topic Re: IMC's not working, JSERVER stopped and don't start in IMC

IMC's not working, JSERVER stopped and don't start

lcieplak — Fri, 05 Jul 2019 07:51:13 GMT

Hello everyone,

Today i have IMC (e605) which is installed on a VM with Windows Server 2012 R2.

I have to migrate this soft on another VM and the new one is on Windows 10

Since 2 days i'm trying to install the new version of IMC (e705) on the new VM but i have a problème to start it, the process JSERVER don't want to start so i can't use IMC on the new VM and access at the web portal.

For informations, i let IMC install the Microsoft SQL 2016 that it propose.

Have you an idea about this problem please ?

Thanks for your help !

Re: IMC's not working, JSERVER stopped and don't start

jguse — Fri, 05 Jul 2019 08:32:58 GMT

Hello,

This sounds like the known issue with jserver startup. I've posted it before here, but here is an updated text:

ISSUE: Jserver process is permanently stopped/does not start after upgrade to E0703 completes successfully.

1) Open Windows CMD as Administrator and navigate to "iMC\client\bin"

2) Run the command: cacls jmx.password /P [admin group name]:F // replace [admin group name] with the non-English equivalent of the Administrators group depending on your OS language (see also https://www.microsoft.com/en-us/language/search )

3) Restart IMC via DMA and the "jserver" process should now start up successfully

Note: If the "cacls" command is not found, you need to make sure that "Windows\system32" is part of your command-line %PATH%, as cacls is a Windows file system permission editing command.
The end result should be the local Administrators group having Full Control over the jmx.password file. Do NOT add any additional permissions for more users/groups to the file, or the jserver issue will remain!

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Fri, 05 Jul 2019 08:47:31 GMT

At first, thanks for your help.

I'll try this but what do you mean witch "admin group name" and what product did you choose for the language on the Microsoft Web Site ?

Re: IMC's not working, JSERVER stopped and don't start

jguse — Fri, 05 Jul 2019 08:54:33 GMT

Hello,

It depends on the language settings of your OS. For example, German-language OS uses the local Administrators group name "Administratoren" so the command would be: cacls jmx.password /P Administratoren:F

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Fri, 05 Jul 2019 09:09:18 GMT

Unfortunately it was not work, the jserver doesn't start....

Re: IMC's not working, JSERVER stopped and don't start

jguse — Fri, 05 Jul 2019 09:45:30 GMT

Can you please try these steps to debug why it won't start?

Edit $iMC\client\bin\startup.bat file.
Locate the last line, change " JAVA_HOME \bin\javaw.exe" to " JAVA_HOME \bin\java.exe", then save it.
Open a windows command line
cd IMC\client\bin
Save startup output to 1.txt: startup.bat >1.txt
Share the output of $iMC\client\bin\1.txt after the startup fails, as well as any output from the CMD window
Edit $iMC\client\bin\startup.bat file and return to " JAVA_HOME \bin\javaw.exe".

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Wed, 10 Jul 2019 07:30:33 GMT

I did these instructions and this is what the command return :

C:\Program Files\iMC\client\bin>startup.bat>1.txt
OpenJDK 64-Bit Server VM warning: Ignoring option PermSize; support was removed in 8.0
OpenJDK 64-Bit Server VM warning: Ignoring option MaxPermSize; support was removed in 8.0
Error: Password file read access must be restricted: C:\Program Files\iMC\client\bin\..\bin\jmx.password
jdk.internal.agent.AgentConfigurationError
at jdk.management.agent/sun.management.jmxremote.ConnectorBootstrap.checkPasswordFile(ConnectorBootstrap.java:590)
at jdk.management.agent/sun.management.jmxremote.ConnectorBootstrap.startRemoteConnectorServer(ConnectorBootstrap.java:436)
at jdk.management.agent/jdk.internal.agent.Agent.startAgent(Agent.java:447)
at jdk.management.agent/jdk.internal.agent.Agent.startAgent(Agent.java:599)

The file 1.txt which was created in the folder bin is empty.

Re: IMC's not working, JSERVER stopped and don't start

jguse — Thu, 11 Jul 2019 08:02:37 GMT

Hello,

That's precisely the startup error that is mentioned above related to jmx.password. Could it be that your local Administrators group has been renamed?

It's likely this would also trigger the issue, as the command IMC runs on E0703 is the "cacls" command mentioned above, using "Administrators" as the group name.

If you are having trouble you could always check the local Users & Groups on the server, or run net localgroup | find "Adm" or similar to locate the Administrators group.

Re: IMC's not working, JSERVER stopped and don't start

jguse — Thu, 11 Jul 2019 11:10:44 GMT

Hello,

One more important bit I'd like to mention... I've seen some folks writing that they have issues despite running "the command correctly" when in fact they were running "icacls" instead of "cacls". Ignore the obsoletion message of cacls, it is not exactly the same as icacls and Engineering have stated that "cacls" must be used here. The same command using "icacls" may not work as expected.

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Thu, 11 Jul 2019 12:29:17 GMT

Hello,

I tried to start the service with the local administrator but the same happened.

For me in France, the admin group is named "Administrateurs" so i used the correct command "cacls", and not "icacls", like this :

cacls jmx.password /P Administrateurs:F then the command asked to me if i'm sure of my choice and i did "yes".

