BPM Auditing Demystified

Very Informative Blog Written by A-TEAM - Mark Foster. This blog is about Audit Level for BPM and its effect on Audit ability and Performance.


BPM Auditing Demystified

Enjoy the reading.

Recomendation: Which JDK best suites SUN Java or JRockit

I have always come across this dialama, which JDK between SUN Java (Hotspot) and JRockit  to use when we are installing Oracle Integration Products, i.e, SOA BPEL, BPM, BAM etc.

Here are some of my findings and recomendations:

First we will need to understand What is the difference between the Sun JVM and JRockit JVM?
 
The most well know JVM is the implementation from Sun. The Sun JVM is called HotSpot. The Sun JVM is shipped in the Java Developer's Kit (JDK) and Java Runtime Environment (JRE) from Sun.

The JRockit JVM from is optimized for reliability and performance for server side applications. To achieve this, JRockit JVM uses technologies such as code generation, hot spot detection, code optimization, advanced garbage.

To know more about the differences or futures of JRockit refer Oracle JRockit Frequently Asked Questions
 
Also as JRockit has been the propitiatoryJDK for BEA, I would use JRockit in Production or similar environment.

For developer environment I believe we should be OK to use either or. If you plan to debug or examine your code with Java Mission Control or want extended futures from Flight recorder than undoubtedly JRockit is your JDK.

If you have more to add please comment below.

Chaw.

Setting Persistence or other Transport Headers for MQ Transport in OSB (Oracle Service Bus)

Setting Persistence For MQ Transport in OSB

This blog applies to Oracle Service Bus only.

Have you been trying to make your MQ messages persist on the MQ server. Than you have landed in the right blog. Follow the steps below to set up MQ Transport to persist the MQ messages on the MQ server.

If you were familiar with weblogic JMS messaging, it is very easy to make a JMS message persist on the weblogic JMS server using OSB as the producer. You can do this by checking the Persistence check box in the business service. But it is not the case if you would want to perform the same  for an MQ message on MQ server using OSB MQ transport.

Steps to make your MQ message persist on MQ server using OSB MQ transport:

Assumption: 

a. You are using publish action to publish your MQ messages.

b. The below steps are performed on the OSB console.

1. Open your Proxy or Local Proxy Service

2. Navigate and Edit the Stage where Publish action exist.

3. Navigate to the Request action of Publish

4. Right Click --> Add an Action --> Communication -->  Transport Headers.

5.  Set "SET TRANSPORT HEADERS for" to "Outbound Request" and Click "Add Header"

6. Click drop down for "SOAPAction" and select Persistence.

7. Click Expression and set the value to be set.  

Note: you can repeat steps 5 to 7 to set various other MQ transport headers values. For the entire list of MQ transport headers and their description please visit the blow mentioned Oracle Document:

Document: Oracle® Fusion Middleware Developer's Guide for Oracle Service Bus

11g Release 1 (11.1.1.4.0)

Section: 33.8.5 Transport Headers

How to Create XSD and WSDL from Scratch using Jdeveloper.

I wanted to find out if there was already documentation on "How to Create XSD and WSDL from Scratch using Jdeveloper".

And guess what, found one at FUSION Blog : Creating a WSDL File From XSD File

Great Article and the author has illustrated the steps clearly and Thoroughly.

Thanks to the Author.

Happy Coding. :)

Oracle ODI - Unable to View Data from Models - Logical Schema not set for current context

Today I stumbled to view data from a ODI Model.

The Problem Statement:

I had created a Model from simple Employee schema with a context name called Development. FYI: I used Oracle Technology.

After performing ODI reverse engineering, I wanted to view the data from one of the tables within the model that I created. You can view the data from the model by 

Right click the Table under the Model --> View Data

On performing the above steps you will get this Error:

"Logical Schema not set for current context"

or

"ODI-17523: There is no connection for this logical schema / context pair: lg1 / GLOBAL."

The Solution:

After doing a bit of reading found that this was a know Design issue.

Document Reference: 

Oracle® Fusion Middleware Release Notes 11g Release 1 (11.1.1) for Linux x86-64 Part Number E14770-44

<Document Snippet>

40.2.1 For File Datastores, the View Data operation always looks for global context

Within ODI Studio, when viewing data from within a data store, there must be a global context defined for the datastore.

com.sunopsis.core.SnpsInexistantSchemaException: ODI-17523: There is no connection for this logical schema / context pair: lg1 / GLOBAL.

As a workaround, define a global context for the datastore.

