Tuesday, 29 March 2016

Migrating a Configuration from WebSphere to Jboss EAP by using BMC MIDDLEWARE AUTOMATION TOOL 8.7

We can migrate a Configuration from the IBM WebSphere (full profile) application server to Red Hat JBoss Enterprise Application Platform (JBoss EAP) application server. Currently, the migration is supported for the following versions:

  • WebSphere (full profile) versions 7/8/8.5 to JBoss EAP version 6.3
Migration of Configuration without application exporting
  • Start WebSphere (full profile) version 7.0/8.0/8.5 application server.
  • Start BMC MIddleware Automation version 8.6.
  • Create a Snapshot of the current WebSphere Configuration.
  • Ensure that the WebSphere Configuration Snapshot contains application elements.
  • Right-click the created Snapshot and select Migrate Configuration.
  • In the Migrate Configuration dialog, click the ‘…’ button next to Source Server Profile, and select the server profile of your source WebSphere application server.
  • From the Target Application Server list, select JBoss EAP 6.3.
  • Clear the Export applications check box, and then click Next.
  • Enter the name for the migrated Configuration, and click Next.
  • Select the Node(s) migration migration mode, and click Next. The Nodes filter screen displays. 
  • Select the nodes you want to migrate, or selects the Migrate all nodes check box, and click Next. The Servers filter screen, that lists all servers that belongs to the selected on previous screen clusters displays. If you did not select any clusters, then the complete list of node servers displays. 
  • Select the servers you want to migrate, or selects the Migrate all servers check box, and click Next. The Applications filter screen, that lists all the applications that belongs to selected servers displays. 
  • Select the applications that you want to migrate, or selects the Migrate all applications check box, and then click Next. The Summary screen, that contains information about configuration, selected nodes, servers, applications etc displays.
  • Click Finish. The transformation process is started. Status view displays the migration log output.
Post-migration configuration

The migrated Configuration is created. It contains the application elements that use tokens as values for the sourcePath attribute. You can view all the information about preconditions, transformations and tokens create during migration in the Migration report.
To finalize the migration, follow the next steps: 
  • Open the target JBoss EAP version 6.3 Configuration and de-tokenize it.
  • Install the Configuration on the JBoss EAP 6.3. 
Migration of Configuration with application exporting
  • Start WebSphere (full profile) version 7.0/8.0/8.5 application server.
  • Start BMC MIddleware Automation version 8.6.
  • Create a Snapshot of the current WebSphere Configuration.
  • Ensure that the WebSphere Configuration Snapshot contains application elements.
  • Right-click the created Snapshot and select Migrate Configuration.
  • In the Migrate Configuration dialog, click the ‘…’ button next to Source Server Profile, and select the server profile of your source WebSphere application server.
  • From the Target Application Server list, select JBoss EAP 6.3.
  • Select the Export applications check box, and then click Next.
  • Enter the name for the migrated Configuration, and click Next.
  • Select the Node(s) migration migration mode, and click Next. The Nodes filter screen displays. 
  • Select the nodes you want to migrate, or selects the Migrate all nodes check box, and click Next. The Servers filter screen, that lists all servers that belongs to the selected on previous screen clusters displays. If you did not select any clusters, then the complete list of node servers displays.
  • Select the servers you want to migrate, or selects the Migrate all servers check box, and click Next. The Applications filter screen, that lists all the applications that belongs to selected servers displays. 
  • Select the applications that you want to migrate, or selects the Migrate all applications check box, and then click Next. The Summary screen, that contains information about configuration, selected nodes, servers, applications etc displays.
  • Click Finish. The transformation process is started. Status view displays the migration log output.
Post-migration configuration

All the applications from the source Configuration that were selected during filtering are exported to the migrated configuration folder (migration folder). The migrated Configuration is created, and it contains application elements that use the paths to the exported applications in the migration folder as values for the sourcePath attribute. You can view all the information about preconditions, transformations and tokens create during migration in the Migration report.
  • To finalize the migration, follow the next steps: 
  • Open the target JBoss EAP version 6.3 Configuration and de-tokenize it.
  • Install the Configuration on the JBoss EAP 6.3.
Migration of custom Configuration templates

You can migrate the packaged Config template that contains resources needed by your application. For example: JDBS providers, JMS providers, Mails sessions, etc.
  • Right-click the created packaged Configuration template and select Migrate Configuration.
  • In the Migrate Configuration dialog, click the ‘…’ button next to Source Server Profile, and select the server profile of your source WebSphere application server.
  • From the Target Application Server list, select JBoss EAP 6.3.
  • Enter the name for the migrated Configuration, and click Next.
  • Select the Packaged Configuration migration mode, and click Next. The Summary screen displays.
  • Click Finish. The transformation process is started. Status view displays the migration log output.
Post-migration configuration
  • To finalize the migration, follow the next steps: 
  • Open the target JBoss EAP version 6.3 Configuration and de-tokenize it.
  • Install the Configuration on the JBoss EAP 6.3.

Difference between JBOSS & WAS & WEBLOGIC

JBOSS 6 V/S JBOSS 7

JBoss 6  
JBoss 7
JBoss 6 provided an unofficial implementation to Java EE 6. JBoss 7 provides an official implementation to Java EE 6.
JBoss 6 does not have a Modular Service Container. JBoss 7 has a Modular Service Container.
JBoss 6 does not have a Centralized command line tool. JBoss 7 has a Command Line tool.
JBoss 6 has Jar files in their application for deployment. JBoss 7 does not have Jar files but it has a modular design, which makes the deployment easier
JBOSS V/S WAS
JBoss WebSphere
JBoss supports limited protocols. WebSphere supports HTTP, FTP, SSL protocols.
JBoss is an Open source Java EE application server. WebSphere is a commercial web application server.
JBoss is a Java based application. WebSphere is not written using pure java.
JBOSS V/S WEBLOGIC

JBoss Weblogic
JBoss is an application server developed by JBoss company. Weblogic is an application server developed by BEA.
JBoss is a freeware or open source product. WebLogic is not an open source product. It is available for use only after procuring the license.
JBoss does not have a self console. It always depends on Tomcat. Weblogic has the self console 7001 which helps the user to change the console setting as per the requirement.
JBoss does not have a web administration console. Weblogic offers web based administration console that helps in configuration of data sources, JMS queues, and security realms.
The admin console is not part of JBoss installation. The admin console JON has to be installed separately. The admin console is available as part of Weblogic installation.
JBoss application server does not provide servlet-api implementation. It depends on Tomcat for the same. Weblogic application server provides its own servlet-api implementation.
The unused services can be removed from JBoss. The unused services cannot be removed from the Weblogic.
JBoss does not offer JMS Clustering. Weblogic provides JMS Clustering.
Database connectivity is established in JBoss using jca-jdbc wrappers. Database connectivity is established in Weblogic using JDBC API.

