How to configure Strong Encryption for Website deployed on Weblogic Server?

Assumption: HTTPS is already configured and its using default SSL Version 3 and default Ciphers.

Newer versions of web browsers (e.g. Chrome) are now configured with policies which only allow websites or portal which enforce the strongest encryption technology to be viewed. SSL version 3 is no more secure due to POODLE attack. Most of the browser disabled support for SSL Version 3 by default. 

Google chrome (version 40+) will throw following error if Weblogic server is configured (by default) to use SSL Version 3.

SSL server probably obsolete.

ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION

Firefox Version 34+ throw following error in case website is using SSL Version 3:-

Secure Connection Failed

An error occurred during a connection to <DNS>. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)

SSL Lab report will show following results if you are using SSLV3:-

Solution:

We need to disable SSL Version 3 and enable TLS protocol. We also need to enable strong ciphers. We can set either of the following system properties in the command-line argument that starts WebLogic Server:

·         weblogic.security.SSL.protocolVersion=TLS1

·         weblogic.security.SSL.minimumProtocolVersion=TLS1

I would suggest to use 2^nd option. This property value enables any protocol starting with "TLS" for messages that are sent and accepted; for example, TLS V1.0, TLS V1.1, and TLS V1.2.

Implementation in Weblogic Server:-

1.     Enable “Use JSSE SSL” option from WLS Console. For this purpsoe go to Servers> AdminServer or Managed Server >>Configuration>>SSL [Advance Tab]

2.     Now Shutdown domain

3.     Create a custom environment setting file “setCustomEnv.sh” with following lines:-

JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1.0"

export JAVA_OPTIONS

4.     Include setCustomEnv.sh file into $DOMAIN_HOME/bin/setDomainEnv.sh file:-

if [ "${WEBLOGIC_EXTENSION_DIRS}" != "" ] ; then

                JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.ext.dirs=${WEBLOGIC_EXTENSION_DIRS}"

                export JAVA_OPTIONS

fi

. ${DOMAIN_HOME}/bin/setCustomEnv.sh

JAVA_OPTIONS="${JAVA_OPTIONS}"

export JAVA_OPTIONS

5.     Add following lines in $DOMAIN_HOME/config/config.xml
<server>

<name>AdminServer</name>
<ssl>

      <enabled>true</enabled>

      <ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_RSA_WITH_AES_256_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>

      <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA256</ciphersuite>

      <ciphersuite>TLS_RSA_WITH_AES_256_CBC_SHA256</ciphersuite>          

      <hostname-verifier xsi:nil="true"></hostname-verifier>

6.     In order to support strong ciphers (AES 256), we need to download install JCE package for JDK. Download the JCE package from the following location:
http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

7.     Extract the downloaded zip and place the two .jar files US_export_policy.jar and local_policy.jar into your $JDK_HOME/jre/lib/security folder and overwrite old files.

8.     Start the domain

9.     Once server started, verify the site on different browser. I tested on Chrome version 45

10.  Clear the cache of the SSL lab site and scan the website again. You will see A-. Not bad J

You can configure strong ciphers using above method in any oracle product as far its using Weblogic Server.

Note: Starting with the January 20, 2015 Critical Patch Update releases (JDK 8u31, JDK 7u75, JDK 6u91 and above) the Java Runtime Environment has SSLv3 disabled by default.

Reference: http://www.oracle.com/technetwork/java/javase/documentation/cve-2014-3566-2342133.html

How to configure SSL for Admin server when configured multiple authenticators

Symptoms:

We are getting following errors when we enabled SSL port and disabled non-SSL port for Admin server and try to check-in document in WCC:-

<oracle.ods.virtualization.engine.backend.jndi.DefaultAuthenticator.BackendJNDI> <LIBOVD-60143> <[#DefaultAuthenticator]  Unable to create connection to ldap://[localhost]:7002 as null.

javax.naming.CommunicationException: simple bind failed: localhost:7002 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException:

Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]

        at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218)

         at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)

Cause: 

When we configure Admin Server to communicate over SSL then defaultLDAP automatically configure to communicate over SSL protocol (LDAPS). In case of multiple authenticators, and one of them is configure to communicate over SSL, we need to put the corresponding LDAP server's root certificate in an additional keystore used by the virtualisation (LibOVD) functionality otherwise application is unable to establish connection with defaultLDAP (ldaps://localhost:7002).

