How to Enable Debug Trace for Smart Card issues?

This article explains what debug trace you need to enable for the client and server to troubleshoot the Smart Card log-in issues with IBM Rational Team Concert. You are required to enable trace for IBM Rational Team Concert Eclipse client , IBM Rational Team Concert server and IBM WebSphere. After enabling the below trace, user can reproduce the issue and then collect all the logs so that support can analyze them and find the route cause of the problem.

• Eclipse .log
• ccm.log
• jts.log
• SystemOut.log

Its is preferred you collect ISALITE data from the server machine so you collect all the logs from the Rational Team Concert server including configuration files and IBM WebSphere logs.

Debug Trace for IBM Rational Team Concert Eclipse Client.

Enable the Eclipse client debugging as follows:

1. Find logging.properties (located within the same directory as the eclipse.ini). If not present, create one.

.level = INFO

handlers = java.util.logging.FileHandler, java.util.logging.ConsoleHandler
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
java.util.logging.ConsoleHandler.level = ALL
com.ibm.team.repository.transport.auth.Tracer.level = ALL
com.ibm.team.repository.transport.client.ClientHttpUtil.level = ALL
httpclient.wire.header.level = FINEST
httpclient.wire.content.level = FINEST
httpclient.wire.level = FINEST
httpclient.level = FINEST
org.apache.commons.httpclient.level=FINEST

2. In eclipse.ini modify the end of the file to include the following debug settings:

  -Djavax.net.debug=all
  -Dcom.ibm.security.cac.debug=true
  -Djava.util.logging.config.file=<exact path to>logging.properties

• NOTE: Where the "exact path to" is replaced with C:\Program Files\IBM\TeamConcert\ or wherever the application is installed on your host that contains the logging.properties file.

• NOTE: If the path to the logging.properties file has spaces, you can try to change "Program Files" to "Progra˜1" or use (for example) C:\IBM\logging.properties

• NOTE: If the customer is using hardware keystores (crypto cards), please also add the following entry in addition to the debug settings above to the eclipse.ini:

-Djava.security.debug=pkcs11impl

3. Restart Eclipse client so the Settings added can be taken into effect.

In combination with above settings , You should also enable the debug tracing for the IBM Rational Team Concert Server and if needed debug tracing for IBM WebSphere

Debug Trace for IBM Rational Team Concert Eclipse Client SSL Handshake.

You would want to enable this trace if you like to get information about SSL Handshake from client to server and check what certificates are used. This is only needed in some cases where suspect problem is certificate in use.

1. Backup your .log file so new run creates a new one. Use a new Eclipse Workspace if possible.

2. Launch RTC Eclipse client.

3. Go to Windows > Preferences > Run/Debug > Console > Make sure that 'Limit console output' is unchecked. ( This is Important)

4. Go to Run -> Run Configurations

5. Create a new Eclipse launch config, and in Arguments -> VM Arguments, append the following:

-Djavax.net.debug=true 

and remove -Djavax.net.debug=all if it was added already.

6. Press Run, This will start the new Eclipse instance.

7. Try to log in with the runtime Eclipse environment that you launched in step 6 selecting your desired certificate and note the name of the certificate you selected.

8. Wait for the failure and then close the runtime Eclipse environment you launched in step 6.

9. Select all text from the console view, (Right Click on Console view > Select All > Right Click > Copy ) Paste in a new text file.

Note: The "Console" view output is captured in the Eclipse instance which you used to launch the new runtime Eclipse environment.

You can correlate the above with all the other traces for a complete picture.

Debug Trace for IBM Rational Team Concert Server.

Enable the debug trace for the following for server: ( CCM and JTS application)

1. In the log4j.properties file of the CCM application, add the following lines:

log4j.properties file is location in

<Jazz Install Dir>\server\conf\ccm

log4j.logger.com.ibm.team.repository.internal.service.auth.impl.IssueAuthToken=DEBUG
log4j.logger.com.ibm.team.repository.internal.service.auth.impl.JAuthHandler=DEBUG

2. In the log4j.properties file of the JTS application, add the following lines:

log4j.properties file is location in

<Jazz Install Dir>\server\conf\jts

log4j.logger.com.ibm.team.repository.internal.service.auth.impl.IssueAuthToken=DEBUG
log4j.logger.com.ibm.team.repository.internal.service.auth.impl.JAuthHandler=DEBUG

3. Reload the log4j properties using ?internal=true so the log4j properties are taken into account.

https://<HOST>:<PORT>/ccm/admin?internal=true#action=com.ibm.team.repository.admin.reloadLoggingSettings
https://<HOST>:<PORT>/jts/admin?internal=true#action=com.ibm.team.repository.admin.reloadLoggingSettings

Debug Trace for IBM WebSphere

CAUTION: These traces that you enable should be removed as soon as you have reproduced the problem and collected the trace. This debug trace cause a lot of noise in the WebSphere logs.

1. In the WebSphere Application Server (WAS) Admin Console, navigate to

"Servers" -> "Server Types" -> "WebSphere application servers" -> <server name>

2. Under "Server Infrastructure", expand

"Java and Process Management" -> "Process definition" -> "Java Virtual Machine"

3. Add the following to the end of the Generic JVM Arguments box, save to the master config, and restart the server for it to take hold

-Djavax.net.debug=ssl,handshake,data,trustmanager

4. This will add debug trace of the SSL handshake to

<Websphere installation>/<AppServer>/profiles/<profile name>/logs/<server name>/SystemOut.log

Related topics: Deployment web home, Deployment web home

External links:

• IBM

Additional contributors: TWikiUser, TWikiUser