WCC url issue

Products

• Autosys Workload Automation

Issue/Introduction

Hi Team,
frequently we are facing WCC prod url down, we need to know the root cause of this issue .
let us know what all logs needed for this 

Environment

Autosys 12.X
WCC

Cause

A remote command was being sent to WCC to shut it down.

INFO   | jvm 1    | 2022/09/30 21:32:22 |    81068 | Sep 30, 2022 9:32:22 PM org.owasp.csrfguard.log.JavaLogger log
INFO   | jvm 1    | 2022/09/30 21:32:22 |    81068 | INFO: CsrfGuard analyzing request /wcc/ecli/pages/applicationFrame.faces
INFO   | jvm 1    | 2022/09/30 21:32:25 |    81071 | Sep 30, 2022 9:32:25 PM org.apache.catalina.core.StandardServer await
INFO   | jvm 1    | 2022/09/30 21:32:25 |    81071 | INFO: A valid shutdown command was received via the shutdown port. Stopping the Server instance.

Resolution

Process to disable shutdown port:
 cd $CA_WCC_INSTALL_LOCATION/tomcat/conf
 cp -p server.xml server.xml_original
 vi server.xml
 and search for the following line (in my server.xml it is on line 13
<Server port="8005" shutdown="">
 port 8005 is the default port number that has been chosen at installation time. It might be different in your environment.
 Change port "8005" to "-1". 
 This will disable that someone might perform a shutdown of the tomcat using that port number

 However, you will be still able to stop/start WCC services using the command "unisrvcntr"

Additional Information

optional steps:
1) Check with your System Admin to see if Auditing was enabled during the time in question and review the audit logs to see who issued the shout down command.
2) if System auditing is not enabled work with your system admin to enable it and make it persistent until the problem is resolved.