Not applicable
3399 views

iPrint on netware - solid lock

We have been running iPrint on netware 6.5 for many years, as best I am aware all the current patches etc, and yesterday afternoon and today we are experiencing failures on the server host.

The server hangs, the current screen just freezes and the only option is to enter the debugger to quit and reset the server.

? in debugger shows:

Address in APACHE2.LNM at code start _00025A96h
Previous: -000009d6 A3BAD0C0 APACHE2.NLM|ssl_var_lookup
Current: 00000000 A3BADA96
Next: +000015CA A3BAF060 APACHE2.NLM|ap_sock_disable_nagle

Looks to be apache related. We running mostly ipp, but do host some secure ipps printers.

We are thinking a new client OS is knocking it over, perhaps mavericks or Windows 8.1.

Anyone else experiencing any similar? We are an eduaction campus, and as such, are at the mercy of our userbase and their upgrade tendencies...

Regards
IanB
0 Likes
28 Replies
sisml Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

Hi,

Are all the certificates valid on the server (does PKIDIAG show any issues)?

Matt
0 Likes
Not applicable

Re: iPrint on netware - solid lock

PKIdiag shows all okay.

After the last server restart we did not load apache, but did load NDPSM and broker. They came up okay. Waited for a bit, then big breath, and ap2webup was loaded, and all seems okay now. We suspect the client machine has gone away.

Prior to that we had 3 failures at, 12:02, 12:17 and 12:50, with the freeze happening whilst the ndps manager was loading in PAs (we have 1000+ printer agents).

Thanks
IanB
0 Likes
Not applicable

Re: iPrint on netware - solid lock

Lots of ups and downs late yesterday and today.

Took the the step to load apache with the listen on port 443 out (httpd.conf), server still failed.

Also now with the line 'NWSSLUpgradeable 631 "SSL CertificateDNS"' out of ipp.conf too, and the server has now been up for three hours without further issues.

Regards
IanB
0 Likes
rjneilly
New Member.

Re: iPrint on netware - solid lock

Hi Ian,

I can confirm the exact same issue - same abend log, similar timing. Our issues started on Friday Oct 25. I went down the same path you did as well - ran pkidiag but we had an expired and an about to expire certificate. So fixed those up and that seemed to bring the server into a stable state. However that was a false issue for two reasons:
1. We use a Thawte cert for the apache and httpd/pcountwi services. So the default server certs should not impact client comms with apache.
2. The server continues to abend in the same place today, which is 2.5 days after the pkidiag "fix".

I posted my abend in the Netware/Abends-hangs forum. Burkhard suggested downgrading the tcp/ip security by switching to the tcpn (null - low encryption) modules. But we use a lot of secure printer agents so that probably wouldn't be a good idea. We are, like you, an educational institution with lots of OS X users. Seems to me the same thing happened last year with OS X 10.8 and Novell fixed it with iprint sp8e.

Cheers,

Ron
0 Likes
Not applicable

Re: iPrint on netware - solid lock

Glad we are not alone but sorry for you to have the same issue! I'm not hopeful of a patch for netware iPrint.

Regards
IanB
0 Likes
sisml Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

+1 for this issue.
We started seeing it this morning, with one of our print managers bouncing between cluster nodes. Our abend log looks similar to yours.

Running process: Interrupt service routine (nested count 0)
Interrupted process: Apache_Worker 31 Process
Thread Owned by NLM: APACHE2.NLM
Stack pointer: 9F290A60
OS Stack limit: 9F281C00
Scheduling priority: 67371008
Wait state: 5050030 Blocked on Semaphore
Stack: --FBF17BA3 ?
995B3A9A (APACHE2.NLM|ssl_var_lookup+9DA)
99598BC9 (APACHE2.NLM|APACHE2@ap_get_status_line+179)
--61502D58 ?
--9F335907 ?
--64696F76 ?
--9F334150 ?
--9F295C78 ?
--9F335850 ?
--95DD30A0 (PORTAL.NLM|XMLFileListMutex+1210)

I'll get in touch with our support partner, but won't be on the edge of my seat waiting for a Netware patch.

Time to get moving with the migration to OES 11 I think.

Matt
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

On 10/24/2013 02:56 PM, ibelton wrote:
>
> We have been running iPrint on netware 6.5 for many years, as best I am
> aware all the current patches etc, and yesterday afternoon and today we
> are experiencing failures on the server host.
>
> The server hangs, the current screen just freezes and the only option is
> to enter the debugger to quit and reset the server.
>
> ? in debugger shows:
>
> Address in APACHE2.LNM at code start _00025A96h
> Previous: -000009d6 A3BAD0C0 APACHE2.NLM|ssl_var_lookup
> Current: 00000000 A3BADA96
> Next: +000015CA A3BAF060 APACHE2.NLM|ap_sock_disable_nagle
>
> Looks to be apache related. We running mostly ipp, but do host some
> secure ipps printers.
>
> We are thinking a new client OS is knocking it over, perhaps mavericks
> or Windows 8.1.
>
> Anyone else experiencing any similar? We are an eduaction campus, and
> as such, are at the mercy of our userbase and their upgrade
> tendencies...
>
> Regards
> IanB
>
>



