Questions asked by John Moser

Engine Performance - Profiling 2

John Moser — Mon, 02 Mar 2020 08:19:48 -0500

Dear Ivy Team

I've profiled our app with VisualVM and it turned out that bundle.getString consumes about 15% of the time :

ResourceHandlerImpl.getLocalePrefixForLocateResource

...

        try
        {
            ResourceBundle bundle = ResourceBundle.getBundle(bundleName, locale,
                    ClassUtils.getContextClassLoader());

            if (bundle != null)
            {
                localePrefix = bundle.getString(ResourceHandler.LOCALE_PREFIX);
            }
        }

Any idea what is wrong here ?

Best regards

John

Browser back button - any workarounds ?

John Moser — Tue, 18 Feb 2020 09:23:43 -0500

Dear Ivy Team

It seems that Ivy can't handle by default the browser back button if the UI is related to a process. Your proposed solution is to suppress the back button. Imho this is not an acceptable solution especially if everything else reacts correctly to the back button.

I would assume/expect that a Ivy process which is designed with multiple "back paths" should be able to support some kind of a "back button" behavior.

Regards John Moser

Engine Performance - Profiling

John Moser — Fri, 07 Feb 2020 04:14:06 -0500

Dear Ivy Team

My test setup is as follows : 4 CPU (i7, 3GHz), Xms128m, Xmx2048m

2 Browsers, every 3 seconds a click on the UI during 60 seconds

1 With visualvm it shows that Ivy spent approx 16s with reading, the issue is I can not quantify how much data it is (since your performance / rest client logging is not working). But my guess is, it can only be a few hundred KB in total.

=> 16s seem to me a lot, can you confirm my results ?

2 Rest Client - java > Ivy.rest() : is Ivy.rest() client pooled ? (since the Rest Clients are pretty heavy weight they should be pooled otherwise memory consumption skyrockets and also performance will degrade if they are used like in a micro services architecture)

=> Ivy.rest() did you do any performance analysis ? Is this the "required" way of using Rest Client in Ivy ?

IvyLog4jLayout - parameters

John Moser — Mon, 03 Feb 2020 11:32:00 -0500

Dear Ivy Team

For REST logs (rest_client category), I would like to log the elapsed time as well as the amount of data transferred. Any tips how to configure IvyLog4jLayout ?

Best regards John

Performance Logging

John Moser — Fri, 31 Jan 2020 12:56:41 -0500

Dear Ivy Team

It looks like the Performance Logging can only be run in DEBUG level. Unfortunately in DEBUG level the logging crashes almost the Ivy Engine.

Is there a way to simply log the requests (such as the access_log in the original tomcat) ?

Regards John

Resources (css, js, images) in Ivy - performance impact ?

John Moser — Tue, 28 Jan 2020 04:16:07 -0500

Dear Ivy Team

Usually the static web content such as css, js, images etc are offloaded and put in a web proxy in order to reduce the data load for the app server. Of course these files must be cached on the browser side. But still they must expire on a daily basis (since hotfixes can come in on a daily basis).

Any ideas ?

Regards John

Java Mission Controller, Flight Recorder - Access denied

John Moser — Fri, 24 Jan 2020 07:20:21 -0500

Dear Ivy Team

Doing some performance analysis since our app is using a lot of CPU. I've activated

JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=9003 -Dcom.sun.management.jmxremote.login.config=jmx -Djava.security.auth.login.config=configuration/jaas.config -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.autodiscovery=true"

JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=<ip>"

When I connect with Java Mission Controller to Ivy 7 I get the following results :

Start JMX Console : works
Start Flight Recorder : Access denied! Invalid access level for requested MBeanServer operation.

java.lang.RuntimeException: Access denied! Invalid access level for requested MBeanServer operation. at com.jrockit.mc.flightrecorder.controlpanel.ui.FlightRecorderProvider.refresh(FlightRecorderProvider.java:110) at com.jrockit.mc.browser.views.JVMBrowserView$1.run(JVMBrowserView.java:100) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) at Caused by: java.lang.SecurityException: Access property for this identity should be similar to: readwrite create com.sun.management.MissionControl at ....

According to https://community.oracle.com/thread/2588377 :

You need to ensure that the user you want to access the flight recorder has permission to create the relevant MBeans. You have probably defined the roles in the jmxremote.access file. Try adding:

<your-role-name-goes-here> readwrite \ create com.sun.management.,com.oracle.jrockit. \ unregister

=> where can I change this for Ivy ?