Solution:
Pre-requisites: Before completing this task, make sure the following configurations:-

• Configure the custom property called virtualize, and set its value to true.
• Admin Server SSL port is not enabled. (*) 
• Managed servers are down 

Steps:

1. Create the keystore:

a.      Set environment variables ORACLE_HOME, WL_HOME and JAVA_HOME.

export ORACLE_HOME=/u01/app/oracle/product/middleware/WC1

export WL_HOME=/u01/app/oracle/product/middleware/wlserver_10.3

export JAVA_HOME=/u01/app/jdk1.7.0_65/

b.      Setup the keystore by running libovdconfig.sh using -createKeystore option.

Open a shell prompt and change the directory to <MW_HOME>/oracle_common/bin. Then, run the following command:

./libovdconfig.sh -host <AdminServerHostName -port 7001 -userName weblogic -domainPath  <DomainPath> –createKeystore

      Enter AdminServer password:[Enter weblogic password]
Enter OVD Keystore password:[Enter a new password to secure a Keystore file]

Once this command runs, we see two new credentials in the Credential Store and a new Keystore file called adapters.jks under <DOMAIN_HOME>\config\fmwconfig\ovd\default\keystores.

2. Export the root certificate from the Admin Server SSL certificate or LDAP directory.
3. Import the root certificate to the libOVD keystore using the keytool command:

$JAVA_Home/bin/keytool -import -keystore adapters.jks -storepass <KeyStore password> -alias <alias of your choice> -file <Admin Server Certificate filename>

4. Enable SSL port and disabled non-SSL port of Admin server. (*)
5. Restart Admin Server and start all the managed servers.

* No need for this step if we are just configuring multiple authenticators with non-defaultLDAP (AD/OID) is communicating over SSL

Reference : Above steps are documented in Oracle BI security Guide: http://docs.oracle.com/cd/E21764_01/bi.1111/e10543/ssl.htm#BIESC6078

Oracle Weblogic Server : Enabling Log rotation of .out file

There is no way to rotate out file from Oracle Weblogic Server Console or EM. To enable log rotation of the out log file on a Linux-based system, perform the following steps:

1. Ensure that you have the logrotate binary installed on your operating system:

ls /usr/sbin/logrotate

2. Create a logrotate configuration file (for example, under /home/oracle/ scripts/logrotate.conf) with the following contents, setting [Domain] to your domain name:

/home/oracle/SOA_DOMAIN/servers/soa_Srv01/logs/soa_Srv01.out {

missingok

copytruncate

compress

rotate=5

size=5M

}

3. Create a logrotate status file (for example, under /home/oracle/scripts/ logrotate.status) with the following contents, setting [Domain] to your domain name:

logrotate state -- version 2

"/home/oracle/SOA_DOMAIN/servers/soa_Srv01/logs/soa_Srv01.out" 2012-1-1

4. Add a new crontab entry by typing crontab -e and adding the following line:

0,15,30,45 * * * * /usr/sbin/logrotate -s /home/oracle/scripts /logrotate.status /home/oracle/scripts/logrotate.conf

This will check every 15 minutes to see if it is necessary to rotate the soa_server1.out standard out file based on the rules defined in the logrotate.conf configuration file. If new log files are added, you must ensure that they are added to the status file or they will not be rotated. This can be repeated for other managed servers as necessary.

You can run the cron job manually to test it.
/usr/sbin/logrotate -s /home/oracle/scripts/logrotate.status /home/oracle/scripts/logrotate.conf

Note: 

You can apply above steps for any Oracle middlware products like Oracle Weblogic Server, WbCenter, SOA, BPM, IDM etc. As this is a linux cron job, I believe its not WLS version specific. 