But it does not works neether... I wanted to see how works the last installation in E603 and i saw that i don't have the "jmx.password" file. Is it a new features with the nw version ?

I don't know what i can do to make the soft functional :')

Re: IMC's not working, JSERVER stopped and don't start

jguse — Thu, 11 Jul 2019 12:57:15 GMT

Hello,

Can you please open Properties for the jmx.password file, and share a screenshot of the Security tab? If you are logged in with some user that is not in local Administrators group, this should show that you do not have read access to the file. Otherwise it shows all users/groups with permission to access the file.

The reason for the jmx.password issue is related to the OracleJDK to OpenJDK 11 backend migration in IMC. This resolved a long list of security issues, and one of them was related to the JMX console being accessible remotely without a password. To secure this and prevent the vulnerability, a jmx.password file must be added which has access restriced to only the local Administrators group. That's not something our developers decided, but the folks who worked on that for (Open)JDK.

See for example https://docs.oracle.com/javadb/10.10.1.2/adminguide/radminjmxenabledisable.html

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Thu, 11 Jul 2019 13:09:48 GMT

There are the autorisations for administrators and users (my profile is in the administrator group)

Re: IMC's not working, JSERVER stopped and don't start

jguse — Thu, 11 Jul 2019 13:23:28 GMT

Hello,

Thanks for the screenshot. I see there are additional permissions in there. Please completely remove all user/group/system privileges on the file that you see on security tab, except for VDRLT622\Administrateurs, and then try starting up jserver again.

Re: IMC's not working, JSERVER stopped and don't start

lcieplak — Thu, 11 Jul 2019 13:49:24 GMT

Hey,

It finally started ! It was just a problem of group of permissions...

I'd never guessed that i juste have to delete the uselesses groups will fix it

Thank you a lot for your help !

Re: IMC's not working, JSERVER stopped and don't start

HirnerStefan — Tue, 16 Jul 2019 10:50:29 GMT

Hello,

I have the same problem, and all the options here already tried. Is there another way to solve the problem? In any case, I also get the error as above time when I rewrite the javaw.exe on java.exe.

"Error: Password file read access must be restricted: C:\Program Files\iMC\client\bin\..\bin\jmx.password
jdk.internal.agent.AgentConfigurationError"

Also i have correct the permissons on the jmx.password - but all this not work for me.

Thanks in advance

Re: IMC's not working, JSERVER stopped and don't start

jguse — Tue, 16 Jul 2019 11:07:22 GMT

Hello,

Can you please post the same screenshot as above, showing your jmx.password "security" tab?

Re: IMC's not working, JSERVER stopped and don't start

MattPanton — Mon, 22 Jul 2019 16:17:37 GMT

Hi Justin,

Same issue over here, ran the cacls command to change persission on that file, upon rebooting the server I noticed that the permissions still had another entry, this cannot be removed at all, you remove it and it comes back automatically, any further troubleshooting?

cant upload images for some reaon but the group is called ALL APPLICATION PACKAGES

Running your diag I get the following which suggests the file is still at fault "Error: Password file read access must be restricted"

Matt

Re: IMC's not working, JSERVER stopped and don't start

jguse — Mon, 22 Jul 2019 18:14:05 GMT

Hello,

The jserver workaround was proposed by Engineering using cacls, hence my recommendation. However I've noticed that it cannot overwrite the permissions that are inherited. After some experiences removing the permissions, it's actually not absolutely necessary to use cacls. Here are alternative steps that should be easier to implement and account for this...

I simulate the issue on English Windows with hostname IMC by opening "lusrmgr" (Local Users and Groups), and renaming the Administrators group to "RenamedAdmins". This will trigger the issue if I install IMC afterwards.

To fix it:

1) Open Properties > Security on the IMC\client\bin\jmx.password file

2) Notice that there are probably 4 different permissions shown - click the icon to get Administrator permissions if you cannot see or edit the permissions. ALL APPLICATION PACKAGES, SYSTEM, Users and RenamedAdmins (this will be different based on the name of your local Administrators group). These are the inherited permissions that cause issues.

3) Click on Advanced, then click on Disable inheritance and select Convert inherited permissions into explicit permissions on this object (selecting the other option will remove all permissions, including your own, so don't use that). Your Advanced Security Settings should now look similar to this:

4) Remove all permissions, except the second one on the list above (the permissions for the local Administrators group, called IMC\RenamedAdmins in my case), like so:

5) Click on Apply to save it, and close the Properties. Start IMC again, and jserver process should now start up successfully.

Hope that helps.

Re: IMC's not working, JSERVER stopped and don't start

HirnerStefan — Tue, 23 Jul 2019 06:40:18 GMT

Hello, I am sorry that I will contact you only now?

Here is the screenshot ....

The Group "Alle Anwendungspakete" can not be removed.

This is always newly created

Best regards, Stefan

Re: IMC's not working, JSERVER stopped and don't start

sylneo — Tue, 23 Jul 2019 07:15:35 GMT

Hi,

Also in french language, the solution to only keep Administrators (Administrateurs in french) group ACL worked for me too. I only said one thing, without java, life would not be so funny...