Thanks & Regards John

Docker, global variables, app.yaml

John Moser — Tue, 12 Nov 2019 03:57:38 -0500

Dear Ivy Team

It looks like there are 3 places where the global vars can be set : - inside IAR - in DB - in app.yaml

So what is the order how Ivy is looking for the global vars ?

Thanks & Regards, John Moser

Docker, applications folder, deployment

John Moser — Fri, 08 Nov 2019 02:34:12 -0500

Dear Ivy team

When we are building the KLARA image in windows, we get an issue with long file names. We have decided to keep the deployed IARs inside the image. Therefore the deployed apps are part of it. The folder structure looks like this :

jam:~/.../applications/luz$ ls -ltr
total 80
drwxr-xr-x 3 jam jam 4096 Mai  1  2019 luz_components
drwxr-xr-x 3 jam jam 4096 Mai  1  2019 luz_docs_process
drwxr-xr-x 3 jam jam 4096 Mai  1  2019 luz_finance
drwxr-xr-x 3 jam jam 4096 Mai  1  2019 luz_xhrm_processes

and each folder contains all the Ivy stuff. So no wonder build under Windows is an issue due to long file names.

Question : What is needed in these folders ? can we skip some folders/files ?

Request for 7.3.2 : Can you provide a "applications"-less Ivy version which does not require 7.4 ?

Best regards John Moser

7.3.1 deployment - is a zip file still suported

John Moser — Wed, 16 Oct 2019 04:51:02 -0400

Dear Ivy Team

Pre-7.3.1 we deployed a xyz.zip containing the IARs to the deploy folder.

What is the preferred way with 7.3.1 ?

Best regards John Moser

Cross site scripting - XSS

John Moser — Thu, 03 Oct 2019 08:33:45 -0400

Dear Ivy team

Just recently we had a security audit which reported that our app is vulnerable to XSS attacks. The issue is that the Primeface input fields (whatever control) seem not to be escaped. By default it should be escape="true" but it seems it's escape="false" which would be really bad (for all Ivy based applications).

Any idea why this is the case ? May be an outdated jsf lib ?

Best regards John

Define path of the Ivy license file

John Moser — Thu, 03 Oct 2019 08:21:52 -0400

Dear Ivy Team

Is it possible to define the path of the Ivy license file ?

If yes, where has this to be configured.

Best regards John

Ivy 7.2.1 -> 7.3.1 Migration

John Moser — Wed, 25 Sep 2019 07:31:38 -0400

Hi Ivy Team

After migrating sys db and running the application we get the following error :

    Caused by: ch.ivyteam.ivy.persistence.PersistencyException: Unknown system property 'Database.Id'
    at ch.ivyteam.ivy.application.internal.ApplicationConfigurationManager.lambda$32(ApplicationConfigurationManager.java:1351)
    at java.util.Optional.orElseThrow(Optional.java:290)
    at ch.ivyteam.ivy.application.internal.ApplicationConfigurationManager.getSystemProp(ApplicationConfigurationManager.java:1351)
    at ch.ivyteam.ivy.application.internal.ApplicationConfigurationManager.getSystemProperty(ApplicationConfigurationManager.java:1336)
    at ch.xpertline.xent.oauth.ivy.IvySecure.getIvySalt(IvySecure.java:17)

Any idea what is missing ?

Best regards John

Docker, set permissions by yaml file

John Moser — Thu, 19 Sep 2019 11:10:44 -0400

Hi Ivy Team

Is it possible to configure the permissions also by a yaml file ?

Regards John

Docker, pass Ivy license as env prop

John Moser — Thu, 19 Sep 2019 04:51:42 -0400

Dear Ivy team

Is it possible to pass the Ivy license via env prop ?

Reason for my question : as you might know we in KLARA want to build our own image. If the license has to be provided as a file in a certain directory then our image, which is hosted somewhere in the cloud, contains the license. May be not so nice from your point of view.

The idea is that we store the license as a secret and inject it at startup of the image.

Regards John

Ivy 7.3.1, Cockpit, some functionalities missing

John Moser — Tue, 17 Sep 2019 12:40:13 -0400

Hi Ivy team

Finally made to 7.3.1 and I am trying to configure the app as I have done with the old ULC admin client.

It looks to me that there are quite a few configuration items missing, which existed in the old admin client.

Any forecasts when they will be available in the Cockpit ?

