PAM-MGC-0085 - Upgraded to 4.1.3 and Management Console stopped communicating.

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We upgraded to 4.1.3 in Prod and Management Console is not communicating. Did the same upgrade in Test Env and MC communicates properly there.

Test Integration API button Fails with this error.

 Error: PAM-MGC-0085: Could not connect to the Management Console integration API. Service is temporarily unavailable. Host: xxxxxxx

Test Reporting API button works fine.

 

 

From the tomcat logs (in INFO mode) we see the following for both operations.

2023-11-06T16:48:31.867+0000 INFO [Timer-2929] com.ca.pam.mgmtconsole.service.MCTimerTask.run PAM-MGC-0068: Starting PAMMC servlet task. Task type:INTEGRATION
2023-11-06T16:48:34.310+0000 WARNING [Timer-2929] com.ca.pam.mgmtconsole.service.MCIntegrationTask.submitStatusToServer PAM-MGC-0032: Failed to submit status request to Management Console. Status:503, Reason:503, URI:https://<MC-HOSTNAME>:443/cspm/ext/rest/clusterstatus/submit/
2023-11-06T16:48:34.310+0000 INFO [Timer-2929] com.ca.pam.mgmtconsole.service.MCTimerTask.run PAM-MGC-0069: Ended Management Console servlet task. Task type:INTEGRATION

2023-11-06T16:49:02.167+0000 INFO [Timer-2930] com.ca.pam.mgmtconsole.service.MCTimerTask.run PAM-MGC-0068: Starting PAMMC servlet task. Task type:REPORTING
2023-11-06T16:49:04.266+0000 INFO [Timer-2930] com.ca.pam.mgmtconsole.service.MCTimerTask.run PAM-MGC-0069: Ended Management Console servlet task. Task type:REPORTING

 

Cause

When maintenance mode is enabled "post" API requests are denied with an Http error 503 but "get" API requests are still allowed. In this case the client forgot to turn off maintenance mode after completing the upgrade.

Resolution

Disabling Maintenance Mode on the Management Console resolves the issue. In the future, the management console does not need maintenance mode set for upgrade as endusers would not be accessing this appliance.