Timing, OPEN DATA SOURCE,00:00:00
Tue 30 Jun 2015 4:54:41 PM 2 00000161 (TR2317) The level 'COMMUNITY NAME' is designated as unique. Source value '10025' was used in an attempt to create a category in the path ( By COMMUNITY_ID,f,3~798,( Blank )~799,( Blank )~800,( Blank )~801,( Blank )~802,10025 ). '10025' already exists in level 'COMMUNITY NAME' in the path ( By COMMUNITY_ID,9,9~1,( Blank ),( Blank )~2,( Blank )~3,( Blank )~4,10025 ). [->OK]
Tue 30 Jun 2015 4:54:41 PM 2 000042AB (TR2318) Transformer has detected 1 attempts to create a category in more than one path. Refer to the online help for a detailed explanation of level uniqueness. [->OK]
Tue 30 Jun 2015 4:54:41 PM 4 000042AB End processing 4447 records from data source 'D_COMMUNITY~1'.
Tue 30 Jun 2015 4:54:41 PM 4 000042AB Timing, READ DATA SOURCE,00:00:00
Tue 30 Jun 2015 4:54:42 PM 4 000042AB End cube update.
Tue 30 Jun 2015 4:54:42 PM 4 000042AB Timing, TOTAL TIME (CREATE CUBE),00:00:02
Tue 30 Jun 2015 4:54:42 PM 2 000042AB (TR0136) A uniqueness violation was detected. The process has been aborted. [->OK]
Transformer Tue Jun 30 16:54:42 2015

[/codesyntax]

This seemed to be a problem which was already introduced after upgrading 4.5 CR4 to CR5 but was not visible because the customer did not have installed Cognos in the old 4.5 environment.

To solve the issue we run a “cognos-configure-update.bat” (make sure the “cognos-setup.properties” contains the correct uernames and passwords for the database uses).  After that the “build-all.bat” script  was running sccessfully.

IBM Connections: Disable IBM Connections Content Manager (CCM)

A customer wanted to temporarily disable the already installed IBM Connections Content Manager (CCM) component. Here are the steps to do that:

  • On Deployment Manager, start WSADMIN client:cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin
    ./wsadmin.sh -lang jython -user _websphere_admin user_ -password _password of wasadmin user_
  • Run the following commands on theWSADMIN console to checkout the LCC configuration file:execfile(“connectionsConfig.py”)
    LCConfigService.checkOutConfig(“/tmp”, AdminControl.getCell())
  • Disable the IBM Content Manager application by running the following commands on theWSADMIN console:LCConfigService.updateConfig(“ecm_files.enabled”, “false”)
    LCConfigService.updateConfig(“ecm_files.ssl.enabled”, “false”)
  • Check in the LCC configuration file again, synchronize all nodes and leave theWSADMIN prompt:LCConfigService.checkInConfig()
    synchAllNodes()
    exit
  • Restart all Connections clusters
  • If you want to enable the applications later again, use the same commands but change the value “false” to “true”.

After I did that, I sawe the following error messages in the SystemOut.log of the server where CCM was installed:

[codesyntax lang=”text”]

[27/03/15 18:01:00:839 CET] 00000123 LifecycleEven I com.ibm.lconn.widgets.service.LifecycleEventReplayService retryQueuedEvents **** LifecycleEventReplayService:retryQueuedEvents:eventId=Wea8ba9f64b9d_41bc_b5d0_604875312e00:index=2:excluding:managedAppDefId=Library:onResource=c7732496-94f2-4ee0-afdf-944f5a707893
[27/03/15 18:01:00:851 CET] 00000123 EventPropagat E com.ibm.lconn.widgets.service.EventPropagater postRemoteEvent CLFWZ0003E: Failed to post event notification to remote widget application handler ([Missing: ecm_filesInterSvcRef]/atom/communities/feed): Invalid uri '[Missing: ecm_filesInterSvcRef]/atom/communities/feed': incorrect scheme
                                 java.lang.IllegalArgumentException: Invalid uri '[Missing: ecm_filesInterSvcRef]/atom/communities/feed': incorrect scheme

[/codesyntax]

The reason for that was, that there were still some unprocessed notification events in the queue which could no longer processed as the application has been disabled. To remove these events I ran the following commands:

  • On Deployment Manager, startWSADMIN client:cd /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin
    ./wsadmin.sh -lang jython -user _websphere_admin user_ -password _password of wasadmin user_
  • Run the following commands on theWSADMIN console:execfile(“communitiesAdmin.py”)
    CommunitiesQEventService.clearQueuedEventsByRemoteAppDefId(“Library”)
  • The command returns the number of cleared events.

Now the error message should no longer be displayed.

Installing TDI 7.1.1 on Windows Server 2012

If you try to install IBM Tivoli Directory Integrator (TDI) V7.1.1 on Windows 2012 Server you might see the following error message:

[codesyntax lang=”text”]

ZeroGu2: Windows DLL failed to load
at ZeroGa2.b(DashoA10*..)
at ZeroGa2.b(DashoA10*..)
at com.zerog.ia.installer.LifeCycleManager.b(DashoA10*..)
at com.zerog.ia.installer.LifeCycleManager.a(DashoA10*..)
at com.zerog.ia.installer.Main.main(DashoA10*..)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.zerog.lax.LAX.launch(DashoA10*..)
at com.zerog.lax.LAX.main(DashoA10*..)

[/codesyntax]

To solve that problem, change the compatibility mode  in the properties of the installer exe file to “Windows 7” and try again.

Thanks to Mikkel  😉

IBM Connections 5.0 CR2: Upgrade of Filenet Content Engine Server fails

The upgrade of the Filenet Content Engine Server component for IBM Connections CR2 on Windows machines failed for two customers now. The command ‘update-ce.bat -was.dm.path “D:\IBM\WebSphere\AppServer\profiles\Dmgr01” -was.admin.user wasadmin -was.admin.password password -ce.fp.installer.location “D:\INSTALL\CCMFIXCR2\5.2.1-P8CPE-WIN.EXE”‘ failed always with the message “Error: Please read the log for detail of the problem, it is D:\IBM\Connections\ccm\ccm\ccm\scripts\fn-ce-update.log”.

If you look into the mentioned log you see that the deployment of the FileNetEngine application was successful. There is no hint why the procedure failed in the end.

I just ignored the error and went on with the next steps. I did not notice any problems and you will re-deploy a newer version manually as the last step anyway … On Linux I never noticed that problem, so it seems to be something Windows specific.

By the way: A detailed instruction for upgrading COnnections 5.0 to CR2 can be found here. If you install on Windows make sure that you use a blank as separator instead of “=” (equal sign) for the Filenet upgrade procedures (e.g. use “-was.admin.user wasadmin” instead of “-was.admin.user=wasadmin”)

 

IBM Connections Cognos: Problem with SSL Certificates

If you want to configure Cognos for IBM Connections to use SSL you need to import the HTTP server certificate and all of the certificates in the certificate chain as described in this chapter. However, after I did that Cognos was not working. The import as successful and there was no error message.

If you have a similar problem, just open the certificate store (“(_transformer_install_dir_)/signkeypair”) with the iKeyman utility (as type of keyfile use “PKCS12”).

You should find all certificates (the server certificate of your web server and all signer certificates in the chain up to the root) in that keystore. If one or more of them are missing (which was the case for me even after the “successful” import) just add it with the iKeyman utility.

After restarting the servers everything should then work correctly.