Right strategy to set startup (JVM+NON-JVM) arguments and debug flags in Weblogic Server

Note: This strategy is applicable in Oracle Weblogic Server, Oracle WebCenter Portal, Oracle SOA/BPM Suite, Oracle WebCenter Content and other Oracle products which are using Weblogic Server. 

Step-by-step guide

1. Finalise the right way
   
   There are two options to configure the JVM arguments:
   1. Via the "Server Start" tab at Administration Console , which is equivalent to the <server-start/> tag in config.xml
   2. Via the script file(startXXX.sh and setXXX.sh) under DOMAIN_HOME/bin/ of each server
   The problem of Option 1 is that the JVM parameters you put in <server-start/> via either Console or directly via config.xml will take effect only if you start the server from NodeManager. If you start the server via scripts, e.g., startWebLogic.sh, the parameters in <server-start/> in config.xml will be ignore.
   For Option 2, if you start servers via scripts under DOMAIN_HOME/bin, specifying JVM parameters will of course work. And as long as you set the StartScriptEnabled=true and StartScriptName=startWebLogic.sh, as required by the Enterprise Deployment Guide, starting servers via NodeManager will also call the same startWebLogic.sh scripts, and hence will pick up the JVM arguments you set there. So you are covered both ways.
   I would go with Option-2 as its covered both ways (nodemanager and startup script), its easy to change via Hudson or manually, its less risky approach as compared to config.xml.
2. Finalise the right script file
   Now, we have chose the right way to specify JVM arguments. Next step is right file to specify the arguments. There are following two files to specify the JVM arguments and non-JVM arguments:-
   1. startWeblogic.sh
   2. setDomain.sh
   setDomain.sh is the right file to specify JVM arguments. This file is called by all startup script like startWeblogic.sh and startManagedServer.sh and nodemanager. Although, startWeblogic.sh is also called by startManagedServer.sh and nodemanager but setDomain.sh is the more logical choice due to its purpose and name.
3. Finalise the right variable
   
   After choosing the right file, next step is choosing the right variables. There are a lot of variables that are related to JVM arguments: MEM_ARGS, USER_MEM_ARGS, JAVA_OPTIONS, JAVA_PROPERTIES etc. Oracle recommend to use the JVM memory settings (i.e. max and min heap size, PermGen size, etc) via variables USER_MEM_ARGS, and specifying any other JVM arguments or non-JVM arguments via JAVA_OPTIONS.
   The advantages of using USER_MEM_ARGS:-
   1. It will override the all standard memory arguments passed to JAVA.
   2. It will reflect right parameters in the server startup logs.
    
4. Finalise the right location in the script file
   It is important to specify the USER_MEM_ARGS in the right location of setDomain.sh file. Following is the right location:-
   
   ==================================================================================
   #IF USER_MEM_ARGS the environment variable is set, use it to override ALL MEM_ARGS values:-
   USER_MEM_ARGS="-server -Xms2g -Xmx2g -XX:PermSize=256m -XX:MaxPermSize=512m -XX:+UseG1GC -XX:ParallelGCThreads=4"
   export USER_MEM_ARGS 
   if [ "$
   {USER_MEM_ARGS}" != "" ] ; then
   MEM_ARGS="${USER_MEM_ARGS}
   "
   export MEM_ARGS
   fi
   ==================================================================================
5. Finalise the right way to specify the JVM arguments per server
   In such case you can script your JVM settings based on the server names in setDomainEnv.sh file like
   #In case of Admin Server
   if [ "${SERVER_NAME}" == "Admin_Server" ] ; then
   USER_MEM_ARGS="-Xms1024m -Xmx1024m"
   export USER_MEM_ARGS
   fi
   
