Risk Analysis fails from CUP

[Former Member]

GRC 5.3 sp9: When we attempt to run a risk analysis from CUP in production, it fails. In dev GRC instance, it does not fail. Both configurations are the same. The connectors have the same name in CUP and RAR. The Risk Analysis works in production RAR by simulating it. Connections are tested and work. The UME webservice user has the correct roles and is not locked. You can logon using this user to both CUP and RAR. The sys log dump is below:

2010-05-05 18:53:50,613 [SAPEngine_Application_Thread[impl:3]_15] ERROR com.virsa.ae.core.BOException: Exception in getting the results from the web service : Service call exception; nested exception is:

java.net.ConnectException: Connection timed out (errno:238)

com.virsa.ae.core.BOException: Exception in getting the results from the web service : Service call exception; nested exception is:

java.net.ConnectException: Connection timed out (errno:238)

at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:199)

at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doRiskAnalysis(RiskAnalysisAction.java:1079)

at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.doAnalysis(RiskAnalysisAction.java:306)

at com.virsa.ae.accessrequests.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:111)

at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)

at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(Native Method)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)

Caused by: com.virsa.ae.service.ServiceException: Exception in getting the results from the web service : Service call exception; nested exception is:

java.net.ConnectException: Connection timed out (errno:238)

at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.getViolations(RiskAnalysisWS53DAO.java:342)

at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.getViolations(RiskAnalysisWS53DAO.java:450)

at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.determineRisks(RiskAnalysisWS53DAO.java:573)

at com.virsa.ae.service.sap.RiskAnalysis53DAO.determineRisks(RiskAnalysis53DAO.java:119)

at com.virsa.ae.accessrequests.bo.RiskAnalysisBO.findViolations(RiskAnalysisBO.java:182)

... 24 more

Caused by: java.rmi.RemoteException: Service call exception; nested exception is:

java.net.ConnectException: Connection timed out (errno:238)

at com.virsa.ae.service.sap.ws53.Config1BindingStub.execRiskAnalysis(Config1BindingStub.java:90)

at com.virsa.ae.service.sap.ws53.Config1BindingStub.execRiskAnalysis(Config1BindingStub.java:99)

at com.virsa.ae.service.sap.RiskAnalysisWS53DAO.getViolations(RiskAnalysisWS53DAO.java:310)

... 28 more

Caused by: java.net.ConnectException: Connection timed out (errno:238)

at java.net.PlainSocketImpl.socketConnect(Native Method)

at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:305)

at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:171)

at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:158)

at java.net.Socket.connect(Socket.java:474)

at java.net.Socket.connect(Socket.java:424)

at java.net.Socket.<init>(Socket.java:309)

at java.net.Socket.<init>(Socket.java:125)

at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initStreamsFromSocket(HTTPSocket.java:682)

at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initializeStreams(HTTPSocket.java:504)

at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.getOutputStream(HTTPSocket.java:461)

at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.HTTPTransport.getRequestStream(HTTPTransport.java:408)

at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.outputMessage(MimeHttpBinding.java:557)

at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.call(MimeHttpBinding.java:1444)

at com.virsa.ae.service.sap.ws53.Config1BindingStub.execRiskAnalysis(Config1BindingStub.java:83)

... 30 more

[sunny_pahuja2]

Hi,

As per logs ur webservices are getting time out while connecting to your backend system.

First check SAP Note 1034117 - Management Reports run too long, not updating, or inaccurate.

Thanks

Sunny

[Former Member]

Found the issue! This client's network folks (outsourced) have the GRC server isolated such that it did not know it's own ip (not in hosts file?). Fixed the issue by replaceing http://<ip>:<port>/. with http://localhost:<port>/. I'm not a strong networking person, so if anyone can give me a reason to setup the server this way, I would appreciate it.

[Former Member]

Hello Jack,

The problem might be due to the large number of SoD violations that would be coming for this user id that you are requesting in CUP. When you will run risk analysis for this user in CUP it will run against all the existing roles assigned to this user already + the new roles requested. If the number of violations are huge then the system times out (during the process of bringing SoD violations from RAR to CUP). For that purpose, if you will search for SAP Notes based on the criteria "Socket Time Out" you should be able to find out some information in GRC component. Alternatively, there is a new setting which has been introduced in RAR -> Configuration -> Risk Analysis where you can specify the limit of number of SoD violations that will be transferred from RAR to CUP during risk analysis. OR you can create a message with SAP GRC Support in component GRC-SAC-SAE to request assistance with this.

Regards, Varun