-
Title
No alarm is generated when Integration TrapAgent sends trap information to the FMS. -
Description
The TrapAgent log indicates that a trap is received and is sent to the FMS but no alarm is generated.
The trap is enabled under the Configuration dashboard (Integration | SNMP Trap Administration | Configuration).
The Integration Servlet URL field of the TrapAgent properties is set as follows:
http://fms_hostname:8080/Integration/Write
When port 8443 was configured for the "Integration Servlet URL" (https://fms_hostname:8443/Integration/Write) the following certificate error was reported:
"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" -
Cause
CAUSE1: The FMS server.config file has the "server.console.httpsonly" parameter set to "true" but the Integration Servlet URL is using the http port (8080). The Integration Servlet URL could not be configured because http is not being allowed.
CAUSE 2: When the "Integration Servlet URL" was configured to use https the following certificate error was reported due to a java SSL certification issue:
"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target". -
Resolution
RESOLUTION 1: Change the the "server.console.httpsonly" setting in the server.config file to "false" and restart the FMS.
RESOLUTION 2: Address the certificate issue encountered when using port 8443 in the "Integration Servlet URL" used by the Trap Agent. Import the certificate for this FMS URL and fix the certificate issue as per the following JAVA KB article:
https://blogs.oracle.com/gc/entry/unable_to_find_valid_certificationThe following steps require that the FglAM that uses a V1.8 JRE (V5.8.1 FglAM or higher).
1. Copy the attached installCert.zip file (installCert.zip file containing the class files for V1.8 JRE) to the temp folder on the FglAM host and then extract the contents (InstallCert.class and InstallCert$SavingTrustManager.class files).
2. Navigate to the temp folder and run following command:
"%FglAM_HOME%\jre\<latest 1.8.0.X version>\jre\bin\java.exe" -server InstallCert FMS_hostname:8443
3. The java program opens a connection to the specified host and starts an SSL handshake. It prints the exception stack trace of the error that occurred and shows you the certificates used by the server.
It will show "Enter certificate to add to trusted keystore ":
After the message is reported enter "1"
4.The program will display the complete certificate and then add it to a Java KeyStore named 'jssecacerts' in the current temp directory.
5. Copy the "jssecacerts" keystore file from the temp folder to the FglAM jvm security folder (%FglAM_HOME%\jre\<latest 1.8.0.X version>\jre\lib\security), so that the FglAM jvm will recognize the certificate as trusted.
6. Change the "Integration Servlet URL" to use the https port (8443)
https://FMS_hostname:8443/Integration/Write
7. Restart the FglAM. -
Attachments
-
Additional Information
If the FglAM is using a V1.6.* or V1.7.* JRE the following class files can be built so that RESOLUTION 2 can be implemented. InstallCert.class InstallCert$SavingTrustManager.class 1). Download and install the appropriate JDK for the JRE version used by the FglAM. 2). Copy the installCert.java file to the host where the JDK is installed. The file is attached (InstallCert.java file needed to build V1.6 or V1.7 class files) 3).Issue the following command to build the InstallCert.class and InstallCert$SavingTrustManager.class files. $JDK_Path\bin\javac InstallCert.java For example if the V1.6.0_45 JRE is used, the V1.6.0_45 JDK was downloaded, and the JDK is in the "C:\Program Files\Java\jdk1.6.0_45\" directory the following command would be issued to generate the class files: "C:\Program Files\Java\jdk1.6.0_45\bin\javac" InstallCert.java