Packages are uniquely identified in JBoss ON based on their version number Before JBoss ON 3.0.1, the method to calculate the package version ID number was a combination of the package name and the package version, where the package version could be derived from the package manifest or from a user-supplied value. However, this method of calculating the version could be inconsistent and could easily lead to collisions that prevented packages from being properly uploaded and deployed. Yet, the version number itself is critical to maintaining package data.

Starting in JBoss ON 3.0.1, there are two package version numbers:

A version number for the package looks like this:

SpecificationVersion(ImplementationVersion)[sha256=abcd1234]

If the META-INF/MANIFEST.MF file does not contain either the specification version or the implementation version, then only one is used. If neither exists, the SHA is used.

Manifest-Version: 1.0
Created-By: Apache Maven
RHQ-Sha256: 570f196c4a1025a717269d16d11d6f37
...

Versioning only matters to content knit with a resource, like EARs and WARs. Other types of content stored in content sources (like CLI scripts used for alerting) do not track versions. Content deployed in bundles handles versioning through the bundle definition, not the content system.

When the JBoss ON agent starts up, it registers with the JBoss ON server. The JBoss ON server creates an entry based on the given agent name, IP address, and port number. The JBoss ON server also creates a randomly-generated string, a security token, which is also associated with the agent name and with the IP address and port number pair. The agent sends its security token to the server when it restarts as a form of pseudo-authentication.

Prior to JBoss ON 3.0.1, the server allowed an agent to re-register using the same agent name, from a different IP address and port, without the security token. An unapproved agent could use the name and identity of an approved agent. The JBoss ON server simply treated the new agent as if it were the original agent.

The JBoss ON server now verifies the agent identity through the security token before allowing registration changes:

The agent security token is persisted in the agent's Java preferences and remains even if the agent is restarted or uninstalled. The agent command-line options have been updated to help manage the security token in the agent preferences:

These fixes are related to Bugzilla 781964/CVE-2012-0052 and Bugzilla 783008/CVE-2012-0062.

The ContentManagerRemote interface has been updated to accommodate the changes in how the content system handles version numbers. One method is deprecated (void deployPackages), and two new methods have been added (PackageVersion createPackageWithDisplayVersion and void deployPackagesWithNote).

The details of changes between 3.0.0 and 3.0.1 is available with the API at https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Operations_Network/3.1/html/API/index.html.

Some improvements have been made to the way that the CLI works:

After extracting the rhq-remoting-cli-version.zip package, the JBoss ON CLI root directory had global read, write, and execute permissions. Any child directories and scripts old be accessed and modified by any local user. A local attacker could use these permissions to steal JBoss ON user credentials or to run arbitrary code.

If a user authenticating to JBoss ON through LDAP gave invalid credentials, they could still be logged into the JBoss ON UI as long as the user account had successfully logged in using LDAP credentials before.

A remote attacker could use this flaw to gain access to the JBoss ON server using an LDAP account without supplying a password.

In some circumstances, Tomcat could allow a denial of service attack if an attacker triggered predictable collisions in the hashing algorithms used by Java, Python, PHP, and other languages in POST statements. The collisions would cause CPU usage to spike to 100% and effectively cause a denial of service.

The version of JBossWeb used by the JBoss ON server has been upgraded to include fixes for CVE-2011-4858.

The JBoss Operations Network server and agent require Java 6. Any operating system which supports the appropriate JVM could be run a JBoss ON server or agent. Check with Red Hat support for specific platform and environment information.

These platforms are fully supported with native JVM support:

The JBoss ON server requires a Java 6 JDK, while the JBoss ON agent requires a Java 6 JRE.

JBoss Operations Network 3.0.1 supports these databases for the JBoss ON server:

Regardless of the server or database platform, there are certain minimum requirements that must be met to install the JBoss ON server and its associated database.

Sun and OpenJDK Java are supported.

The Installation Guide has more information on configuration databases for the JBoss ON server, upgrading servers, and other installation information. This is a quick summary of performing an initial installation.