Regards John

Docker, Migration 7.2.1 to 7.3.1

John Moser — Thu, 29 Aug 2019 10:33:45 -0400

Hi Ivy Team

I am getting following error message during Ivy startup after I migrated to the 7.3.1 image :

java.lang.Exception: The system database (jdbc:postgresql://10.172.0.9:5432/ivysystemdb_7) with all tables already exists (Version: 50). But was created with a older version of the ivy Engine. at ch.ivyteam.ivy.server.configuration.command.CreateDbCommand.checkIfCreationNeeded(CreateDbCommand.java:114) at ch.ivyteam.ivy.server.configuration.command.CreateDbCommand.createSystemDatabase(CreateDbCommand.java:63) at ...

What has to be done to fix this problem.

Thanks & Regards John

Docker, set admin client / system db values via yaml file

John Moser — Tue, 16 Jul 2019 11:34:51 -0400

Dear Ivy Team

In the Non-Docker world, we have a deployment IAR, which writes config values fed via a script.

With Docker we want to avoid that. The global variables we already configure them via app.yaml. What would be (in the future ?) the best way to configure permissions, iwa_applicationproperty, etc

Best regards, John

Docker, Rerun image with IAR installation

John Moser — Mon, 15 Jul 2019 12:20:24 -0400

Dear Ivy Team

In your example setup, the ivysystemdb exists as an image and is therefore created from scratch every time docker-compose is run. That means you can run the same image as many times as you want.

If we do that in our Dev environment, we are running into the versioning problem (I think), which prevents to rerun of the same image multiple times (Error : The process model version '1' of process model 'luz_web' of application 'luz' is currently unavailable because of maintenance.)

Since our image does the installation as well, it can't be "used" more then one time, which means for each restart we would need a new build of a new version of our app.

Or do I miss something ?

Best regards John

Docker, dropins, AuthenticationValve

John Moser — Fri, 31 May 2019 10:29:36 -0400

Hi Ivy Team

I am building a Docker image based on axonivy/axonivy-engine:7.2.1. In our project we have a few JARs which should go into the dropins folder but during Ivy startup I get the following error :

14:13:05.368 ERROR [org.apache.tomcat.util.digester.Digester] [localhost-startStop-1]    Begin event threw exception
    java.lang.ClassNotFoundException: com.axonivy.auth.valve.AuthenticationValve cannot be found by ch.ivyteam.tomcat_8.5.34.201810151000 ...

4:13:05.380 ERROR [...apache.catalina.startup.ContextConfig] [localhost-startStop-1]    Parse error in context.xml for [/ivy]
org.xml.sax.SAXParseException; systemId: file:/usr/lib/axonivy-engine-7x/webapps/ivy/META-INF/context.xml; lineNumber: 13; columnNumber: 66; Error at (13, 66) : com.axonivy.auth.valve.AuthenticationValve cannot be found by ch.ivyteam.tomcat_8.5.34.201810151000

So far I did the following:

1) Dockerfile:

COPY --chown=ivy:ivy axonivy7-engine-folder-setup/dropins/* /usr/lib/axonivy-engine-7x/dropins/

2) Check if files exist after Ivy startup:

ivy@22ae6389e9e5:/usr/lib/axonivy-engine-7x/dropins$ ls -ltr
total 956
-rwxr-xr-x 1 ivy ivy   2028 Mar  8  2018 README.html
-rwxr-xr-x 1 ivy ivy 962431 Jul 19  2018 com.axonivy.auth.valve.AuthenticationValve_1.0.0.201807190929.jar
-rwxr-xr-x 1 ivy ivy   1622 Aug  1  2018 workflow.klara_patchNoBusinessCaseQuery_1.0.0.201807311434.jar
-rw-r--r-- 1 ivy ivy   8078 Nov  5  2018 webserver.rest.extension.patch_1.0.0.201805241153.jar

3) Check if JARs are listed using ss in console, but all the JARs in dropins are not listed:

Axon.ivy Engine is running and ready to serve. [19778ms] Type 'shutdown' and confirm with ENTER to stop the running engine instance ss "Framework is launched."

id  State       Bundle
0   ACTIVE      org.eclipse.osgi_3.13.0.v20180409-1500
                Fragments=2, 1
1   RESOLVED    ch.ivyteam.ivy.osgi.classpatcher_7.2.1.201811131504
                Master=0
2   RESOLVED    org.eclipse.osgi.compatibility.state_1.1.100.v20180331-1743
                Master=0
3   ACTIVE      org.eclipse.equinox.simpleconfigurator_1.3.0.v20180502-1828

As far as I understood, one should copy the JARs into the dropins folder and it should work

Thanks & Regards John

Docker, Global Properties, Placeholder, app.yaml

John Moser — Mon, 20 May 2019 11:20:27 -0400

Hi Ivy Team

Assuming I have a global prop such as :

myGlobalProp: http://myIP:1234/whatever

myIP is different for Dev, Test and Prod. Is there a way to "inject" myIP at startup of the Docker image ?

