Hello everyone.

The ultimate question is: Do you have to use sequelink to connect TN to WM? If you don’t, what can you use instead?

We currently have TN 4.5.1 using Sequelink 5.3 to connect to WM 4.6 with an Oracle DB 8.1.7.4. Any advice would be greatly appreciated.

TIA

Dave

Dave,

For TN pre6.0 versions ie.(4.0.4.5,4.6)you have to use the sequelink to connect an external DB.(Internally TN comes with CloudScape DB for this no need of using sequellink)

HTH,

Dave,

If you pester your wM support people enough, they might give you a JDBC driver to use that will eliminate the SequeLink server requirement. That is, you supply a good sob story about SequeLink server dying, unstable, slow, what not… 8)

Hint: Look at how TN 6.* is connecting to RDBMS…

We experienced problems using the Merant proxy with IS/TN 4.6. WM supplied a driver – sl53_cj32(build38).jar – to connect TN directly to Oracle (bypassing the Merant proxy). This works well.

Be sure to load test though - from memory, an earlier version of the driver had problems.

A newer driver is supplied with wM 6.X – sl53_cj33.jar. Haven’t had problem with that one. But of course, Sonam’s suggestion to test the driver first (on non-Production system!) is the prudent thing to do.

One more thing – we support a large number of customers, and definitely agree with wM’s suggestion that Cloudscape (in TN 4.X) not be used for production systems. They can’t be backed up on-line. They can’t shrink even if you deleted all transactions and conversations (CS limitation). The worst problem we had with them (although fairly uncommon) is some installations had the CS DB files just exploding (best way I can describe it. More than 1GB in 10 mins) for no apparent reason.

The SequeLink server is hard to set up, finicky sometimes. And it’s one more point-of-failure to worry about. Hence, our recommeded configuration is TN 4.X + Cloudscape for Test/Development server, and RDBMS + the sl53_cj3x.jar driver for Production server.

We are using external Oracle database, therefore Sequelink, also for development and QA environments.

However moving to production is causing lots of problems because IS is located in DMZ (protected LAN, behind firewalls). It happens that the firewall closes the TCP communication b/w IS and DB.

Moving from 5.2 to 5.3 with or without Sequelink server doesn’t change anything. Any idea how to manage/configure TN behind firewall?

Regards

Sorin,

Out of curiosity…
Why are you using Sequelink instead of the Oracle drivers?

Sorin,

That’s what I was thinking you meant. For webMethods 6.x, I don’t think there is any reason to not use the Oracle supplied thin JDBC driver with TN. It has always worked fine for me.

Over the years, I have only found 2 reasons to use Sequellink:

1. Your software vendor requires it. This has only happened to me twice in 10 years. The last vendor to do this to me I disqualified in a product evaluation.

2. Performance benefits by pre-fetching batches of rows on the server side while the client thinks it’s just fetching 1 row at a time. ( Modern versions of Oracle are good at providing pretty much the same benefit, so not much incentive here either )

In exchange, as you know, you have an extra license to pay for, an extra server-side configuration to maintain, and an extra layer of software to toubleshoot.

Try the thin JDBC driver.

Hi Mark,

unfortunately I’m still using 4.6 version (how could I forget to mention this!)

Reading out your answers in this forum I know you Mark have enough experience and I’d say very often found your replies very good & interesting. I’ll certainly try to see how TN is behaving with jdbc instead of sequelink drivers.

However I’m a little bit confuse: why wM is pushing sequelink if jdbc just does the same job? I really appreciate a comment over the query I posted (please notice the strange Join syntax in the from clause).

Thx and Regards

Sorin,

To your first question:

I don’t webMethods is pushing Sequelink for their current software. (6.x)

Vendors sometimes push Sequelink because it can make their job a little easier. Although you might think JDBC is a “standard”, like many specifications, it allows for a lot a variability from driver to driver. By forcing everyone to go through a “super driver” like SequelLink, they can avoid writing some additional code to account for the variation between drivers. You the customer pay the price in both dollars and effort when this happens.

But… these days, almost everyone expects good support for the vendor-supplied drivers from the big players: Microsoft SQL-server, Oracle and IBM DB2.

I know that for 6.x webMethods supports the Data Direct Connect drivers, (which come bundled with the 6.x installation) for the JDBC connection pools. These are not the same as Sequelink. I think Data Direct connect may be supported on 4.6 too, but I’d have to defer to someone else on that.