   #if server name contains WLS_SERVER*if [[ "${SERVER_NAME}" == "WLS_SERVER*"]] ; then
   USER_MEM_ARGS="-server -Xms2g -Xmx2g -XX:PermSize=256m -XX:MaxPermSize=512m -XX:+UseG1GC -XX:ParallelGCThreads=4"
   export USER_MEM_ARGS
   fi
6. Other recommendations about better management
   a. To be safe, it is better to move the all custom arguments (JVM + NON-JVM) to an external script (e.g. setCustomEnv.sh), and source this external script from setDomainEnv.sh file like:-
    
   -------------------------------------------------------------------------------------------------------------------------------------------------
   #IF USER_MEM_ARGS the environment variable is set, use it to override ALL MEM_ARGS values
    
   . ${DOMAIN_HOME}/bin/setCustomEnv.sh
    
   if [ "${USER_MEM_ARGS}" != "" ] ; then
   MEM_ARGS="${USER_MEM_ARGS}"
   export MEM_ARGS
   fi

         -------------------------------------------------------------------------------------------------------------------------------------------------

        b. To easy to manage and easy to change, we can put the setCustomEnv.sh at a shared file system. So you keep only one copy of it where all the JVM settings are centralised. This single copy of setCustomEnv.sh can be referenced by the individual setDomainEnv.sh for each server.

All done. 

When we need a new Weblogic Domain?

Depending on your particular business needs and system administration practices, you might decide to organize your domains based on criteria such as:

1. If you have different applications using the same set products  but their maintenance requirements (patching, backup etc) are different.
2. If you have different applications using the different version of the Oracle WebLogic Server software (Weblogic, WebCenter Portal, IDM, SOA etc)
3. Different System administrators are responsible to manage different applications due to physical location, or branches of your business.
4. Different applications are using different LDAP providers and your top requirements are Performance and Security
5. If you want to segregate domains according to product components (WC, SOA, WL etc) or physical tier [Presentation, Integration, Service, Data etc] to achieve better maintainability
6. If you want to segregate domains according to logical divisions of applications. For example internet applications and intranet applications OR financial applications and portal applications.

Hiden Gem of Oracle WebCenter: Spaces Automatic Services Configuration

Spaces supports automatic configuration of certain Oracle WebCenter Portal services.  Mean, you don’t need to set discussion, portlet, UCM services etc from the EM manually. This feature is available from 11G PS3 onward.

The Automatic Service Configuration only worked if the following conditions are met:

• Spaces and the target component must be installed in the same domain.
• The managed server of the target component must have an explicit listening address. If its listening address is empty or null or "localhost", then it must have a system associated to it that has an explicit address.
• The target component (like discussions, ucm, pagelet etc) must not be deployed to a cluster.
• You must start the managed servers associated to the WebCenter Portal services first. Then, start the WC_Spaces managed server.

Currently, automatic Service Configuration is implemented for the following Services:

Component/Service	Default Connection Name	Specific Rule
Discussions and Announcements services	WebCenterSpaces-Discussions	The user granted the Administrative role exists in discussions.
Documents service	WebCenterSpaces-ucm
Pagelet producer	WebCenterSpaces-PageletProducer
Personalization service	Conductor-WCPSSpaces  and Properties-WCPSSpaces
Preconfigured portlet producers	wc- OmniPortlet wc-WebClipping wc-WSRPTools
Worklist service and Spaces workflows	WebCenterSpaces- Worklist

Every time you start Spaces it will try to create the connections unless they already exist. This will be true until the service is configured for the first time unless you disable automatic service configuration. If the automatic configuration fails for a specific component, then you will have to manually configure the service.

You can verify from the EM that service connections are automatically configured for the Spaces application when you start the managed servers.

If required, you can disable the auto-configuration feature by setting the following Java property in domain_home/bin/setDomainEnv.sh  (on UNIX) or domain_home\bin\setDomainEnv.cmd (on Windows). 

