IMC's not working, JSERVER stopped and don't start

[lcieplak]

Hello HirnerStefan

When you are on this window, go in the "Advanced" setting at the bottom of this page.

Then disable the "inheritance" at the bottom again.

When you try to do that, a message with 2 choices will appear, take the first one.

Now you can validate and i think you could delete the autorisation and just keep the administrator group

[MattPanton]

Hello Justin

I removed inheritance and clicked the convert to explicit option when presented, I still cannot remove the group "ALL APPLICATION PACKAGES" 

And I still cant start JServer process from DMA

Matt

[jguse]

Hello Matt and all,

Is it possible that you are not the owner of the file and therefore can't remove it? I can't see the owner in the Security context screenshot.

Please have a look at this doc (rather old but should still be relevant) from Oracle on securing jmx.password in Windows:

https://docs.oracle.com/javase/8/docs/technotes/guides/management/security-windows.html

Another possibility is that Group Policy is somehow interfering with the permissions, if you are in an AD Domain. See for example the steps mentioned here:

https://support.microsoft.com/en-us/help/2798317/microsoft-store-apps-fail-to-start-if-default-registry-or-file-permiss

In that case, you could test assigning the system to a temporary OU that blocks GPO inheritance and try again after updating the policy on the server.

[WTAabigailD]

Would you know where any log files are put when jserver fails to start? I'm also having this problem trying to set up a trial of IMC. 

I'm running on an english OS without the administrator's group renamed, so I never did try the command, but looking at the permissions, I also seem to be having the "ALL APPLICATION PACKAGES" permission come back on. This may still be my problem but I would also like to know if my log files would show me anything different, and I don't know where to find them. 

[elara]

Thank. It helped.

[jguse]

Hello,

There is no IMC log to debug the jserver startup, because jserver doesn't "log" anything until it actually starts up - which it won't if the permissions do not work out. The way to "debug" the startup is mentioned in the 5th post or so further up here - you can rename the client\bin startup.bat javaw.exe to java.exe, and then attempt to run startup.bat from CMD.

This will print some output, which will almost certainly be an error about jmx.password security.

EDIT: Removed the workaround of last resort, please do not use it. New Platform versrion iMC 7.3 E0705 has been released and resolves the issue in this topic entirely.

[sd219]

@jguse 

i followed this whole topic and read also all messages including the recommended workaround concerning the inheritance and all the stuff.

i also tried your highly insecure workaround with the renaming of the both startup.bat files on a test system (because all other recommended workarounds didn't work.)  and its worked as you said.

So basically i am interested in the reason why your workaround, described as highly insecure, is highly insecure and on top of that if there exists a solution right now.

So i am not the only person you might have noticed; so it would be nice if there is a solution

[jguse]

Hello,

I think all possible/known solutions to this issue have been posted throughout this topic. I've also posted earlier how to debug the jserver startup (modifying the javaw.exe to java.exe in startup.bat) and checking the output on CMD - have you tested this when using the "normal" startup.bat? If so, what output do you see in the CMD window?

The reason why startup_d.bat (which exists for debugging purposes) works, is because it starts the "java server" aka jserver process of IMC without any of the security and other options. This can be seen by comparing the two startup files. Startup_d remarks (comments out) these lines:

rem Enabling Local/Remote Monitoring and Management
rem set JMXRMI_PORT=9091
rem set JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote.port=%JMXRMI_PORT% -Dcom.sun.management.jmxremote.authenticate=false -Djavax.net.ssl.keyStore="%IMC_HOME%\security\newks" -Djavax.net.ssl.keyStorePassword=iMCV500R001

This means the SSL keystore is not set, there will be no authentication on the jmx.remote agent (which means a JMX console on IMC can be accessed remotely without login), and the jmx.remote port is not set to 9091. The port not being set might cause issues with distributed installations, though I didn't test it specifically and can't confirm.

The "Java Heap Size" is also set to 512MB by default, which will make IMC run very slowly (if at all, on larger installs). You can fix that though, by modifying the -server -Xmx512m in the following line:

set JAVA_OPTS=-server -Xmx512m -XX:PermSize=64m -XX:MaxPermSize=512m -Dimc.home="%IMC_HOME%" -Duser.language=en -Duser.country=US -Djava.io.tmpdir="%IMCROOT%\tmp" -Dorg.apache.el.parser.COERCE_TO_ZERO=false

Here is the same line on my test system with 8GB Heap Size (out of 16GB total memory), and a few other changes that only exist in the "normal" startup.bat:

set JAVA_OPTS=-server -Xmx8192m -Xrs -XX:PermSize=64m -XX:MaxPermSize=1024m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=../log -Dimc.home="%IMC_HOME%" -Duser.language=en -Duser.country=US -Djava.io.tmpdir="%IMCROOT%\tmp" -Dorg.apache.el.parser.COERCE_TO_ZERO=false -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true -Dorg.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH=true

If you are still struggling to get the proper startup.bat working, please share the output I mentioned above from CMD, and open a support case if it's urgent.

[sd219]

As follows, you see the output of the debugging:

output from cmd

C:\Program Files\iMC\client\bin>startup.bat >2.txt
OpenJDK 64-Bit Server VM warning: Ignoring option PermSize; support was removed in 8.0
OpenJDK 64-Bit Server VM warning: Ignoring option MaxPermSize; support was removed in 8.0
Error: Password file read access must be restricted: C:\Program Files\iMC\client\bin\..\bin\jmx.password
jdk.internal.agent.AgentConfigurationError
at jdk.management.agent/sun.management.jmxremote.ConnectorBootstrap.checkPasswordFile(ConnectorBootstrap.java:590)
at jdk.management.agent/sun.management.jmxremote.ConnectorBootstrap.startRemoteConnectorServer(ConnectorBootstrap.java:436)
at jdk.management.agent/jdk.internal.agent.Agent.startAgent(Agent.java:447)
at jdk.management.agent/jdk.internal.agent.Agent.startAgent(Agent.java:599)

the outfrom from the 2.txt file is empty....

[jguse]

Hello,

This error provided matches the issue I've described in previous posts here.

It means that the security settings on your jmx.password file are not correct. This file must be configured with Full Control for the local Administrator Group and absolutely no other permissions.

If you are unable to figure it out, can you please post a screenshot of the jmx.password file Security settings (permissions)?