Citrix Secure Gateway and HP PSP 7.50 Problem

[Radoslav_1]

We are running a WI 4.2 and SG 3.0 on a W2K server in a W2K3 ADS. Sporadicly, mostly after the weekly reboot on saturdays, it is possible to log on to the Web Interface and see your published applications, but after clicking on one of the apps. the ICA client freezes at 'Connection in progress...'. When trying to restart the Secure Gateway service (which always is a workaround) the SG console tells me, that it is unable to restart the service and hangs in 'Stopping' status. So I kill it (pskill) and start it up again - everything works fine - even restarting the service from within the console. This problem is NOT user related, even if I log on with domain admin rights I'll get not connection to the PS4 server through SG3. It doesn't matter either if hotfix SGE300W001 is installed or not; no eventlog entries.

After deinstalling PSP 7.50 The Secure Gateway works perfectly, the problem seems to be on PSP i installed the newest PSP but the problem is the same

I think HP should open an Call to develop an patch for the PSPs

Greetings

Radoslav Jordan

[James Priest_2]

I have experienced this exact issue on 5 separate HP servers (some brand new). A range of DL380 and DL360 servers, I have found PSP 7.40B is OK, the CSG works fine. Using 7.50 or 7.60 causes this issue, for me, every 7 days (pretty much exactly).

I found that on a new server, (built with smart start 7.50), Windows Server 2003 std, WI 4.2, SG 3.0 (and all patches) this issue occured 7 days after it was put into production (with less than 100 remote users), it then continued to occur every 7 days (occasionaly it would do it one or two more times straight after a pskill and restart of the CtxSecGateway service...

I have opened a case with Citrix on this issue to no avail, they blame the 3rd party vendor (HP)...

Any update from HP acknowledging this issue and perhaps some kind of fix would be really good. But if anyone else has come across it and found a fix??

[Radoslav_1]

Hello,

i get a information from an HP technican:

Symptoms

When a server containing Secure Gateway 3.0 is restarted, the Secure Gateway Service does not appear to start completely and users connecting may receive an Error (SSL Error 4, or similar) and cannot connect.

If the Secure Gateway Service process (CtxSGSvc.exe) is terminated manually and the Secure Gateway Service is restarted, the Secure Gateway works correctly until the server is restarted again.

After a restart the same behavior is observed.

Cause

An issue has been identified where starting certain third-party applications, based on Apache Web server (for example, System Management Homepage, version 7.5 from Hewlett-Packard), causes processes required by Secure Gateway 3.0 to terminate. The application replaces the process with the third-party version of the process.

The process in question is RotateLogs.exe, and in a normal setup of Secure Gateway 3.0 there should be five instances of this process running.

It can be verified that the third-party application has terminated the Secure Gateway specific processes by using Process Explorer (from Sysinternals.com at http://www.sysinternals.com/ntw2k/freeware/procexp.shtml). The parent of the RotateLogs.exe process is the third-party software.

If the third-party software is disabled before the server is restarted, the issue does not occur.

Workaround

As this issue is caused by third-party software, it is recommended to contact the technical support team of the relevant software vendor for a permanent fix.

Citrix Technical Support suggests the following workaround as a temporary solution until the third-party software vendor can support a permanent fix for their application:

Locate the rotatelogs.exe file for Secure Gateway. This file is normally located in the C:\Program Files\Citrix Secure Gateway\bin folder.
Rename the rotatelogs.exe executable (for example, rotate.exe).
Open the http.conf file located in the C:\Program Files\Citrix\Citrix Secure Gateway\conf folder. To do so, perform the following procedure:
Open a command prompt window.
Navigate to the C:\Program Files\Citrix\Citrix Secure Gateway\conf folder from within the command prompt.
In the command prompt window, type notepad httpd.conf to open the httpd.conf file.
Note: The httpd.conf file is hidden. You cannot open the file unless you use a text editor.
Create a backup of the file (for example, httpd.conf.bak).
Modify the httpd.conf file and replace rotatelogs.exe with the new executable name (for example, rotate.exe).
Restart Secure Gateway (for the new changes to take effect. Process Explorer should reflect the new changes).
After performing the changes, set the HP Management Homepage Service to Automatic (or the other third-party application).
Restart the system and test against the problem.
More Information

Secure Gateway 3.0 is also built on Apacheâ see CTX107581 â Secure Gateway 3.0 Configuration File - httpd.conf.

Best Regards

Radoslav Jordan