-Dwebcenter.spaces.disableAutoConfigure=true

Reference:

Oracle® Fusion Middleware Installation Guide for Oracle WebCenter Portal
11g Release 1 (11.1.1.6.0)


4.2 Working with Oracle WebCenter Portal: Spaces
http://docs.oracle.com/cd/E23943_01/install.1111/e12001/wc_components.htm#CHDGEJFG

Start WebLogic’s Managed Server without Username and Password manually

After you installed Fusion Middleware products like WebCenter, UCM, SOA etc you have plenty of Managed Servers (MS) and you have to enter username and password when you start each Managed Server (WC_Spaces, UCM_server1, IBR_server1, WC_Portlet, WC_Utilities, BAM_server1 etc) from the command line.  To make it automatic so that you don’t need to enter username and password. Follow the following steps:-

Apply to all the managed servers (Unsecured and simple way)

If you want that all my Managed Servers (MS) will not prompt for username and password then this approach is for you. In this approach, you just need to change one file and all the MSs will not prompt you for username and password without doing any change in individual MS. Follow the following instructions:-

1.       Go to bin of weblogic domain. In my case, following is the domain path:- <Middleware-Home>\user_projects\domains\<doman>\bin i.e. C:\Oracle\Middleware\user_projects\domains\wc_domain\bin

2.       Open the startManagedWebLogic.cmd in any text editor

3.       Set the following two variables with your weblogic admin user and its password

Set WLS_USER=<Admin-User-Name>
Set WLS_PW=<Admin-User-Password>

4.       Save the file and now start your MS from the command line.

startManagedWeblogic <MS-Name> <Admin-Server-IP:Port>

i.e. startManagedWeblogic WC_Spaces http://127.0.0.1:7001

If everything is ok then it should not prompt you for username and password.

Pls note that username and password will remain unencrypted.

Apply to individual MS changes (Secured and recommended way)

If you want to go with secured way and want to configure few servers that will run without asking for username and password then you need to go with this approach.

1.       (First time only). If you not started your MS before, you need to start it once from the command line so that it create required directories inside <Middleware-Home>\user_projects\domains\<domain> \servers\<MS-Name> i.e. C:\Oracle\Middleware\user_projects\domains\wc_domain\servers\UCM_server1

2.       Once started successfully, shutdown it.

3.       Create a security folder  in <MS-Name> folder

4.       Copy the boot.properties file from <MiddlewareHome>\user_projects\domains\wc_domain\servers\AdminServer and past it into newly created security folder.

Pls note that you can also create a boot.properties, just open any text editor like notepad and enter the following content:-
username=weblogic
password=welcome1
Don’t worry about plain text username and password. Once you start your MS, username and password will be encrypted with AES and will remain encrypted.

End-to-end Weblogic Clustering steps with Apache Proxy Plug-in

End-to-end Weblogic Clustering steps with Apache Proxy Plug-in

Purpose

This tutorial will give you quick overview about how to create a new cluster using tow physical boxes and how to configure Apache Proxy Plug-in as a load balancer. It is assumed that person must have good knowledge of J2EE & Weblogic Server.

Topics

This tutorial covers the following topics:

1.      Overview

2.      System Requirements

3.      Creating a Cluster

4.      Monitoring the Cluster

5.      Load Balancing using Apache Web server & Proxy plug-in

6.      Create a clustered-enabled web-application for Weblogic Server

7.      Deployment on Clustered

8.      Best Practices

9.      Related Information

Overview

A WebLogic Server cluster consists of multiple WebLogic Server instances, running simultaneously and working together to provide increased scalability and reliability. A domain includes one or more WebLogic Server instances, which can be clustered, nonclustered, or a combination of clustered and nonclustered instances. A domain can include multiple clusters.

A cluster appears to clients as one WebLogic Server instance. The server instances that constitute a cluster can run on one machine or on different machines. You can increase a cluster’s capacity by adding server instances to the cluster on an existing machine, or by adding machines to the cluster to host the incremental server instances.

All server instances in a cluster use multicast or unicast to broadcast regular server heartbeat messages to other members of the cluster. Each heartbeat message contains data that uniquely identifies the server that sends the message. Servers broadcast their heartbeat messages at regular intervals. In turn, each server in a cluster monitors the multicast or unicast address to ensure that all peer servers’ heartbeat messages are being sent.

