Troubleshooting Spectrum OneClick / OneClick login issues

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

We are having difficulty logging into Spectrum OneClick console. What troubleshooting steps can we perform? 

Environment

Platform Independent

All Spectrum releases

Cause

• There are a number of factors that may prevent a user from logging into Spectrum OneClick Console.
• Note that the version of Spectrum may vary as issues logging in can affect any version and any user, and this document assumes you are trying to log in with a local account, not an Enterprise account.
• There may be other reasons why a network account may not be able to log in.
• For LDAP account login issues there is an option within Users tab of OneClick to have the option of "Allow LDAP users to log in". Further LDAP login troubleshooting doc is linked below. 

Resolution

Here are several items to check as you are troubleshooting the Spectrum OneClick Login issue: 

A. Verify the OneClick and Tomcat service installation was successful by checking the Install logs: <SPECROOT>/Install-Tools/LOGS/<timestamp_of_install>/postinst file.

B. Verify Tomcat is running on the One Click server
>ps -ef | grep -i tomcat

C. Check Tomcat log for "Server Startup in <time in ms>" to verify it is started - Restart if needed and tail the Tomcat log to confirm it is started:

- from <SPECROOT>/tomcat/bin: 
>./startTomcat.sh

- from <SPECROOT>/tomcat/logs: 
WIN: >tail -f stdout.log
LINUX: >tail -f catalina.out

D.  Be Sure Local Firewall is disabled:
- Linux OS RHEL 5.x, 6.x:
>service iptables stop
     
- Linux OS RHEL 7.x:
>service firewalld stop
>systemctl disable firewalld

- Windows:
Start > Search > Firewall > Disable

E.  Check netstat output to verify nothing blocked port 80 or 8080. Also check for blocked ports 14001 through 14006: 
>netstat -ano | grep 80
>netstat -ano | grep -i 1400*

F.  Verify the <SPECROOT>/.hostrc files 
     - OC server can only have it's local hostname in the $SPECROOT/.hostrc file. Make sure it is not a + symbol and/or does not have other machine names in it.
     - If editing host files manually, be sure there is no extension appended to the file (meaning, if the file is named like 'hostrc.txt' then it will fail) 
     - If editing host files by propagating copies over the network, be sure any third party tool used to perform the task is not adding formatting which prevents Spectrum from reading the files 

G.  Verify etc/hosts files are complete and correct, if being used.

IMPORTANT - make sure all etc/hosts on all servers are matching information. Even a typo in a single etc/hosts file can cause some communication issues. The same from above (#F) applies if using any third-party copy applications, and verify no abnormal formatting gets applied to the flat files. 

H.  Verify DNS of hostnames of MLS server and OneClick server via nslookup command: 
>nslookup <hostname>
>nslookup <ip_address>

I.  Verify SpectroSERVER MLS is started successfully: 
- review the Spectrum Control Panel server status
- review the SS log at <SPECROOT>/SS/VNM.OUT

J.  Verify the user logging in is added to the MLS SSdb via Spectrum Control Panel > Control menu > Users option
- you can also verify the user exists in the database via CLI:
>cd /vnmsh
>./connect
>./show models | grep -i user

K.  Check this KB to clear duplicate users which cause conflict and prevent login: "The Spectrum install owner cannot login to OneClick"

L. In some cases there may be a corrupt User Model or other DB corruption. 
- Try deleting / recreating the User 
- Try loading last known good SSdb backup

M. Check context.xml file located in <SPECROOT>/tomcat/webapps/spectrum/META-INF/context.xml
- review "locServerName=" entry. This entry should match the MLS hostname
- review "adminUserName=" entry. This entry should match the initial_user_model_name in <SPECROOT>/SS/.vnmrc

N. If using SSO Single Sign-On by method such as EEM server, be sure to verify EEM server is up and running and OneClick has access

O. If using LDAP user login, verify the LDAP server is up and can be reached by the OneClick server (ping or putty)

P. If none of the above suggestions is found to the login issue root cause, you can manually enable "SSORB Security" login debug from web.xml file located in <SPECROOT>/tomcat/webapps/spectrum/WEB-INF 

The tag must be added manually. Then save the web.xml and restart tomcat service. The SSORB login debug will print to <SPECROOT>/tomcat/logs. IMPORTANT - this debug will remain "on" until the value is manually changed to "off" , or the tag removed, and tomcat restarted once more. 

SecuritySpSSORB@SecuritySP@SSORB Security SP@on;

 

Additional Information

If you have tried the above troubleshooting and still are unable to log into OneClick, please open a support ticket for further investigation. Please provide a copy of the Tomcat logs, if possible. <SPECROOT>/tomcat/logs

LDAP Users allowed to log in: "Users cannot login to OneClick because their account is locked"