Monday, 14 March 2016

OPEN SSL COMMANDS

Create, Manage & Convert SSL Certificates with OpenSSL
One of the most popular commands in SSL to create, convert, manage the SSL Certificates is openssl.
There will be many situations where you have to deal with openssl in various ways and here I have listed them for you as a handy cheatsheet.
Some of the abbreviations related to certificates.
SSL – Secure Socket Layer
CSR – Certificate Signing Request
TLS – Transport Layer Security
PEM – Privacy Enhanced Mail
DER – Distinguished Encoding Rules
SHA – Secure Hash Algorithm
PKCS – Public-Key Cryptography Standards
1. Create new Private Key and Certificate Signing Request
openssl req -out geekflare.csr -newkey rsa:2048 -nodes -keyout geekflare.key
Above command will generate csr and 2048-bit RSA key file. If you intend to use this certificate in Apache
or nginx then you need to send this csr file to certificate issuer authority and they will give you signed
certificate mostly in der or pem format which you need to configure in Apache or nginx web server.
2. Create Self-Signed Certificate
openssl req -x509 -sha256 -nodes -newkey rsa:2048 -keyout gfselfsigned.key -
out gfcert.pem
Above command will generate self-signed certificate and key file with 2048-bit RSA. I have also included
sha256 as it’s considered most secure at the moment.
Tip: by default it will generate self-signed certificate valid for only one month so you may consider
defining –days parameter to extend the validity.
Ex: to have self-signed valid for 2 years.
openssl req -x509 -sha256 -nodes -days 730 -newkey rsa:2048 -keyout
gfselfsigned.key -out gfcert.pem
3. Verify CSR file
openssl req -noout -text -in geekflare.csr
Verification is important to ensure you are sending CSR to issuer authority with required details.
4. Create RSA Private Key
openssl genrsa -out private.key 2048
If you just need to generate RSA private key, you can use above command. I have included 2048 for
stronger encryption.
5. Remove Passphrase from Key
openssl rsa -in certkey.key -out nopassphrase.key
If you are using passphrase in key file and using Apache then every time you start, you have to enter the
password. If you are annoyed with entering password then you can use above openssl rsa -in geekflare.key
-checkto remove the passphrase key from existing key.
6. Verify Private Key
openssl rsa -in certkey.key –check
If you doubt on your key file, you can use above command to check.
7. Verify Certificate File
openssl x509 -in certfile.pem -text –noout
If you would like to validate certificate data like CN, OU, etc then you can use above command which will
give you certificate details.
8. Verify the Certificate Signer Authority
openssl x509 -in certfile.pem -noout -issuer -issuer_hash
Certificate issuer authority signs every certificate and in case you need to check them, you can use above
command.
9. Check Hash Value of A Certificate
openssl x509 -noout -hash -in bestflare.pem
10. Convert DER to PEM format
openssl x509 –inform der –in sslcert.der –out sslcert.pem
Usually certificate authority will give you ssl cert in .der format and if you need to use them in apache or
.pem format, you can use above command to convert them.
11. Convert PEM to DER format
openssl x509 –outform der –in sslcert.pem –out sslcert.der
In case you need to change .pem format to .der
12. Convert Certificate and Private Key to PKCS#12 format
openssl pkcs12 –export –out sslcert.pfx –inkey key.pem –in sslcert.pem
If you need to use cert with java application or with any other who accept only PKCS#12 format, you can
use above command, which will generate single pfx containing certificate & key file.
Tip: you can also include chain certificate by passing –chain as below.
openssl pkcs12 –export –out sslcert.pfx –inkey key.pem –in sslcert.pem -chain
cacert.pem
13. Create CSR using existing private key
openssl req –out certificate.csr –key existing.key –new
If you don’t want to create a new private key instead using existing one, you can with above command.
14. Check contents of PKCS12 format cert
openssl pkcs12 –info –nodes –in cert.p12
PKCS12 is binary format so you won’t be able to view the content in notepad or other editor. So you got to
use above command to view the contents of PKCS12 format file.
15. Convert PKCS12 format to PEM certificate
openssl pkcs12 –in cert.p12 –out cert.pem
If you wish to use existing pkcs12 format with Apache or just in pem format, this will be useful.
16. Test SSL certificate of particular URL
openssl s_client -connect yoururl.com:443 –showcerts
I use this quite often to validate the SSL certificate of particular URL from the server. This is very handy to
validate the protocol, cipher, and cert details.
17. Find out OpenSSL version
openssl version
If you are responsible to ensure OpenSSL is secure then probably one of the first thing you got to do is to
verify the version.
19. Check PEM File Certificate Expiration Date
openssl x509 -noout -in certificate.pem -dates
Useful if you are planning to put some kind of monitoring to check the validity. It will show you date in
notBefore and notAfter syntax. notAfter is one you will have to verify to confirm if certificate is expired or
still valid.
Ex:
[root@Chandan opt]# openssl x509 -noout -in bestflare.pem -dates
notBefore=Jul 4 14:02:45 2015 GMT
notAfter=Aug 4 09:46:42 2015 GMT
[root@Chandan opt]#
19. Check Certificate Expiration Date of SSL URL
openssl s_client -connect secureurl.com:443 2>/dev/null | openssl x509 -noout
–enddate
Another useful if you are planning to monitor SSL cert expiration date remotely or particular URL.
Ex:
[root@Chandan opt]# openssl s_client -connect google.com:443 2>/dev/null |
openssl x509 -noout -enddate
notAfter=Dec 8 00:00:00 2015 GMT
20. Check if SSL V2 or V3 is accepted on URL
To check SSL V2
openssl s_client -connect secureurl.com:443 -ssl2
To Check SSL V3
openssl s_client -connect secureurl.com:443 –ssl3
To Check TLS 1.0
openssl s_client -connect secureurl.com:443 –tls1
To Check TLS 1.1
openssl s_client -connect secureurl.com:443 –tls1_1
To Check TLS 1.2
openssl s_client -connect secureurl.com:443 –tls1_2
If you are securing web server and need to validate if SSL V2/V3 is enabled or not, you can use above command. If enabled, you will get “CONNECTED” else “handshake failure”
21. Verify if particular cipher is accepted on URL
openssl s_client -cipher 'ECDHE-ECDSA-AES256-SHA' -connect secureurl:443
If you are working on security findings and pen test results shows some of the weak cipher is accepted
then to validate, you can use above command. Off course you will have to change the cipher and URL,
which you want to test against.
If mentioned cipher is accepted then you will get “CONNECTED” else “handshake failure”.