<Document Snippet>

After reading the above, it clearly makes sense why I was getting the error. The view Data command always referred to the "Global" context which I had not set to any thing.

Please perform the following steps to rectify the problem:

1. Go to the Topology Tab in ODI studio.

2. Select the Logical Schema to which the Model is associated to.

3. Under the Definition tab of the Logical Schema assign the same physical schema, as same as the development context (In my case I used Development Context during Reverse engineering of the Model), to the Global Context.

4. Save all.

5. Now try viewing the data and this will work.

Hope it helped you. Happy Code -ing .... :)

Moving Oracle BPM Human Workflow Data from One Environment to Another

I was hunting to find out how to migrate runtim rules and routing policies from one Oracle BPM work flow environment to Another for example from Test to Dev and found this document from Oracle web site.

<Snapshot from the document>
You can migrate Human Workflow user metadata, such as views, mapped attribute (previously known as flex field) mappings, and vacation rules, from a test environment to a production environment using the Human Workflow User Config Data Migrator. The Data Migrator is available as an ant target that can be executed at the command line.

To know more read from the document itself:

Oracle® Fusion Middleware Administrator's Guide for Oracle SOA Suite and Oracle Business Process Management Suite
11g Release 1 (11.1.1.5.0)

Section: 21.6 Moving Human Workflow Data from a Test to a Production Environment

Hope fully it was worth a read.

How To Configure Role based Access for OSB Console

I have been asked This questions multiple Times.

Can we limit / restrict the access of an user for OSB Console?

The answer is YES.

Please refer to Oracle Documentation:

Document NAme: Oracle® Fusion Middleware Developer's Guide for Oracle Service Bus 11g Release 1 (11.1.1.5.0)
Part Number E15866-03
Section: 48 Configuring Administrative Security
Link to Document: admin_security.htm

Oracle provides some predefined Integration roles which we can use. Also there are options to create customized roles.

If you are keen in learning more about creating users  and customizing roles read further in this section 48.3 Configuring Administrative Security: Main Steps

Have a good one. :)

What is the default username and password for Oracle Enterprise Repository 11g

The default username and password for Oracle Enterprise Repository 11g is:

User: admin

Password: admin

This is valid only for the fresh install. After the first login you will be forced to change the password for the admin user.

The admin user is the default administrative account installed with Oracle Enterprise Repository.

How to configure SQL IDentity Provider for ORACLE BPEL or Worklist application in 11g SOA (Troubleshooting)

If you are looking to setup SQL IDentity Provider  for ORACLE BPEL or Worklist application in 11g SOA then you are in the right place.

The solution is basically provided by an Oracle Sample.

You can download the Oracle Sample here: workflow-120-SQLIdentityProvider.zip

Please follow the steps in the sample provided. Also you can double check the steps with this blog: SQLAuthenticator and Human Worklist Application

Credits to: Marc Kelderman.

By now you have setup the SQL Identiy provider for BPEL and worklist app.

Troubleshooting: (WorklistApp only)

When you have setup the SQL Identiy Provider, there is a very much likely chance that you might face an issue with the user name case sensitivity.

For example if you had a user in mixed case such as  UserName. Then when you try to log in to worklist app, it will complain that the user does not exist, despite that you witness the UserName exist in the database. This will not work for the following reasons.

Human workflow system (Worklist app) appears to be case insensitive for user names login. By default  all user names are stored in lowercase (Not using SQL identity, as this is a different case). As is the case we need to change a property to notify worklist app. 

Solution:

User name case insensitivity property should be changed in Oracle Enterprise Manager Fusion Middleware Control.

Please follow the steps provided in the

Document:  Oracle® Fusion Middleware Developer's Guide for Oracle SOA Suite 11g Release 1 (11.1.1)

section: 29.5.5 Case Sensitivity

Following the steps mentioned in the document and set the value to "true".

This will resolve the issue.

 

ORACLE BPEL 11g, Composite Deployment Propagation Issue Due To Coherence.

If you are facing BPEL (SOA) composite deployment propagation issues in 11g oracle SOA cluster, then there is a very good chances that this happening due to the cluster communication section.

In 11g the cluster communication is maintained by another Oracle product called Coherence.