Bugzilla 801551

Some information about the server cannot be changed during upgrade. Even though the fields are editable in the upgrade form, changing these values from the original settings causes upgrade problems. This includes information like the server name. If any of that information changes, then one of the results is NPEs in the server logs.

For example, the process to register the upgraded server plug-ins fails with a null pointer exception. For example:

2012-03-08 20:33:34,523 ERROR [org.rhq.enterprise.server.core.plugin.ServerPluginScanner] Failed to register server plugin file [/home/hudson/jon-server-3.0.1.GA/jbossas/server/default/deploy/rhq.ear/rhq-serverplugins/rhq-serverplugin-ant-bundle-4.2.0.JON.3.0.1.GA.jar]
java.lang.NullPointerException
	at org.rhq.enterprise.server.core.plugin.ServerPluginScanner.registerServerPlugin(ServerPluginScanner.java:212)
...

This error only occurs if a different server name was entered in the configuration page when the server was upgraded. Changing the Server Name field is not supported for upgrades.

Bugzilla 536007

If the installer is not bound to 0.0.0.0 when setting up a server, then it does not set all of the required connection properties. Specifically, the installer does not set the java.rmi.server.hostname parameter to the real value, and it uses the default of 0.0.0.0. This parameter must be set to the real IP address of the server by manually editing the rhq-server.properties file.

Bugzilla 588381

Automatic upgrades of agents on Windows appear to fail. Two conditions must be true for automatic upgrade of agents to work on Windows:

Bugzilla 616979

When starting a server while agents are running, the server may log servlet errors in the logs. This is because the remoting (communications) classes are loaded early in the startup sequence, before the server is completely started. This causes some communications interruptions until the server is completely started. These errors can be ignored.

Bugzilla 617123

If a JBoss ON server was added to the resource inventory, the old JBoss ON server resource must be deleted from the inventory after upgrade. The old resource entry is unusable after upgrade.

Bugzilla 663610

Null pointer exceptions for the org.apache.catalina.connector.CoyoteAdapter service are returned when the JBoss ON 3.0.1 server is first installed. These errors are harmless and can be ignored. Installation will complete successfully, and both the server and the GUI will start and run properly.

Bugzilla 742486

The installer shows non-replaced {} properties.

Bugzilla 579766

The password mechanism in the server installer doesn't properly hash Unicode characters. The Unicode characters are translated into the HTML entities, and then the HTML characters are hashed and stored as the password.

For example, the string 你好 is treated as the string 你好 in the installer, and the second string is the one that is hashed and stored in the rhq-server.properties file.

After configuring the server, but before logging in, manually update the password in the rhq-server.properties file:

Bugzilla 828938

When a plug-in, effectively a resource type, is deleted, the agent's plug-in container is automatically rebooted, to reload the new configuration. If the agent itself is running as a daemon, then rebooting the plug-in container also kills the agent thread. That means that if a plug-in (with resources of that type in the inventory) is deleted while the agent is running in the background, the agent process is stopped.

The agent can be restarted without any errors, and the plug-in is successfully removed.

Bugzilla 782915

Attempting to use the config import command in the agent command prompt fails with an InvalidPreferencesFormatException exception.

java.util.prefs.InvalidPreferencesFormatException:
org.xml.sax.SAXParseException; lineNumber: 2; columnNumber: 41; Document root
element "preferences", must match DOCTYPE root "null".
...

Bugzilla 787017

The JVM can sometimes cause the agent to crash when Augeas is running.

A fatal error has been detected by the Java Runtime Environment
...

Bugzilla 675862

The agent assumes that PostgreSQL uses a default password. If a different password is used, the PostgreSQL resource is shown as unavailable in the UI even if it is running.

Bugzilla 749642

A dynagroup definition with a short recalculation interval (less than two minutes) can cause duplicate groups to be created.

Bugzilla 785160

Changing the recursive setting on a group disassociates the group from any roles it was (previously) associated with.