Can you try the Data Direct connect driver instead of Sequelink to see what happens?

Regards

ConnectJDBC is the defacto standard for current 6.x installations, and since it’s a type 4 driver, it doesn’t see nearly the installation problems that SequeLink had. Tn 4.6 was pretty picky about drivers, but even back in the day with 4.6, ConnectJDBC was offered to support clustered SQL Server installations, in which SequeLink could cause data loss. I’m not sure about the Oracle thin driver, and I don’t think that would be supported, but you can definitely get a driver that’s more user-friendly than SequeLink. Call webm support–it shouldn’t be a big deal to get setup with the updated driver and info.

“We can rebuild it. We have the technology.”

Tate

I’d agree with Tate, if you don’t already have the Connect JDBC driver, see if you can get it from webMethods support.

-Mark

I tried also to connect with sl53_cj32.jar driver (com.wm.dd.jdbc.oracle.OracleDriver). The results is the same or even worse than using Sequelink server…

Sorin,

Can you provide details on the error you get when you try to connect with the com.wm.dd.jdbc.oracle.OracleDriver?

-Mark

Now it is beginning to make sense!

If the network connection is lost, there isn’t much a JDBC driver or any other database client can do except attempt to restore the connection on a scheduled basis.

Closing a network connection through a firewall after a period of inactivity seems like a reasonable setup.

I would not usually expect to see a database connection going through a firewall. This is normally considered a security risk. Can we step back a little and discuss more generally what you are doing and why you are not going through the firewall with HTTP, FTP, etc?

I’ll be happy to discuss it.

I’m not an expert, but from my past experience, I think that for security reasons network people try to keep separately (as network) the webserver and the back office data (e.g. DB Server).

The webServer will have static IP/domain name and will be installed in a separate and very protected network, what they call DMZ, where firewalls will control HTTP/FTP/etc connection to and from Internet. I don’t know exactly how a DMZ is configured, but some how you will get also more protection to inside calls (that is versus/from back office systems).

The most of mine precedent installations of wM used to have IS inside local LAN, together with back-office, using proxy/NAT to access Internet.

In this case, however, IS is exposing several DSP pages as UserInterface, so for the network people is acting as a web server, so they decided to setup IS inside DMZ. It seams that is affecting DB connections especially through sequelink drivers (of any versions).

Oracle jdbc thin driver instead is acting a little bit better: while still having exceptions sometimes, it seams that connection pools using this driver will somehow open a new connection allowing IS to continue the work. Sequelink/DataDirect versions, once the connections are broken, failed to manage the situation and implied IS functionality becomes unavailable until IS completely restart…

I was wondering if there is a way to get control, programmatically, over the way wM manages the connection pool, so that I could intercept this exceptions and decide to clean the connection from the pool creating a new one instead! In your opinion, it’s this possible?

Please fill free to consider all my previous suppositions wrong, as there may be a way to correct/better configure the network and have everything working just fine!

Best Regards

Normally, the only IS you would find in a DMZ would be a reverse-proxy server.

Moving the “regular” IS inside the DMZ is not good.

Many companies do not even put webservers in the DMZ, allowing only proxy servers ( such as Microsofts ISA ) in the DMZ.

I would strongly recommend that you get the IS out of the DMZ and have the proxy environment configured to pass HTTP requests back and forth to it.

Regards

What you propose Mark makes a lot of sense to me (compliments!). Unfortunately network architecture/config does not depend on me, so all I can do about is try to explain and propose a inverse proxy solution.

However in this moment network people sustain this is a wrong behavior from wm app sever (i.e. IS!) and after months of trying to convince them otherwise I am finally facing “ the reality”: instead of accepting Process Monitor feature always unavailable I am trying to find a work around by catching exceptions and controlling pool connections. Hopefully this will be until upgrade to 6.1 version will consider a better network solution…

In few words my idea is to schedule an IS service that each 15min will try to execute sql for each connection in the pool, catching eventual exceptions. In base of exception code should decide to remove connection from the pool and eventually open a new one…

Any idea where to start?

I’m not sure what to suggest. Whatever you come up with is going to be a pretty unique setup.

Maybe others have some suggestions?

One other thought, if you have the license, you could strip down the IS in the DMZ to doing only the DSP pages, and forward the “real work” requests to another IS inside. The inside IS would do the database connections.

