Run Sterling Integrator LWQWW (queue Watcher agent) with SSL enabled

LWQWW (LW Queue Watcher Watching) is the light weight command line agent that polls Sterling B2B Integrator  (SI) performance related data including: execution queues information, Database pools usage, heap information, etc …

LWQWW is a java application created by the EMEA B2B customer support and Services team (Alf Auklend, Carsten Michel, Mounir Babari, Frank Strecker, Sorin T., …). This useful tool is used by many customers on production. The application is bundled as a jar and can be installed on the Sterling Integrator server or on any other machine that can access the SI server using HTTP/S.

Link to the  LWQWW download page.

In the recent IBM B2B Sterling Integrator (SI) versions, new security features were introduced to reinforce security and address various vulnerabilities. Since version 525, security tokens were added by default to prevent Cross-Site Request Forgery CSRF.

In this blog, I will explain how to enable SSL with LWQWW to poll Sterling Integrator Queue Watcher on the HTTPS port.

1*/ I assume lwqww.jar and the lwqww.properties (and appinfo.properties from version 206) files are copied to your target machine, where you want to tun the LWQWW tool (can run from the same SI server or remotely).

2*/ From a browser make sure you can access Queue Watcher. Type:

https://ip:sslport/queueWatch

You will get the welcome screen:

 

3*/ If you want to use HTTP only (and not HTTPS), you will just need to edit your LWQWW.properties with your host, port and user:

port=0000
wfid=on
solicitPW=true
node=1
user=USER
memory=on
threshold=90.0
nohup=false
target=queueWatch
rate=5000
logon=on
jdbc=off
debug=on
host=0.0.0.0
ssl=false
workdir=.
stop_After=0

To run LWQWW in HTTP only:

/PathToYourJRE/java -jar lwqww.jar -prop LWQWW.properties

 

You can run the tool in the background with nohup. A file with a name format of nodeX-que-date.txt will be created in the working directory.

Enabling SSL for LWQWW:

1*/ If your Sterling Integrator is not HTTPS enabled, follow these steps: Switch from HTTP to HTTPS in SI.

2*/ We need to import the SI certificate into our local keystore or truststore:

a. Go to SI dashboard/portal menu trading Partner Digital Certificates System

b. Choose the system certificate used for the admin interface. By default it is the ASISslCert.

c. Check out the certificate as DER.

d. Copy the exported public key into your client java machine where you want to run LWQWW from.

3*/ Creating the Keystore and Truststore:

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass Changeme -validity 3600 -keysize 2048

[OPTIONAL: create a truststore for sharing purposes]
keytool -genkey -keyalg RSA -alias selfsigned -keystore  truststore.jks -storepass Changeme -validity 3600 -keysize 2048

4*/ Add the SI certificate to your newly created keystore:

keytool -import -trustcacerts -alias mydomain -file ./ASISslCert.der -keystore truststore.jks

Use the same password from the previous step!

5*/ Change the lwqww.properties to enable SSL:

Insert the following lines:

keyStoreType=jks

trustStoreType=jks

keyStore=./keystore.jks

trustStore=./truststore.jks

keyStorePassword=Changeme

trustStorePassword=Changeme

ssl=true

Change the property file to use the HTTPS port.

6*/ Run LWQWW:

java -jar lwqww-210.jar -prop lwqww.properties

Depending on your JDK version you may need to specify the default security protocol:

java -Dcom.ibm.jsse2.overrideDefaultProtocol=TLSv12 -jar lwqww-210.jar -prop lwqww.properties

New versions of lwqww need a file called appinfo.properties to be added to the lwqww folder:

program.COMPANY=IBM
program.COPYRIGHT=COPYRIGHT
program.DESCRIPTION=LWQWW 210
program.BUILDNUM= 2.1.0
program.BUILDDATE= APRIL 2019
program.AUTHOR=Support

 

Example of LWQWW recorded output:

The LWQWW recording output will be very useful to understand the SI system load, processing queue usage, Business process execution times, memory usage, Database pool usage, etc …

The output can be analyzed using a separate IBM internal tool called: Queue Watcher Analyzer QWA:

How to encrypt your password in LWQWW (from version 2.1.0):

In version 2.1.0 a password properties was added to lwqww.properties

The first time you run LWQWW (2.1.0) you need to type the password.

An encrypted password string will be displayed

Encrypted Password .. 0A007EE9C48CF969AA

Then Paste the encrypted password to the password property:

password=F1D4BDD5CAF63A50FA

Restart the application and it should not ask for your password.

How to change an expired password:

If your password is changed, you need to remove it from the property file and restart the application. LWQWW will ask you to enter the new password and will display the new encrypted string to replace in the property file.

Did you like this powerful monitoring tool for B2B Integrator? leave a comment?