Applying a WebSphere 7 Fixpac

Install the latest UpdateInstaller once on a machine, then use that to install any updates (fix packs, refresh packs) to WAS, IHS and Plug-in
1. Download Websphere UpdateInstaller from the official IBM Site
http://www-01.ibm.com/support/docview.wss?uid=swg24020212
2. Extract the installer
[websphe@middleware updatetemp]$ unzip 7.0.0.29-WS-UPDI-LinuxIA32.zip
[websphe@middleware updatetemp]$ cd UpdateInstaller/
[websphe@middleware UpdateInstaller]$ ls -ltr
-rw-r--r--  1 websphe dba      183 May 26  2013 version.txt
-rwxr-xr-x  1 websphe dba    13123 May 26  2013 install
drwxr-xr-x  2 websphe dba     4096 May 26  2013 framework
-rw-r--r--  1 websphe dba 18961789 May 26  2013 updi.updi.pak
drwxr-xr-x  3 websphe dba     4096 May 26  2013 updi.primary.pak
-rw-r--r--  1 websphe dba 14075908 May 26  2013 setup.jar
-rwxr-xr-x  1 websphe dba     1120 May 26  2013 relabel_java.sh
drwxr-xr-x  2 websphe dba     4096 May 26  2013 panels
drwxr-xr-x  2 websphe dba     4096 May 26  2013 lib
drwxr-xr-x  2 websphe dba     4096 May 26  2013 lafiles
-rw-r--r--  1 websphe dba     6866 Nov 20 23:11 responsefile.updiinstaller.txt
 3. Customize that response file parameters according to your environment.
You can find the original response file (responsefile.updiinstaller.txt) inside UpdateInstaller folder in update setup. Take a backup of that file and open and edit the response file parameters according to your environment. The minimum lines required for installing UpdateInstaller are given below.
-OPT silentInstallLicenseAcceptance="true"
 -OPT allowNonRootSilentInstall="true"
 -OPT installLocation="/u05/local/opt/was/was70/UpdateInstaller"
4. Execute that response file by using a command
syntax :: install -options responsefile.updiinstaller.txt -silent
[websphe@middleware UpdateInstaller]$ ./install -options /home/websphe/Desktop/was70/updates/updatetemp/UpdateInstaller/responsefile.updiinstaller.txt -silent
5. verify the installation
Check for a message INSTCONFSUCCESS in a log file called updateconfig.log if the installation is completed successfully. the updateconfig.log located in /WAS_HOME/ logs/update/install
[websphe@middleware update]$ pwd
/u05/local/opt/was/was70/logs/update
[websphe@middleware update]$ ls -ltr
total 24
-rwxrwxrwx 1 websphe dba 8570 Nov 20 21:10 updateconfig.log
-rwxrwxrwx 1 websphe dba 8598 Nov 20 21:10 updateconfigCIM.log
 INSTCONFSUCCESS message in updateconfig.log as below.
<message>Returning with return code: INSTCONFSUCCESS</message>
UpdateInstaller has installed successfully, now you can apply fix packs/refresh packs to WAS , IHS or plug-in.
Apply a fix-pack to WAS
1.  Check the current version of WebSphere by using ‘versioninfo.sh’
/WAS_HOME/bin/versionInfo.sh
[websphe@middleware bin]$ ./versionInfo.sh
WVER0010I: Copyright (c) IBM Corporation 2002, 2005, 2008; All rights reserved.
WVER0012I: VersionInfo reporter version 1.15.1.26, dated 8/9/08
--------------------------------------------------------------------------------
IBM WebSphere Application Server Product Installation Status Report
--------------------------------------------------------------------------------
Report at date and time November 20, 2015 11:19:53 PM PST
Installation
--------------------------------------------------------------------------------
Product Directory        /u05/local/opt/was/was70
Version Directory        /u05/local/opt/was/was70/properties/version
DTD Directory            /u05/local/opt/was/was70/properties/version/dtd
Log Directory            /u05/local/opt/was/was70/logs
Backup Directory         /u05/local/opt/was/was70/properties/version/nif/backup
TMP Directory            /tmp
Product List
--------------------------------------------------------------------------------
ND                       installed
Installed Product
--------------------------------------------------------------------------------
Name                     IBM WebSphere Application Server - ND
Version                  7.0.0.0
ID                       ND
Build Level              r0835.03
Build Date               8/31/08
Architecture             Intel (32 bit)
--------------------------------------------------------------------------------
End Installation Status Report
--------------------------------------------------------------------------------
2.  Stop all process that users installations
like dmgr , nodes and applications servers
3. Make sure the .pak file is available under maintenance directory.
[websphe@middleware maintenance]$ pwd
/u05/local/opt/was/was70/UpdateInstaller/maintenance
[websphe@middleware maintenance]$ ls -ltr