Could be an idea refactoring dsp pages… This will however require more hw I don’t have…

Thanks 4 everything

Bye

Regarding network architecture (in particular, IS in DMZ). Actually, I don’t think it’s that big a problem. An IS, after all, is not a generic Application Server along the lines of WebSphere or WebLogic. We normally expose to outside only an HTTPS port, locked down to put only wm.ip.rn:receive (RosettaNet), wm.tn:receive, and wm.server:ping (for connectivity testing) available. To inside, expose another HTTPS port with full admin privilege. Then lastly, open DB or whatever backend connections through inside FW also.

The thinking is that we’ll only be accepting docs (XML, RosettaNet, EDI, whatnot) from outside, and an outsider will have a hard time connecting to inside network even if the IS is compromised.

Of course, this is not going to be as secure as having a reverse proxy in the DMZ, but 1) not every client’s going to purchase a license for a server that looks like it does pretty much nothing, 2) it’s much easier to set up and manage, and 3) one fewer point-of-failure.

The same thing could be said about many kinds of IT servers. webMethods does make it easier than many other products to exclude services that can be executed through a given port.

However, the decision to put a server in the DMZ is usually not based on the technical capabilities of the software. These two usually drive it:

1. A configuration or programming error on a server in the DMZ should not put the company at risk.

2. An independent person or group are controlling and monitoring the network “gates”. These are designated security staff that are responsible for the safety of all applications and systems.

Even in strict configuration like this, it is possible to expose the company to risk. It is just considered less likely, and easier to monitor/audit.

Hi all,

Thanks for your suggestions. I think Reverse Proxy is a very good thing to consider certainly for next system upgrades / evolution.

I try to think to a bigger wM architecture. For example it could be interesting to consider using inside DMZ wM Portal for exposing GUI, or Reverse Proxy to enable document routing. Behind firewalls IS that I like to consider it our middleware, very useful to connect to multiple data sources, and offering logic support for functionalities although exposed through Portal, TN or Monitor. Is just because of multiple data access that I think would be safer placing IS behind the firewall. As you said Mark, multiple data connections will be more difficult to monitor for and will increase security risk.

Returning back to my original problem, I found that TN 4.6 SP2 somehow seams to partially resolve the problem. After installing it we still keep having connection errors reported in server.log from monitor.execSQL, but refreshing ProcessMonitor page we got the results. Seams like now ProcMon is able to open a new connection when the old one is broken… At least I hope so

Thank you again,
Best regards

Hi All,
Am getting this error when trying to configure TN on IS6.1
Test of TN Failed
[wm-cjdbc33-0009][Oracle JDBC Driver]Error establishing socket. Connection refused: connect
Am using “com.wm.dd.jdbc.oracle.OracleDriver” .

TIA

Am getting the same error if I use this driver too…
“oracle.jdbc.driver.OracleDriver”

TIA

Hi Krishna

I think the drivers are ok, especially the “com.wm.dd.jdbc.oracle.OracleDriver” one. But your problem might be the patch for TN that I dont think you have applied. The file name is TNS_6-1_Fix15.jar but I am not certain whether the ns is global. You might also have an error like “value inserted too large” when starting the IS. That happens when you haven’t applied the fix pack. I don’t know the policy about sharing files here. So I won’t send it to you. Hope you get it.

Cheers

Krishna,

As the error message suggests, this is a basic connection problem and is not related to the TN “millenium bug”.

As you’ve probably noticed, the Administrator’s guide says:

“You must use DataDirect Connect JDBC 3.3 as your driver; it is the only JDBC driver certified by webMethods for this purpose. The Connect JDBC driver is a Type 4 JDBC driver that does not have a server component. The client component comes with Integration Server, so no installation is required.”

So philosophical objections aside, you are doing the right thing by using the supplied DataDirect driver.

Have you verified your ability to connect using another client app with the same port and sid?

Have you verified your database URL in the JDBC pool connection alias configuration page?
It should look something like:
jdbc:wm:oracle://host_or_IPaddress:1521;SID=database_name

Hi Guys,
I am using the below format of URL and sequl link driver for TN connection,but when i try to reconnect .It throughs an error.

[wm-cjdbc33-0069][Oracle JDBC Driver]Unable to connect. Invalid URL.

“Have you verified your database URL in the JDBC pool connection alias configuration page?
It should look something like:
jdbc:wm:oracle://host_or_IPaddress:1521;SID=database_name”

Please help ,i am not able to open my TN console.
Thanks

Please do not CROSS-POST.