When you look at the Soa Diagnostic logs (and/or the coherence log if you have redirected the coherence logs to some other file)  you might witness logs such as:


Log from SOA1Cohearance.log

2011-03-30 11:08:27.270 Oracle Coherence GE 3.3.2/391 <Warning> (thread=PacketPublisher, member=1): Experienced a 22869 ms communication delay (probable remote GC) with Member(Id=2, Timestamp=2011-03-30 10:17:51.636, Address=IPAddress:Port, MachineId=<MachineID>, Location=process:<Process@Domain>); 123 packets rescheduled, PauseRate=0.0075, Threshold=6802011-03-30 11:31:00.643 Oracle Coherence GE 3.3.2/391 <Warning> (thread=Cluster, member=1): This senior Member(Id=1, Timestamp=2011-03-29 16:13:25.607, Address=IPAddress:Port, MachineId=<Machine ID>, Location=process:<Domain@DomanName>) appears to have been disconnected from another senior Member(Id=2, Timestamp=2011-03-30 10:17:51.636, Address=IPAddress:Port, MachineId=<MachineID>, Location=process:<Process@Domain>), which is the only member of its cluster, but did not respond to any of the termination requests; manual intervention may be necessary to stop that process.2011-03-30 11:31:00.695 Oracle Coherence GE 3.3.2/391 <D5> (thread=Cluster, member=1): TcpRing: disconnected from member 2 due to a disconnect request2011-03-30 11:31:01.652 Oracle Coherence GE 3.3.2/391 <D5> (thread=Cluster, member=1): TcpRing: connecting to member 2 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}2011-03-30 11:31:01.949 Oracle Coherence GE 3.3.2/391 <D6> (thread=PacketPublisher, member=1): Member(Id=2, Timestamp=2011-03-30 10:17:51.636, Address=IPAddress:Port, MachineId=<MachineID>, Location=process:<Process@Domain>) has failed to respond to 17 packets; declaring this member as paused.2011-03-30 11:31:03.672 Oracle Coherence GE 3.3.2/391 <D5> (thread=Cluster, member=1): TcpRing: connecting to member 2 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}2011-03-30 11:31:05.694 Oracle Coherence GE 3.3.2/391 <D5> (thread=Cluster, member=1): TcpRing: connecting to member 2 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}

Log from SOA2Cohearance.log

2011-03-30 11:30:53.820 Oracle Coherence GE 3.3.2/391 <Warning> (thread=PacketPublisher, member=2): Timeout while delivering a packet; removing Member(Id=1, Timestamp=2011-03-29 16:13:25.607, Address=IPAddress:Port, MachineId=<Machine ID>, Location=process:<Domain@DomanName>)
2011-03-30 11:30:53.820 Oracle Coherence GE 3.3.2/391 <D5> (thread=PacketPublisher, member=2): Member 1 left service soa_domain_SOA_ClusterCacheService with senior member 2
2011-03-30 11:30:53.821 Oracle Coherence GE 3.3.2/391 <D5> (thread=PacketPublisher, member=2): Member 1 left Cluster with senior member 2
2011-03-30 11:30:53.821 Oracle Coherence GE 3.3.2/391 <D5> (thread=ReplicatedCache:soa_domain_SOA_ClusterCacheService, member=2): Service soa_domain_SOA_ClusterCacheService: sending ServiceConfigSync to all
2011-03-30 11:30:54.181 Oracle Coherence GE 3.3.2/391 <D5> (thread=Cluster, member=2): TcpRing: disconnected from member 1 due to the peer departure
2011-03-30 11:31:00.683 Oracle Coherence GE 3.3.2/391 <Warning> (thread=Cluster, member=2): The member formerly known as Member(Id=1, Timestamp=2011-03-30 11:30:53.82, Address=IPAddress:Port, MachineId=<Machine ID>, Location=process:<Process@Domain>) has been forcefully evicted from the cluster, but continues to emit a cluster heartbeat; henceforth, the member will be shunned and its messages will be ignored.
2011-03-30 11:31:01.670 Oracle Coherence GE 3.3.2/391 <D4> (thread=TcpRingListener, member=2): Rejecting connection to member 1 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}
2011-03-30 11:31:03.685 Oracle Coherence GE 3.3.2/391 <D4> (thread=TcpRingListener, member=2): Rejecting connection to member 1 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}
2011-03-30 11:31:05.704 Oracle Coherence GE 3.3.2/391 <D4> (thread=TcpRingListener, member=2): Rejecting connection to member 1 using TcpSocket{State=STATE_OPEN, Socket=Socket[addr=/<IPAddress>,port=<Port>,localport=<Port>]}

When you see log message such as above, All it says is that Coherence is not able to communicate to the other node member in the cluster. In other words the other node, which keeps disconnecting very often, is not responding to coherence connection request.