-rw-r--r-- 1 websphe dba 718834707 Nov 20 23:21 7.0.0-WS-WAS-LinuxX32-FP0000029.pak
-rw-r--r-- 1 websphe dba  84327167 Nov 20 23:21 7.0.0-WS-WASSDK-LinuxX32-FP0000029.pak
4. Customize the response file parameters
[websphe@middleware maintenance]$ cd /u05/local/opt/was/was70/UpdateInstaller/responsefiles/
[websphe@middleware responsefiles]$ ls -ltr
-rwxr-xr-x 1 websphe dba 3064 Nov 20 23:11 uninstall.txt
-rwxr-xr-x 1 websphe dba 4275 Nov 20 23:11 install.txt
You can find the original response file (install.txt) inside responsefiles folder in UpdateInstaller. Take a backup of that file and open and edit the response file parameters according to your requirement . The minimum lines required for installing UpdateInstaller are given below.
 -OPT checkFilePermissions="true"
-W maintenance.package="/u05/local/opt/was/was70/UpdateInstaller/maintenance"
(This parameter specify a full folder name that contains the maintenance packages)
-OPT rootUserHasRunSlibcleanCommandSuccessfully="true"
-W product.location="/u05/local/opt/was/was70"
-W update.type="install"
5. Execute update execute file
[websphe@middleware UpdateInstaller]$ ./update.sh  -options=/u05/local/opt/was/was70/UpdateInstaller/responsefiles/install.txt -silent
Executing command: /u05/local/opt/was/was70/UpdateInstaller/java/jre/bin/java -cp /u05/local/opt/was/was70/UpdateInstaller/update.jar -Xms48m -Xmx384m run -options /u05/local/opt/was/was70/UpdateInstaller/responsefiles/install.txt -silent
Check the installation status of fix pack or refresh pack in a log file named by log.txt.
If the installation is success we will get a message “INSTCONFSUCCESS”
[websphe@middleware install]$ pwd
/u05/local/opt/was/was70/UpdateInstaller/logs/install
[websphe@middleware install]$ ls -ltr
total 96
-rw-r--r-- 1 websphe dba  4034 Nov 20 23:11 trace.xml.gz
-rw-r--r-- 1 websphe dba  2457 Nov 20 23:11 trace.txt.gz
-rw-r--r-- 1 websphe dba    26 Nov 20 23:11 relabel.stdout.gz
-rw-r--r-- 1 websphe dba    26 Nov 20 23:11 relabel.stderr.gz
-rw-r--r-- 1 websphe dba 17207 Nov 20 23:11 log.txt
-rw-r--r-- 1 websphe dba 56032 Nov 20 23:11 installconfig.log.gz
[websphe@middleware install]$ view log.txt
 ------------------------------------
--------------------------------
(Nov 20, 2015 11:11:57 PM), Install, com.ibm.ws.install.ni.ismp.actions.InstallNIFPackage, msg1, Running configuration command: 90SCreateEmptyUPDIDirs, percent complete: 100%
(Nov 20, 2015 11:11:58 PM), Install, com.ibm.ws.install.ni.ismp.actions.SettleNIFRegistryAction, msg1, Current install/uninstall process is successful. Process type is: install
(Nov 20, 2015 11:11:58 PM), Install, com.ibm.ws.install.ni.ismp.actions.SetExitCodeAction, msg1, CWUPI0000I: EXITCODE=0
(Nov 20, 2015 11:11:58 PM), Install, com.ibm.ws.install.ni.ismp.actions.ISMPLogSuccessMessageAction, msg1, INSTCONFSUCCESS
Now check the current version of WAS, and start your process
[websphe@middleware bin]$ ./versionInfo.sh
WVER0010I: Copyright (c) IBM Corporation 2002, 2005, 2008; All rights reserved.
WVER0012I: VersionInfo reporter version 1.15.5.1, dated 6/15/11
-------------------------------------------------------------------------------
IBM WebSphere Application Server Product Installation Status Report
--------------------------------------------------------------------------------
Report at date and time November 20, 2015 11:43:28 PM PST
Installation
--------------------------------------------------------------------------------
Product Directory        /u05/local/opt/was/was70
Version Directory        /u05/local/opt/was/was70/properties/version
DTD Directory            /u05/local/opt/was/was70/properties/version/dtd
Log Directory            /u05/local/opt/was/was70/logs
Backup Directory         /u05/local/opt/was/was70/properties/version/nif/backup
TMP Directory            /tmp
Product List
--------------------------------------------------------------------------------
ND                       installed
Installed Product
--------------------------------------------------------------------------------
Name                     IBM WebSphere Application Server - ND
Version                  7.0.0.29
ID                       ND
Build Level              cf291321.01
Build Date               5/26/13
Architecture             Intel (32 bit)
--------------------------------------------------------------------------------
End Installation Status Report
--------------------------------------------------------------------------------
[websphe@middleware bin]$
*******************************************************************

SAMPLE INSTALL.TXT FOR FIX PACK UPDATE :