Hot deployment fails if the file changes during provisioning.

If a bundle is being deployed in a hot deployment and one of the underlying bundle files, like a WAR or JAR, is changed while the bundle is being uploaded, then provisioning will fail.

Bugzilla 615978

Using the Recipe option to upload a recipe file separately than the bundle archive files requires that the XML in the recipe be well-formed and that all tags are explicitly closed, using the format <tag></tag>, not the abbreviated format <tag />.

Additionally, the Recipe option's upload button does not work on Internet Explorer. To add a recipe file using this option with Internet Explorer, copy the entire recipe file and paste it directly into the text box.

Bugzilla 759166

The <rhq:system-service> Ant tag only works on Red Hat Enterprise Linux systems. Using the tag and then deploying the bundle to other operating systems causes the Ant task to fail to operate and can cause the deployment to fail.

Bugzilla 785208

A repository can only be used for one resource, the one it was initially defined for.

Bugzilla 796169

Attempting to upload a CLI script directly to a repository to use for alerting fails because it says the SHA-256 checksum for the script is not an OSGi string. Uploading a CLI script through the alert configuration UI works successfully.

Bugzilla 796169

Attempting to delete a repository with a space in the name throws an exception and the deletion fails.

Bugzilla 796192

Deploying WARs from a content repository is not supported. WARs and EARs should be deployed using bundles.

Bugzilla 642674

The JBoss ON remote API cannot be used to connect to the JBoss ON server when the client is running inside an application server. For example, the remote API cannot be run from a client inside an EAP instance; it fails with errors like the following:

Caused by: java.lang.IllegalArgumentException: interface
org.rhq.enterprise.server.auth.SubjectManagerRemote is not visible from class
loader
at java.lang.reflect.Proxy.getProxyClass(Proxy.java:353)
at java.lang.reflect.Proxy.newProxyInstance(Proxy.java:581)
at
org.rhq.enterprise.client.RemoteClientProxy.getProcessor(RemoteClientProxy.java:69)

Bugzilla 787322

The JBoss ON CLI hangs if it is executed as a service or in the background.

Problems with Sessions and Multiple Tabs

If there are multiple tabs open to the JBoss ON UI and one of those sessions times out, then the other tabs will register errors. This can also occur if multiple people are logged into JBoss ON as the same user.

Bugzilla 784571

If there are more than 200 children for a resource, not all of the children are displayed in the resource tree. Additionally, refreshing the tree may display a different subset of child resources.

Bugzilla 796096

All of the buttons on the Inventory tab are disabled after a child resource is created.

Bugzilla 703856

Searching for a resource with a backslash (\) in the name returned no results, even if the resource exists.

Bugzilla 736732: Bookmarked UI Pages May Display the Old UI

The page names used for different pages in the JBoss ON UI for version 3.0 are different than the ones used in JBoss ON 2.4. However, because JBoss ON 3.0 retains some of the elements used in the older JSF-based UI, these pages still exist. This means that bookmarks will go to the old style pages.

For example, the Dashboard page in the old JSF UI had the URL http://localhost:7080/Dashboard.do/. In the new UI, the location is http://localhost:7080/coregui/#Dashboards.

All of the new pages have the coregui/ element in them. Remove any old bookmarks and replace them with the new GWT-based pages in the coregui/ area.

Bugzilla 781797

A user-defined baseline value for a metric is ignored and overwritten by the server-calculated baseline.

Bugzilla 786889

Setting a metric collection interval to zero (0) seconds results in out of memory errors for the agent and metric collection fails. That is an invalid setting for the collection interval and should not be used.

Bugzilla 795531

The agent returns invalid values for thread-related metrics for a Tomcat instance if the Tomcat connectors are configured to use a shared thread pool (executor).

Bugzilla 797325

In Oracle, the alert notification table is created with the NOLOGGING option. This means that users are required to review the alert notification configuration manually for every alert to verify that the configuration is correct.