IOS7 has changed how ipp traffic is sent to server so it may be related.
Can you post the complete abend.log where abend 1 is seen?
0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

On 10/29/2013 01:36 PM, sisml wrote:
>
> +1 for this issue.
> We started seeing it this morning, with one of our print managers
> bouncing between cluster nodes. Our abend log looks similar to yours.
>
> Running process: Interrupt service routine (nested count 0)
> Interrupted process: Apache_Worker 31 Process
> Thread Owned by NLM: APACHE2.NLM
> Stack pointer: 9F290A60
> OS Stack limit: 9F281C00
> Scheduling priority: 67371008
> Wait state: 5050030 Blocked on Semaphore
> Stack: --FBF17BA3 ?
> 995B3A9A (APACHE2.NLM|ssl_var_lookup+9DA)
> 99598BC9 (APACHE2.NLM|APACHE2@ap_get_status_line+179)
> --61502D58 ?
> --9F335907 ?
> --64696F76 ?
> --9F334150 ?
> --9F295C78 ?
> --9F335850 ?
> --95DD30A0 (PORTAL.NLM|XMLFileListMutex+1210)
>
> I'll get in touch with our support partner, but won't be on the edge of
> my seat waiting for a Netware patch.
>
> Time to get moving with the migration to OES 11 I think.
>
> Matt
>
>


This is a CPU hog abend. What value do you have o nyuor server for CPU
hog timeout amount?
0 Likes
sisml Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

CPU hog timeout is set to 8 seconds. This machine is in a cluster and I understand that's the default value in this case.
0 Likes
rjneilly
New Member.

Re: iPrint on netware - solid lock

Hi - not the original poster but if you check my post in the NetWare Abend-Hangs forum you will see my Abend.log : https://forums.novell.com/novell-product-discussions/file-networking-services/open-enterprise-server/oes-netware/oes-nw-abends-hangs/472113-apache-iprint-cpu-hog-abend-nw6-5sp8.html

How does IOS7 relate to OSX 10.9? Are the ipp "stacks" the same on both (code sharing would make sense)? Also can you elaborate on how the ipp traffic has been changed.

Thanks,

Ron
0 Likes
rjneilly
New Member.

Re: iPrint on netware - solid lock

On our non-clustered server it is set to 1 minute. However we are also seeing hard occasional crashes of the "multiple abends are occuring" variety - of course that could be a side effect from the attempt to force the server to reboot.

Cheers,

Ron
0 Likes
sisml Absent Member.
Absent Member.

Re: iPrint on netware - solid lock

Hi Ron,

I raised an SR with Novell earlier and this is the latest I've received from their support:

"Apple has change in the way cups works on the new IOS7 and, on previous versions, ipp was sent to port 80 but with the new IOS7, it is sent to port 443 what apache does not expect as ipp is not a secure protocol"

Like you I don't know if this is the case for OS 10.9 and may be the cause of our issues. I'll post back with any progress we get through the Novell support channel.

Matt
0 Likes
Knowledge Partner
Knowledge Partner

Re: iPrint on netware - solid lock

sisml wrote:

> I raised an SR with Novell earlier and this is the latest I've received
> from their support:
>
> "Apple has change in the way cups works on the new IOS7 and, on previous
> versions, ipp was sent to port 80 but with the new IOS7, it is sent to
> port 443 what apache does not expect as ipp is not a secure protocol"


Please can you let us know your SR number? If you don't want to post it
publicly please send me a Private Message via these forums.

> Like you I don't know if this is the case for OS 10.9 and may be the
> cause of our issues. I'll post back with any progress we get through the
> Novell support channel.


Whilst Apple developed both OS X Mavericks (10.9) and iOS 7 they're not the
same. It would also seem the issues referenced in this thread appeared to
start after the former was released.

HTH.
--
Simon
Novell Knowledge Partner
0 Likes
rjneilly
New Member.

Re: iPrint on netware - solid lock

Hi Matt,

I thought secure ipp does exist (ipps) and it is on port 631. I'm pretty sure that that is what is defined in ipp.conf via these statements:
Listen 631
NWSSLUpgradeable 631 "SSL CertificateDNS"

So the initial connection on port 631 can be without SSL security and it supports upgrading the connection to a secure connection with the specified certificate, in this case "SSL CertificateDNS". It could also use a cert issued by an external authority. What does is now unclear to me is how the problem goes away when we disable the iprint printer agent option to use ssl/tls and require authentication. With this configuration there is no secure (ssl) traffic taking place between client and iprint server (ie apache) - right? I'd like to better understand the communciation pathways from client to printer agent for both secure and non-secure iprint printer agents... oh and every other component involved in the process, eg eDir, LDAP, apache, ndps manager, ndps broker. Where is that diagram?

Cheers and good fortune,

Ron
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.