Or generally:

If I want to build an image which should be deployed in Dev, Test and Prod, is there a way to parameterize all the config files used for the Ivy Engine (yaml, xml, etc.) ?

Thanks & Regards John

Docker, prevent container being stopped after an exception

John Moser — Wed, 15 May 2019 11:54:13 -0400

Hi Ivy team

Is there a switch or something to keep the container running even if there was a (fatal) exception at boot time of Ivy ?

Currently it's slightly painful to debug ...

Thanks & Regards John Moser

Docker, Dockerfile, what USER to apply

John Moser — Wed, 15 May 2019 11:25:17 -0400

Hi Ivy team

We want to build our own image and we are running in some troubles regarding the USER :

FROM axonivy/axonivy-engine:7.2.1

USER root or ivy or ... ? <--- which one to apply ?

COPY ... CMD ... etc.

Thanks & Regards John Moser

PS: can someone with enough "reputation" put dockerfile into the tag list ?

Docker, IAR deployment

John Moser — Wed, 15 May 2019 11:10:37 -0400

Hi Ivy team

I have a zip file with IARs (but w/o app.yaml) and I use COPY to copy the zip file to the deploy folder of the Ivy engine, where it should be deployed at startup - according to the doc.

a) is this procedure correct ? b) If yes then I get -> Caused by: java.nio.file.FileSystemNotFoundException: /usr/lib/axonivy-engine-7x/applications/projects/authentication_tool_ivy/1.zip

There is indeed a authentication_tool_ivy-7.2.0-SNAPSHOT.iar in the zip file.

Any idea why this error happens ? Any more specific description how the files have to be named ? Is the order how the IARs are listed in the zip file relevant ?

Thanks & Regards John Moser

Request parameter of a xhtml page

John Moser — Fri, 22 Feb 2019 05:42:12 -0500

Hi Ivy Team

I have the following setup: A process is started to display a dialog. In the dialog (..../MyDialog.xhtml) a redirect to another site is executed and the site calls again .../MyDialog.xhtml?myParam=xyz

myParam should be read in a script box - usually one would use

... FacesContext.getCurrentInstance().getExternalContext().getRequestParameterMap().get("myParam")

but looks like this doesn't work. Importantly I can not use the start/param mapping feature.

So is there another way to read the parameter or the request path ?

Thanks & Regards John

Streaming with Ivy REST API

John Moser — Tue, 08 Jan 2019 10:00:55 -0500

Dear Ivy Team

I have the following case: User should be able to upload scanned documents (1...xx MB) via Ivy and the data should be streamed through the REST service (layers). Since each REST service decouples (therefore no shared memory) the memory required to transport the document data could be quite high. To avoid that I would like to stream the data down to the persistency layer.

Problem: Currently I am trying to pass binary data -> "In Inscribe Rest Service Call Activity" -> Body, entity -> binary data and content-type=application/octet-stream and read it by the consumer REST service with HttpServletRequest request->getInputStream(). Though here I get an error (InputStream seems to be already closed).

Question: Is this approach correct or do I have to use multipart/form-data (if yes, do you have an example, especially if the call is executed by the Ivy REST client).

Thanks in advance for a feedback.

Best Regards John

Getting no parent SYS_FK_720 when trying to save business case data

John Moser — Mon, 19 Nov 2018 08:27:29 -0500

Hi guys

I am trying to save business case data inside a "script step" after a user dialog and I get the following error:

Caused by: java.sql.SQLException: Integrity constraint violation - no parent SYS_FK_720 table: IWA_CASE in statement [INSERT INTO IWA_BusinessCaseData (BUSINESSDATAID, OBJECTTYPE, BUSINESSCASEID) VALUES (?, ?, ?)]

Funny thing is, if I save the same data after resp. in a user task, there is no error.

Thanks John