Bugzilla 741414

Alerts with compound AND conditions can incorrectly fire when one of the conditions goes from true to false within 30 seconds of the other condition going from false to true.

Bugzilla 742804

Alert conditions and alert notifications in an alert definition cannot be edited. The condition or notification must be deleted and a new item added.

Bugzilla 801504

Recovery alerts are not triggered by an availability condition.

Bugzilla 768099

Drift definitions can be created for resources which do not support drift, using the remote API to create a script.

Bugzilla 758426

Drift monitoring is not supported for embedded web applications, only for standalone applications.

Bugzilla 790753

The assumption is that the JBoss ON agent and resources like a JBoss server or Tomcat server run as the same system user. If the agent user is different than the resource user, then there can be problems when one entity makes a configuration change and the other attempts a change later.

For example, when deploying an application, the deployment operation is initiated by the agent and the content is supplied through the agent, and then the application server completes the actual deployment. When deleting an application, the application server handles the undeployment by itself.

If a WAR file is deployed exploded without a MANIFEST.MF file, the agent creates one when it writes the SHA-256 value for the package. When the JBoss AS server tries to remove the WAR application later (and the JBoss AS user is different than the agent user), then the removal fails. The JBoss AS server cannot delete the MANIFEST.MF file. The agent then rediscovers the application directory and re-initiates the deployment operation for the removed WAR.

Bugzilla 801432

If a resource is ignored in the discovery queue, the server throws a ConcurrentModificationException error.

15:17:56,508 WARN  [DiscoveryBossBean] Could not perform commit synchronization
with agent for server [OpenSSH sshd]
java.lang.RuntimeException: java.util.ConcurrentModificationException
        at
org.rhq.core.pc.inventory.InventoryManager.synchInventory(InventoryManager.java:1072)

Bugzilla 772790

If a WAR file is configured to be deployed to a non-standard location on a Tomcat application server, an invalid deployment name is added to the inventory. The unpackWARs option extracts the web app to a second, invalid directory. For example, if it should be extracted to /myapps/helloworld, the web app is extracted both there and to /myapps#helloworld.

Bugzilla 671496 and Bugzilla 671500

If EAR, WAR, or script resources are deleted, the agent throws an exception during discovery, and the server is not informed that the resource was deleted.

Bugzilla 696151

Apache directives are case-insensitive, but the Apache plug-in treats them as if they were case-sensitive. This makes the plug-in disregard directives with non-default case.

Bugzilla 699870

Discovering a JBoss AS instance fails if the configuration directory is a URL.

Bugzilla 699893

The discovery process fails to determine the JNP URL if the data directory is not located at ${jboss.server.home.dir}/data.

Bugzilla 701092

Turning off an agent does not show the platform as unavailable for 15 minutes, the time of the next agent availability report.

Bugzilla 731101

Shutting down a JBoss AS 5 resource can fail with java.rmi.NoSuchObjectException: no such object in table.

Bugzilla 734141

It is not possible to add some system properties for a JBoss AS resource.

Bugzilla 797331

The inventory for a Linux platform may discover non-existent network adapters, which are added and then shown as unavailable in the inventory.

Bugzilla 782826

The JBoss AS plug-in is unable to load resource configuration for JMS queues that are deployed using a SAR file.

Bugzilla 795500

The agent cannot discover a Tomcat instance if its Java process is running as a user other than the system user that the agent is running as.

Bugzilla 738209

A role cannot be deleted if an LDAP group is assigned as a member.

Bugzilla 734527

Attempting to update the members in a compatible group with thousands of members times out and fails with 'Failed to fetch Resource Group.'

Bugzilla 737193, Bugzilla 737190, Bugzilla 738799

Viewing configuration, alerts, or other data for groups with more than 1000 members can fail with the SQL exception maximum number of expressions in a list is 1000.

Bugzilla 795559

If an embedded plug-in extension is defined and the parent resource type has subcategories, those subcategories cannot be changed or it causes a database deadline.