System Requirements

Make sure that your system environment meets the following requirements:

Software Requirements

• Ms. Windows 20003
• Oracle Weblogic Server 10.3
• Apache Web Server 2.2

Minimum Hardware Requirements

Item	Specification
Processor Type	Intel Xeon
Processor Speed	2.4 GHz or higher
Number of Processor	1 or more (if required)
Memory	4 GB
Free Hard Disk Space	20 GB
Operating System	MS. Windows 2003

Creating a Cluster

Perform the following steps:

1.      Install Weblogic Server in Box-A and Box-B in the same directory structure.

Box-A   Suppose IP Address is : 192.168.1.1
Box-B   Suppose IP Address is : 192.168.1.2

2.      Create a Domain (myDomain)  in Box-A then Start the AdminServer (suppose port is 7001 for Admin) of that newly created Domain

3.      Open Admin Console http://192.168.1.1:7001/console

4.       Create two Managed Servers MS3 and MS4 with following configurations.

MS3 Listen Port: 7003
MS3 Listen Address: 192.168.1.1

MS4 Listen Port: 7003
MS4 Listen Address: 192.168.1.2

5.      Create two machines (M1 and M2) with following node manager configuration and add MS3 to M1 and MS4 to M2.

M1
Nodemanager Listen Address: 192.168.1.1
Nodemanager ListenPort: 5556

M2
Nodemanager Listen Address: 192.168.1.2
Nodemanager ListenPort: 5556

6.       Now start NodeManager in Box-A and see in the admin console that its accessible from M1.

Home –>Summary of Machines –>Machine-A –>Monitoring
Make sure that the Nodemanager Status is “Reachable”.

Steps For Box-B (Second Managed Server Box)

7.      Paste the Domain from Box-A to Box-B in the Same Location where it is available in Box-A.

8.      Open the command prompt and set environment variables using setWLS.cmd.

9.      Enroll NodeManager of Box-A with myDomain created in Box-B  using following WLST command:-

nmEnroll('C:/bea/user_projects/domains/myDomain',
'C:/bea/wlserver_10.0/common/nodemanager')

10.            Start the NodeManager at Box-B and login to AdminConsole of Box-A and then check that the Machine-2 Nodemanager is showing “reachable”.

11.  Create a Cluster with following information:-

Field	Value
Name	myCluster
Messaging Mode	Unicast
Clustered Address	192.168.1.1:7003, 192.168.1.2:7003

12.  Click myCluster. Click the Configuration > Servers tab.



Add MS3 and MS4 servers in myCluster and click Finish.

13.  Start the MS3 using following shell command:-

myDomain\bin>startManagedWebLogic.cmd MS3 192.168.1.1:7001 from Box-A

14.  Watch the server start up using the shell's standard output stream.  At some point, you should see it begin listening for cluster communication and begin waiting to synchronize with other servers in the cluster. Because the other servers have not started, there is nothing for it to synchronize with yet:

<Jun 3, 2010 5:41:36 AM CDT> <Notice> <Cluster> <BEA-000197> <Listening for announcements from cluster using unicast cluster messaging>

<Jun 3, 2010 5:41:36 AM CDT> <Notice> <Cluster> <BEA-000133> <Waiting to synchronize with other running members of Cluster_1.>

<Jun 3, 2010 5:42:06 AM CDT> <Notice> <Cluster> <BEA-000162> <Starting "async" replication service with remote cluster address "null">

15.  Repeat the previous steps to start the other managed servers from the Box-B. Once again, use the shell's standard output stream or the server log to confirm that the servers joined the cluster successfully:

myDomain\bin>startManagedWebLogic.cmd MS4 192.168.1.1:7001



<Jun 3, 2010 6:03:07 AM CDT> <Notice> <Cluster> <BEA-000197> <Listening for announcements from cluster using unicast cluster messaging>

<Jun 3, 2010 6:03:07 AM CDT> <Notice> <Cluster> <BEA-000133> <Waiting to synchronize with other running members of Cluster_1.>

<Jun 3, 2010 6:03:16 AM CDT> <Notice> <Cluster> <BEA-000142> <Trying to download cluster JNDI tree from server MS4.>

<Jun 3, 2010 6:03:16 AM CDT> <Notice> <Cluster> <BEA-000164> <Synchronized cluster JNDI tree from server MS3.>

Above information is showing that cluster has been created successfully.

