RE: [users@httpd] Loading of Siteminder module at apache start

[Axel-Stéphane SMORGRAV <Axel-Stephane.SMORGRAV@xxxxxxxxxxxxxx>]

Title: Message

I have seen no such recommendation. From my understanding of the product support matrix, they support 1.3.33 with SMWA 5QMR6 and later.

 

Did the server work OK with 5QMR6?? Is the upgrade to QMR7 the only change you have made? Did you by any chance make changes to the SmHost.conf file? Is 5QMR7 for Apache 1.3 based on the new framework agent (with external LLAWP process)? If you disable the WebAgent (EnableWebAgent="NO" in WebAgent.conf), does the server start any faster? If you increase the LogLevel (LogLevel="3"), do you get any output in error_log or webagent_log? What is the CPU utilisation of the HTTP and Policy servers during the startup and intialisation (serving first page)?

 

From my experience with the framework agent with Apache 2.0 starting the server itself is pretty quick, but it does take a little time to serve the first page because that is when the LLAWP process is fired up and initialises. We are however only talking about a few seconds.

 

I would not call 12 minutes to serve the first page "a slight performance issue"... That's a LOT! This is what makes me think that your problem may be caused by some difficulties in setting up the communication with the Policy Server, e.g. DNS resolution involving timeouts, rather than internal system issues.

 

On Solaris you can use snoop to capture packets from one of the computer's interfaces and dump them into a file (snoop -o <filename> <IP address of remote server> port 44441 or port 44442 or port 44443) for subsequent analysis. If you use snoop also for the analysis, there are different timestamp options that may be useful: relative to the beginning of the capture, relative since last packet received and absolute. Read the man pages for details.

 

Browsing the traffic (especially if you are interested in the payload of the packets) is best done with other applications like Ethereal. Ethereal can import the files generated by snoop. I believe they are in tcpdump format.

 

-ascs

---

From: Ranjan, Prashant [mailto:Prashant.Ranjan@xxxxxxx]
Sent: Thursday, September 29, 2005 5:42 AM
To: users@xxxxxxxxxxxxxxxx
Subject: RE: [users@httpd] Loading of Siteminder module at apache start

Thanks ascs. Yes, I saw the CA support matrix and they recommend using siteminder version 5QMR6 instead of 5QMR7 for apache 1.3.33 on Solaris. I would get in touch with them regarding the same. Also it would be useful if you can let us know how to do a packet capture to examine what is exchanged between the two.

 

thanks,

Prashant