The following was the solution in my/our case: 

Finally with various testing and researching, found out that the second node container was taking a long time with Garbage collection (GC) and was found that the second node's Java start up parameters where not set up to standards.

As a result  the Java start up parameters were tuned as following:

-XX:+UseParallelGC -XX:+UseAdaptiveSizePolicy -XX:ParallelGCThreads=4 -XX:+UseGetTimeOfDay -Xms4096m -Xmx4096m -XX:PermSize=512m -XX:MaxPermSize=756m -XX:NewSize=512m -XX:MaxNewSize=512m -XX:MaxTenuringThreshold=0 -XX:SurvivorRatio=10

and aded -Dtangosol.coherence.mode=prod to EXTRA_JAVA_OPTIONS variable

Note: Dont forget to restart your weblogic managed servers.

With the above settings, the issue with BPEL composite Deployment propagation disappeared.

ServerURL and Callback Server URL in SOA 11g, 10G

This question or need for setting property really arises when you want a cluster setup or predominantly when you have a software or a hardware load-balancer which takes the requests and routs.


In 10g We would configure this Call back url and server URL by following steps:

1. Set the soapServerURL and the soapCallbackUrl to the same value as the load balancer URL:
   
   1. Open the ORACLE_HOME/bpel/system/config/collaxa-config.xml file.
   2. Set the soapServerUrl and soapCallbackUrl to the HTTPS URL, so that the entries resemble the following:
      

      ...
          <property id="soapServerUrl">
              <name>BPEL soap server URL</name>
                 <value>https://soa.mycompany.com</value>
      ...
          </property>
      ...
          <property id="soapCallbackUrl">
              <name>BPEL soap callback URL</name>
                 <value>https://soa.mycompany.com</value>
      ...
          </property>
      

2. Restart the OC4J_SOA instances on both computers.

Source: Oracle® Application Server Enterprise Deployment Guide 10g Release 3 (10.1.3.1.0)
Part Number B28939-03
Section: Section: 3.1.12 Configuring the Cluster of BPEL Instances

Now the same can be achieved in 11g by following the steps from:

1. Right Click on SOA-INFRA component in the left navigation tree. Go to Soa Administration --> Common Properties 

2. Set the CallBackServerURL and the ServerURL to  http://deskLinux:8001 and click Save button

3. Restart SOA server to activate the changes . The URL should now be modified for all composites.


Source: Thanks to Mihai's Blog.
ServerURL and Callback Server URL in SOA 11g

Reference:
Document: Oracle® Fusion Middleware Enterprise Deployment Guide for Oracle SOA Suite 11g Release 1 (11.1.1)
Part Number E12036-01

Section: 5.17 Setting the Frontend HTTP Host and Port - Callback URL

How To Configure a Read Only or Read & Deployment Only or Restricted User For Oracle SOA 11g Enterprise Manager Console

If you  would like to create or configure a user, Who only has read and deploy composites permissions (Restricted Access) in EM console please do the following:

Access to the Enterprise Manager console is determined by the role assigned to the user. See Appendix C.1 Roles and Privileges in:

Document Reference: Oracle® Fusion Middleware Administrator's Guide for Oracle SOA Suite and Oracle Business Process Management Suite 11g Release 1 (11.1.1.4.0) - Part Number E10226-06

Section: C.1.1 Overall Role Functionality Matrix

For a description of the roles defined and the access granted to each role.

Steps to configure the roles described in the document document: (In this case we assign the Monitor role to the user created)

1.  Log in to the Weblogic console.
2. Click on Security Realms -> the name of the realm (myRealm is the default) -> Users and Groups.
3. Click on New to create a new user.
4. Click on the name of the user just created, then Groups and move Monitors from the list on the left to the right. Click Save.
5. Now log in to the Enterprise Manager console with admin privileges, open the SOA folder and right-click on soa-infra and select Security -> Application Roles.
6. Leave the search text empty and click on search button. This will give you a list of all Application Roles.
7. Click on SOAMonitor role to edit it.
8. Scroll down and click on add user. Click on the search button, and a list of available users will be populated. You should see the user just created on the Weblogic console. Move the user to the right and click OK and OK again.
9. Log out, then log in with the user just created.

Additional Info: If you are keen in learning about the roles and their restrictions on weblogic server console please refer:


Document: Oracle® Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server 11g Release 1 (10.3.4) - Part Number E13747-04
Section: 6 Users, Groups, And Security Roles