Verifying Jetty integrated web server

Products

• Automic Applications Manager

Issue/Introduction

Following an upgrade to Applications Manager 9.6.2 or higher, security scanners may still flag the external Apache HTTP or Tomcat web server for vulnerabilities (e.g., CVE-2026-29167).

Since Applications Manager now uses an integrated Jetty-based web server, the legacy external server can be removed once the integrated configuration is confirmed.

Symptoms:

• Security scans report vulnerabilities on the port previously used by the external Apache HTTP server.
• Inquiry into whether the built-in web server is active and how to safely remove the legacy Apache configuration.

Environment

Applications Manager 9.6.2 and above

Resolution

Resolution Applications Manager 9.6+ utilizes an integrated Jetty web server, eliminating the requirement for a standalone Apache HTTP or Tomcat instance.

Confirm Integrated Web Server Usage Verify that Applications Manager is correctly utilizing the built-in server before decommissioning the legacy one:

1. Check Configuration Port: Open the file $AW_HOME/site/awenv.ini and locate the APACHE_PORT parameter.

   • Example: APACHE_PORT=9010
   • Note: This port value is assigned during the upgrade/installation process.

2. Verify Server Startup: Review the $AW_HOME/log/webserver.log file for successful startup entries:

   INFO com.broadcom.am.webserver.EmbeddedJettyServer -- Starting Jetty on port ####INFO org.eclipse.jetty.server.AbstractConnector -- Started ServerConnector@...{HTTP/1.1, (http/1.1)}{0.0.0.0:####}

Procedure to Remove Legacy Apache HTTP Server Once the integrated server is confirmed active, follow these steps to remove the old configuration:

1. Stop Services: Stop the standalone Apache HTTP server service on the host machine.
2. Verify Access: Ensure you can still access the Applications Manager interface using the APACHE_PORT identified in step 1.
3. Decommission: Disable or uninstall the standalone Apache HTTP server.
   • Note: Because the web server is now integrated into the AM application startup, no configuration files within the $AW_HOME directory need to be manually edited to "disconnect" the old server.