Monitoring the Cluster

1.      Return to the administration console. Select Environment > Clusters from the Domain Structure panel. Then select your cluster.

2.      Click the Monitoring tab. You can see summary, health and Failover tabs. The Cluster—>Monitoring page displays how many Managed Servers are configured for the current cluster, and how many of the configured Managed Servers are currently running. For each Managed Server configured for the cluster, the monitoring table displays the current state of the server instance, and metrics about activity since the server instance was started.

Load Balancing using Apache Web server & Proxy plug-in

The Apache HTTP Server Plug-In allows requests to be proxied from an Apache HTTP Server to WebLogic Server. The plug-in will also serve as a load balancer for Weblogic Server.

Note: You can install apache server on Weblogic machine or separate machine. Assume Apache Web Server is running at http://192.168.1.3:80

The Apache plug-in is distributed as a shared object (.so) for windows.

1.    Copy the mod_wl_22.so (for Apache 2.2) from <Bea-Home>\server\plugin\win\32 to <Apache-Home>\modules\

2.    Add following lines in the httpd.config file for single clustered:-

LoadModule weblogic_module modules/mod_wl_22.so

<IfModule mod_weblogic.c>

WebLogicCluster 192.168.1.1:7003, 192.168.1.2:7003

Debug                    ON

WLLogFile             c:/tmp/global_proxy.log

WLTempDir             "c:/myTemp"

DebugConfigInfo       On

KeepAliveEnabled       ON

KeepAliveSecs         15

DynamicServerList     ON

</IfModule>

<Location /weblogic>

SetHandler weblogic-handler

Path-trim weblogic

</Location>

Note:-  Apache plug-in will treat 192.168.1.1:7003 as primary server. It mean first request will go to MS3 managed server.

3.    Restart Apache Server.

4.      Deploy the application on a cluster. For example your application context path is sessionDemo.

5.      Now, access the application using Apache Server like

http://192.168.1.3:80/weblogic/sessionDemo

Where 192.168.1.3:80 is the IP address and port of Apache Web Server.

6.     To verify the configuration of the proxy server & status of Weblogic Managed Server:-

http://192.168.1.3:80/weblogic/sessionDemo/session.jsp?__WebLogicBridgeConfig

Clustering Best Practices

1. When creating the clustered WebLogic Server instances on a single machine, specify an unused localhost port such as 127.0.0.1 for the Listen Address. If you leave the Listen Address field blank, the server binds to all available IP addresses on the machine. If you specify "localhost" as the Listen Address, the server binds to all localhost addresses (127.0.0.x).
2. When creating a new cluster, it is recommended that you use unicast for messaging within a cluster. For backward compatibility with previous versions, WebLogic Server you must use multicast for communications between clusters.
3. Always specify an unused Multicast address and port number for production clusters. This ensures that only the cluster's messages are broadcast on the address/port combination.

4.      Do not install WebLogic Server on machines that have dynamically assigned IP addresses.

Related Information

• Weblogic Clustering

http://download.oracle.com/docs/cd/E11035_01/wls100/cluster/setup.html

• Weblogic Clustering

http://biemond.blogspot.com/2008/11/build-your-own-weblogic-103-cluster.html

• Cluster unicast messaging mode

http://weblogic-server.blogspot.com/2010_02_01_archive.html

• J2EE Clustering

http://www.theserverside.com/news/1364410/Under-the-Hood-of-J2EE-Clustering

• Installing and Configuring the Apache HTTP Server Plug-In

http://download.oracle.com/docs/cd/E15051_01/wls/docs103//plugins/apache.html