#########################################################
# This is the silent install response file for
# installing maintenance packages using the update
# installer.
#
# A common use of an options file is to run the wizard
# in silent mode. This lets
# the options file author specify wizard settings
# without having to run the
# wizard in graphical or console mode. To use this
# options file for silent mode
# execution, *uncomment* and modify the parameters
# defined within.
#
# Use the following command line when running the wizard
# from the update installer directory:
#
#    update -options responsefiles/install.txt -silent
#
#########################################################
# Used to input the maintenance package full filename
# specification to be installed.
# Edit as appropriate.
#
# ie. -W maintenance.package="C:\Program
# Files\WebSphere\AppServer\
#          updateinstaller\maintenance\PQ20029.pak"
#
# Note: If no package is specified, a default of the
# last downloaded maintenance
# package will be used (based on time stamp).
#
#-W maintenance.package=
#########################################################
# Used to modify the product install location that will
# be updated.
# This value should be left commented out if the Update
# Installer is
# being run from the recommended location
#
# ie. -W product.location=
# "C:\Program Files\WebSphere\AppServer"
#
# Note: If no location is specified, the parent
# directory to update installer
# will be used as default
#
#-W product.location=""
#########################################################
# Do not edit these values.
#
#
-W update.type="install"
*******************************************************************
sample of a response file used by the Update Installer to install an interim fix, interim feature, or test fix using the silent installer.
This is the silent install response file for installing maintenance packages
# using the update installer.
#
# A common use of an options file is to run the wizard in silent mode. This lets
# the options file author specify wizard settings without having to run the
# wizard in graphical or console mode. To use this options file for silent mode
# execution, *uncomment* and modify the parameters defined within.
#
# Use the following command line when running the wizard from the update
# installer directory:
#
#    update -options responsefiles/install.txt
#
# Please enclose all values within a single pair of double quotes.
#
################################################################################
################################################################################
#
# This section describes how to apply a maintenance package using the full filename specifications to be installed.
# There are three ways you can specify installing a maintenance package.  They are the following:
# (Use the examples below and edit where appropriate.)
#
# 1. Specify a single maintenance package full filename to be installed.
#
#    For example:
#    -W maintenance.package="/QIBM/ProdData/WebSphere/UpdateInstaller/V61/UPDI/maintenance/PQ20029.pak"
#
# 2. Specify a multiple maintenance package full filename to be installed.
#    -  Use a semicolon to separate the full filename specifications.
#    -  Update Installer will install the latest applicable maintenance in the order listed.
#
#    For example:
#    -W maintenance.package="/QIBM/ProdData/WebSphere/UpdateInstaller/V61/UPDI/maintenance/PQ20029.pak;
# /QIBM/ProdData/WebSphere/UpdateInstaller/V61/UPDI/maintenance/PQ20030.pak";"
#
# 3. Specify a full folder name that contains the maintenance packages.
#    Update Installer will install the latest applicable maintenance in the order listed in the folder.
#
#    For example:
#    -W maintenance.package="/QIBM/ProdData/WebSphere/UpdateInstaller/V61/UPDI/maintenance"
#
# Notes: If no package is specified, maintenance packages from the default folder
# (such as, UpdateInstaller_HOME\maintenance )
#        will be installed.
#
#-W maintenance.package=
################################################################################
#
# Prerequisite Checking
#
# The update installer checks the system for prerequisites by default.
#
# Uncomment the following option to notify the installer to continue with
# the update and log the warnings even though prerequisite checking
# failed.
#
#-OPT disableNonBlockingPrereqChecking="true
################################################################################
#
# Used to input the product install location that will be updated.
#
# ie. -W product.location="/QIBM/ProdData/WebSphere/AppServer/V61/Express"
#
# Note: The product install location should always been specified, and it should
# always be the full path.
#
-W product.location=""
################################################################################
################################################################################
#
# File Permission Checking
#
# The installer does not check that it has sufficient file permissions to
# perform the installation by default.
#
# Uncomment the following option to notify the installer that it should
# check that it has sufficient file permissions to perform the required
# install operation on each file to be installed.
#
# This option is not applicable for Windows.
#
# -OPT checkFilePermissions="true"
#
###############################################################################
################################################################################
#
# AIX Non-root User Limitation
#
# The AIX user account running the Update Installer program also must be able to
# run the slibclean command; otherwise, a root user must run the slibclean command
# before the Update Installer program runs.
#
# Uncomment the following option to notify the installer that a root user has run
# the slibclean command before the Update Installer program runs.
#
#-OPT rootUserHasRunSlibcleanCommandSuccessfully="true"
#################################################################################
# Do not edit these values.
#
-W update.type="install"


WAS interview questions:

Compare the WAS process server & WAS portal server and WAS application server?
Process server is a high performance business engine that executes mission critical business processes more securely and consistently.
Portal Server:  built on WAS, used to execute portlets. A portal is a composite application that is assembled at the front-end. It is an aggregation point for services delivered through portlets. This new feature in WebSphere Portal V6 makes it easier for end-users to use and to customize the portal to interact with services that they need.
App Server: which is used to execute the J2EE applications, supports load balancing, work management etc.,
Compare Version V.5 and V6? In v5
we don’t have a profile concept, where as in v6 we can create 3 types of profiles by which we can create number of servers without installing the product binaries again and again. And also v6 supports web services.
What is profile ? How many types of profiles u have? In v6 we have 3 profiles: Dmgr, Stand-alone and Custom. In v6.1 there is one more extra profile called cell profile, which is a combination of Dmgr and stand-alone profile which is already federated to it.
What is SIB’s? Service integration bus supports applications using message-based and service-oriented architectures. A bus is a group of one or more interconnected servers or server clusters that are members of the bus. Applications connect to a bus at one of the messaging engines associated with its bus members. By default, the SIB Service is disabled. This means that when a server starts it does not have any messaging capability. The SIB Service is automatically enabled when you add the server to a service integration bus. You can choose to disable the service again by configuring the server.
What is the command to find out the WAS version?
versionInfo
How many types of containers are there in WAS, and what is the role of those containers?
Two types of containers: web container and EJB contianer
Web container: used to execute the requests related to servlets, jsp’s html etc.,
EJB container: used to execute EJB applications. This will contain 3 types of beans (session, entity and MDB beans).
How did u differentiate b/w static and dynamic content?
Static website is where we can not change the content until next edition.
A dynamic website on the other hand uses programming in addition to the layout to not only allow  the flow of data in and out of the site but to make meaningful relationships with the data.
How many types of clusters WAS support? What did u meant by Horizontal & vertical ?
Two types of clusters:
A vertical cluster has cluster members on the same node, or physical machine.
A horizontal cluster has cluster members on multiple nodes across many machines in a cell.
Can you give the scenario when we will go for horizontal & vertical clustering ?
Suppose if our organization is having servers in diff locations, and if we want to manage them than we will create horizontal cluster. If all the servers and in the same location than we will use vertical cluster.
How to apply the fix packs?
Ans: we need to stop all the JVM instances than apply the fix pack.
Due some reasons nodeagent was not running? Where did u check for the logs?
We need to check the nodes logs (startNode.log)
Addnode full command?
app_server_root/bin/addNode host_name  soap_port  -includeapps
efaults ports for SOAP, admin, Bootstrap? SOAP: 8880, admin: 9060, bootstrap:
What is virtual host?
A virtual host is a configuration entity that enables a single host machine to resemble multiple host machines. It maintains a list of Multipurpose Internet Mail Extensions (MIME) types that it processes. You can associate a virtual host to one or more Web modules, but you can associate each Web module with one and only one virtual host. Resources associated with one virtual host cannot share data with resources associated with another virtual host, even if the virtual hosts share the same physical machine.
What is the role of node agent?
Node agents are administrative agents that represent a node to your system and manage the servers on that node. Node agents monitor application servers on a host system and route administrative requests to servers.
What is cell?
A cell is a configurational concept which is used to administer the processes in that particular cell by using Dmgr.
Do we have any unmanaged node in a cell?
Yes we can have an unmanged node in a cell, and these unmanaged nodes are maily useful to define web servers.
How do u configure a datasource.
servers > Application servers > server_name > Web container settings > Session management > Distributed environment settings > Database.
Here we need to configure the datasource details.
Which command u used to find out the IHS version?
What all information we can get from the plugin-cfg.xml file?
Plugin.xml file:
A plug-in is described in an XML manifest file, called plugin.xml, which is part of the plug-in deployment files. The manifest file tells the portal application’s runtime what it needs to know to register and activate the plug-in. The manifest file essentially serves as the contract between the pluggable component and the portal application’s runtime
What is the command to find out to run the process?
What is the command to find out the ports, which are listening on box?
Netstat -an
appplication server vs webserver
 application server is used to execute the j2ee applications where as web server is used to execute the requests related to servlets, jsp’s and html. And web servers also used to route the request to diff app servers.
Why we require web server separate:
The Web servers are necessary for directing traffic from browsers to the applications that run in WebSphere Application Server. It is mainly used for the router for directing the request between different application servers which are in cluster. The Web server plug-in uses the XML configuration file to determine whether a request is for the WebSphere Application Server.
how user request will process
First the request will go to web server, there the plug-in will decide to which app server it should go. Then the request will go to the particular app server, then the request can move to DB(if requires).
What is the usage of plug-in?
The plugin-cfg.xml file will contain all the applications information and servers and their ports information. This information is used to direct the request to the available server.
 EAR vs WAR vs RAR
EAR, enterprise archive, which is the combination of WAR, JAR and RAR files. And this is the file we will deploy it on to the app server for execution.
WAR, web archive, which will contain all the servlets, jsp’s and html things, which will make up this web module.
RAR, resource adapters, it will contain the connections to all the external resources.
What is mean by clustering?
Clusters are groups of servers that are managed together and participate in workload management. A cluster can contain nodes or individual application servers.
Installation procedure
 cd_root/operating_system/architecture/ifpackage/WAS/install, by clicking install.sh here we can install the WAS onto Unix box.
Data Source
Data sources allow you to manage a pool of connections to a database.
Data sources work as follows:
When a client wants to use a connection, it looks up a data source by name from a JNDI server.
The data source then returns a connection to the client.
If the data source has no more connections, it may ask the database manager for more connections (as long as it has not exceeded the maximum number of connections).
When the client has finished with the connection, it closes the connection.
The data source then returns the connection to the available pool.
Data Source creation
We can create a datasource in one of two ways:
Resources > JDBC > Data sources > data_source
Resources > JDBC > JDBC providers > JDBC_provider > Data sources > data_source
ND vs Base
No profile concept in base where as we can create no. of servers by using a profile concept which is available in ND. That will reduce the installation space.
Directory structure
Important configuration files
Wimconfig.xml – stores the vitual member manager global settings.
Use the ssl.client.props file to configure Secure Sockets Layer (SSL) for clients. In previous releases of WebSphere Application Server, SSL properties were specified in the sas.client.props or soap.client.props files or as system properties.
To configure the IBM HTTP Server, edit the httpd.conf configuration file.
We should update the was.policy file if the application has specific resources to access.
JVM setting
The JVM translates the Java byte codes into the native instructions of the host machine. The application server, being a Java process, requires a JVM in order to run, and to support the Java applications running on it. JVM settings are part of an application server configuration.
To view and change the JVM configuration for an application server's process, use the Java virtual machine page of the administrative console or use wsadmin to change the configuration through scripting.
Procedure :
In the administrative console, click Servers > Application Servers >server. Then, under Server Infrastructure, click > Java and Process Management > Process Definition .select Java Virtual Machine.
Specify values for the JVM settings as needed and click OK
What is heap dump?
Although heap dumps are generated only in response to a detected memory leak, you must understand that generating heap dumps can have a severe performance impact on WebSphere Application Server for several minutes.
Federation:
Federation is the process of adding profiles to Dmgr. This can be done in 2 ways: By using the Dmgr’s admin console or by using the command prompt. In both the cases we need to specify the SOAP port info.
Configuration backups
We can take configuration backups by using “backupConfig” command.
Application maintenance
what is dmgr
Dmgr is one type of profile which is used to administer the different profiles which are federated to it, and also can be able to mange webservers which are defined on a managed node. On this profile we can’t deploy any applications, it’s just central management tool.
wsadmin main commands
AdminControl: Use to run operational commands.
AdminConfig: Use to run configurational commands to create or modify WebSphere Application Server configurational elements.
AdminApp: Use to administer applications.
AdminTask: Use to run administrative commands.
Help: Use to obtain general help
In which file all the ports entries are there?   server.xml
thread dump
The JVM creates a thread dump whenever an application server process spontaneously closes. You can also force an application to create a thread dump. After a dump is created, you can check the dump for clues as to why new requests are not being processed
After the application creates the dump, you can check for the following clues:
Look for an excessive current heap size. The thread dump shows information on the current Java heap size, and the minimum and maximum heap size settings.
Look at the snapshot of each thread in the process. The thread dump contains a snapshot of each thread in the process, starting in the section labeled "Thread Information."
Look for threads that are waiting on locks held by other threads.
Look for multiple threads in the same Java application code source location. Multiple threads from the same location might indicate a deadlock condition (multiple threads waiting on a monitor) or an infinite loop, and help identify the application code with the problem.
Name of plgin logfile?
For every plugin we need to mention the log file location and name in the plugin-cfg.xml file. Then in that specified file the logs will be stored.
What is core group?
A core group is a high availability domain that consists of a set of processes in the same cell that can directly establish high availability relationships. Highly available components can only fail over to another process in the same core group and replication can occur only between members of the same core group.
How IHS and WAS talk to each other?
By using the plug in configuration file.
What type info can u see in plugin file?
Plugin.xml file is a part of the plug-in deployment files. The manifest file tells the portal application’s runtime what it needs to know to register and activate the plug-in.
WebSphere Application Server functions use information in this file during the configuration and deployment phases of Web application development.
What si the command to find out version of IHS?
./apachectl -v
Log files in IHS?
Access.log and error.log
Nohup: No Hang Up. Runs a command even if the session is disconnected or the user logs out.
Run a command immune to hangups, runs the given command with hangup signals ignored, so that the command can continue running in the background after you log out.

SYNTAX
nohup Command [Arg]...
nohup command
Answer is simple, use nohup utility which allows to run command./process or shell script that can continue running in the background after you log out from a shell:
Syntax:
nohup command-name &
Where,
Command-name: is name of shell script or command name. You can pass argument to command or a shell script.
&: nohup does not automatically put the command it runs in the background; you must do that explicitly, by ending the command line with an & symbol
Log levels: Off, Fatal, Severe, Warning, Audit, Info, Config, Detail, Fine, Finer, Finest, ALL.
Log location
Main log files will be available at /root/bin/logs dir. And for individual processes they will be available in their own /bin directories.
Log information
By using the information in the log files we can know the status of the operation that we are performing
how we will configure WAS with IHS?
By using the plugin conf file (plugin-cfg.xml).
 What is security colobrator?
DumpNamesSapce
You can use the dumpNameSpace tool to dump the contents of a name space accessed through a name server. The dumpNameSpace tool is based on Java Naming and Directory Interface (JNDI).
Eg: dumpNameSpace -host myhost.mycompany.com -port 901
Name space dump output is sent to the console. It is also written to the file DumpNameSpace.log in the server's log directory
FFDC:
The first failure data capture (FFDC) log file saves information that is generated from a processing failure. These files are deleted after a maximum number of days has passed. The captured data is saved in a log file for analyzing the problem
FFDC instantly collects events and errors that occur during the WebSphere Application Server runtime.
Activity. Log/Service Log
The IBM service log contains both the WebSphere Application Server messages that are written to the System.out stream and some special messages that contain extended service information that can be important when analyzing problems. There is one service log for all WebSphere Application Server Java virtual machines (JVMs) on a node, including all application servers and their node agent (if present). A separate activity log is created for a deployment manager in its own logs directory. The IBM Service log is maintained in a binary format. Use the Log and Trace Analyzer or Showlog tool to view the IBM service log.
The Java virtual machine (JVM) logs are written as plain text files. The JVM logs are created by redirecting the System.out and System.err streams of the JVM to independent log files. WebSphere Application Server writes formatted messages to the System.out stream. Systemout.log and Systemerr. Log are the two files for JVM logs.
Process logs / native logs
WebSphere Application Server processes contain two output streams that are accessible to native code running in the process. These streams are the stdout and stderr streams. Native code, including Java virtual machines (JVM), might write data to these process streams
Garbage Collection: The Java run-time system performs garbage collection automatically. It finds memory that a program is no longer using and frees it. In the Profiling Tool, garbage collection can only be run if the process is active.  Garbage collection is available from Memory Statistics view
We can enable this option by going to application servers->server1->process definition->Java virtual machine, than select the option “verbose garbage collection”
Can u control GC cycle? How do u control that?
LOGSJVM logs (SystemOut and SystemErr)
1. You can find the logs in the following directory:
<WAS_install_root>/profiles/<profile>/logs/<process
2.from the administrative console, select
Troubleshooting → Logs and Trace. Select the process whose logs you want to configure, and then click JVM Logs. The General Properties window opens.
3.Your applications can also write to them by using the print(), println(), and
printStackTrace() methods.
4.SystemOut and SystemErr logs are created for every WebSphere® Application
Server process (application server, cluster member, node agent, and deployment manager).
First Failure Data Capture (FFDC)
1.The FFDC feature runs in the background and collects events and errors that occur during WebSphere Application Server runtime and processing failure.
2.The information that it collects are written to log files in the
<WAS_install_root>/profiles/<profile>/logs/ffdc directory.
 3.There are three FFDC configuration files in the <WAS_install_root>/properties directory ffdcRun.properties, ffdcStart.properties, andffdcStop.properties.
Process (native) logs
1.On execution of Native code these logs are generated. Native code is non-Java code,typically found in files with .dll, .exe, and .so extensions.
2.The process logs are named native_stdout.log and native_stderr.log
3.They are located in the <WAS_install_root>/profiles/<profile>/logs/<server> directory
service log (activity.log)
1) The activity.log and is found in the
<WAS_install_root>/profiles/<profile>/logs directory 2)There is only one activity.log for each node
3)WebSphere Application Server runtime events are logged to the activity.log
4) It is written in binary format, so it cannot be viewed in a
text editor. The main purpose of the activity.log is that it can be viewed with the
Log Analyzer tool, is a graphical user interface that displays the events from the activity.log and uses a symptom database to analyze the events and diagnose problems
Installation Logs:
1)<WAS_install_root>/profiles/<profile>/logs/pctlog.txt
This log file records the profile creation status
2)Enable trace logging in the Web server plug-in by setting the LogLevel directive
   in the plugin-cfg.xml file as shown
<Log LogLevel="Trace"
Name="c:\ibm\was6\plugins\logs\webserver1\http_plugin.log" />
3)This example also shows you where you set the amount of
   detail that is logged.
<Log LogLevel="Error"
Name="c:\ibm\was6\plugins\logs\webserver1\http_plugin.log" />
4) Output from wsadmin
Messages from wsadmin are written to the wsadmin.traceout log file:
<WAS_install_root>/profiles/<profile>/logs/wsadmin.traceout
You can also increase the amount of data that is logged to this file by tracing the
wsadmin utility. To do so, update the following file:
<WAS_install_root>/properties/wsadmin.properties
Uncomment the following line:
com.ibm.ws.scripting.traceString=com.ibm.*=all=enabled
5)Management scripts like startServer.log, stopServer.log, startManager.log etc generated when we run respective .sh(script files) into log directory.
Ex. Location: <WAS_install_root>/profiles/<profile>/logs/<server>/stopServer.log
6)The profile creation and management tool wasprofile writes messages to the
   profile independent logs directory, that is:
    <WAS_install_root>/logs/wasprofile/<profile>.log
ADMIN CONSOLE
1)As you work with the configuration, the original configuration file and the new
 configuration file are stored in a folder at:
<profile_home>/wstemp
Once you save the changes, these files are removed from the wstemp folder.
2)To change the admin console time out
1. Copy the following script into a file.
 Example 4-1 Jython script to change the console session expiration
dep = AdminConfig.getid("/Deployment:isclite/" )
appDep = AdminConfig.list("ApplicationDeployment", dep )
sesMgmt = AdminConfig.list("SessionManager", appDep )
# check if existing sesMgmt there or not, if not then create a new one, if
# get applicationConfig to create new SessionManager
            appConfig = AdminConfig.list("ApplicationConfig", appDep )
                if (appConfig == ""):
                      # create a new one
                 appConfig = AdminConfig.create("ApplicationConfig", appDep, []
                 )
                 # then create a new SessionManager using new Application Config
               just created
                  sesMgmt = AdminConfig.create("SessionManager", appConfig, [] )
               else:
                 # create new SessionManager using the existing
             ApplicationConfig
           sesMgmt = AdminConfig.create("SessionManager", appConfig, [] )
            #endElse
           #endIf
             # get tuningParams config id
          tuningParams = AdminConfig.showAttribute(sesMgmt, "tuningParams" )
              if (tuningParams == ""):
           # create a new tuningParams
             AdminConfig.create("TuningParams", sesMgmt, [["invalidationTimeout",
                <timeout value>]] )
                  else:
       #modify the existing one
       AdminConfig.modify(tuningParams, [["invalidationTimeout", <timeout
        value>]] )
           #endElse
           # saving the configuration changes
           AdminConfig.save()
          142
2. Change the <timeout value> on the two lines of this sample to the new
session expiration value. This number specifies the number of minutes the
console preserves the session during inactivity.
3.Save the file to any directory using, for example, the filename timeout.py.
4. Start the wsadmin scripting client from the
<was_home>/profiles/<profile_name>/bin directory.
5.Issue the following command.
wsadmin -f <path to jython file>/timeout.py
SERVER
1)Changing the working directory
 of server
    a) Select the server
    b)Expand the Java and Process Management
   c)select Process Definition.
    d)change the working directory from
       ${USER_INSTALL_ROOT} to
      ${PLANTSBYWEBSPHERE_ROOT}/workingDir
2)To create server virtual host, do the following
    1.Select the Environment → Virtual Hosts entry in the navigation pane.
    2.Click New.
     3.Enter the virtual host name, plantsbywebsphere_host.
    4.Click Apply.
     5.Select Host Aliases in the Additional Properties section.
   6. Add the two aliases  by clicking New, entering the
     values, and clicking OK.
 3)Creating virtual hosts is done using the VirtualHost directive, as in Example 14-2.
    Example 1 Using VirtualHost
  <VirtualHost www.plantsbywebsphere.com:80>
  ServerAdmin webmaster@plantsbywebsphere.com
  ServerName www.plantsbywebsphere.com
  DocumentRoot "C:\IBM\HTTPServer\htdocs\plantsbywebsphere"
  ErrorLog logs/plantsbywebsphere_error.log
  TransferLog logs/plantsbywebsphere_access.log
  </VirtualHost>
SIB
service integration bus supports applications using message-based and service-oriented architectures. A bus is a group of interconnected servers and clusters that have been added as members of the bus. Applications connect to a bus at one of the messaging engines associated with its bus members.
FIX Packs:
we need to stop all the JVM instances than apply the fix pack.
Heap &Thread Dumps:1)thread_dump.sh     -           Collect Thread dumps
2)_The JVM creates a thread dump whenever an application server process spontaneously closes. You can also force an application to create a thread dump. After a dump is created, you can check the dump for clues as to why new requests are not being processed.
 3) After the application creates the dump, you can check for the following clues:
Look for an excessive current heap size. The thread dump shows information on the current Java heap size, and the minimum and maximum heap size settings.
Look at the snapshots of each thread in the process. The thread dump contains a snapshot of each thread in the process, starting in the section labeled "Thread Information."
Look for threads that are waiting on locks held by other threads.
00Look for multiple threads in the same Java application code source location. Multiple threads from the same location might indicate a deadlock condition (multiple threads waiting on a monitor) or an infinite loop, and help identify the application code with the problem.
Garbage Collection:
1)The Java run-time system performs garbage collection automatically.
2) We can enable this option by going to Application Servers->Server1->Process Definition->Java Virtual Machine, than select the option “verbose garbage collection”.