启动WSO2 API Manager遇JMSListener连接失败及端口权限问题求助

启动WSO2 API Manager时持续遇到相同错误，已与企业安全团队协作确认拥有所有端口的完全访问权限，他们发现错误来自因防范mDNS投毒而被拦截的5353端口，但WSO2并未调用该端口。尝试过重新安装Java、检查端口日志与权限、将所有端口上调1位（日志中显示9712而非默认9711），问题仍未解决，需在月底前完成排查，求其他解决思路。

当前错误日志 #

[2024-04-03 10:55:23,311] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,311] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,316] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,316] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,321] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,321] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,322] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,322] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,322] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,322] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,324] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,324] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,324] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,324] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,325] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,325] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:23,325] ERROR - JMSListener JMS Provider is not yet started. Please start the JMS provider now.
[2024-04-03 10:55:23,325] ERROR - JMSListener Connection attempt : 5 for JMS Provider failed. Next retry in 320 seconds
[2024-04-03 10:55:53,038]  WARN - DataEndpointGroup No receiver is reachable at URL Endpoint/Endpoints [tcp://192.168.40.6:9612], will try to reconnect every 30 sec
[2024-04-03 10:55:53,039] ERROR - DataEndpointConnectionWorker Error while trying to connect to the endpoint. Cannot borrow client for ssl://192.168.40.6:9712
org.wso2.carbon.databridge.agent.exception.DataEndpointAuthenticationException: Cannot borrow client for ssl://192.168.40.6:9712
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:147) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.run(DataEndpointConnectionWorker.java:59) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) ~[?:?]
        at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
        at java.lang.Thread.run(Thread.java:842) [?:?]
Caused by: org.wso2.carbon.databridge.agent.exception.DataEndpointException: Error while opening socket to 192.168.40.6:9712. Permission denied: connect
        at org.wso2.carbon.databridge.agent.endpoint.binary.BinarySecureClientPoolFactory.createClient(BinarySecureClientPoolFactory.java:75) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at org.wso2.carbon.databridge.agent.client.AbstractClientPoolFactory.makeObject(AbstractClientPoolFactory.java:39) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at org.apache.commons.pool.impl.GenericKeyedObjectPool.borrowObject(GenericKeyedObjectPool.java:1212) ~[commons-pool_1.5.6.wso2v1.jar:?]
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:137) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        ... 6 more
Caused by: java.net.SocketException: Permission denied: connect
        at sun.nio.ch.Net.connect0(Native Method) ~[?:?]
        at sun.nio.ch.Net.connect(Net.java:579) ~[?:?]
        at sun.nio.ch.Net.connect(Net.java:568) ~[?:?]
        at sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:593) ~[?:?]
        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:327) ~[?:?]
        at java.net.Socket.connect(Socket.java:633) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:304) ~[?:?]
        at sun.security.ssl.SSLSocketImpl.<init>(SSLSocketImpl.java:163) ~[?:?]
        at sun.security.ssl.SSLSocketFactoryImpl.createSocket(SSLSocketFactoryImpl.java:88) ~[?:?]
        at org.wso2.carbon.databridge.agent.endpoint.binary.BinarySecureClientPoolFactory.createClient(BinarySecureClientPoolFactory.java:58) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at org.wso2.carbon.databridge.agent.client.AbstractClientPoolFactory.makeObject(AbstractClientPoolFactory.java:39) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        at org.apache.commons.pool.impl.GenericKeyedObjectPool.borrowObject(GenericKeyedObjectPool.java:1212) ~[commons-pool_1.5.6.wso2v1.jar:?]
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:137) ~[org.wso2.carbon.databridge.agent_5.3.5.jar:?]
        ... 6 more

已尝试的方案 #

• 重新安装Java
• 检查端口访问日志与权限配置
• 将所有服务端口上调1位（如原9711改为9712）

额外排查与解决建议 #

1. 验证DataEndpoint端口的实际监听状态 #

• 在WSO2服务器上执行netstat -ano | findstr "9712"（Windows）或netstat -tulpn | grep 9712（Linux），确认端口是否被WSO2进程正常监听
• 若端口未监听，检查repository/conf/datasources/master-datasources.xml和repository/conf/analytics/analytics-datasources.xml中的DataEndpoint配置，确保IP和端口与修改后的一致

2. 排查JMS Provider启动失败的根源 #

• 查看repository/logs/wso2carbon.log中更早的启动日志，寻找JMS Provider初始化失败的具体错误（如端口占用、配置文件语法错误）
• 检查repository/conf/broker.xml中的消息 broker 配置：
  • 确认<TransportConnectors>下的端口与修改后的端口匹配
  • 验证WSO2运行用户对repository/data/broker目录有读写权限

3. 规避mDNS拦截的间接影响 #

部分JVM或系统库可能在网络初始化时触发mDNS请求，可通过JVM参数禁用相关功能：

• 修改bin/wso2server.sh（Linux）或bin/wso2server.bat（Windows），添加JVM参数：-Dcom.sun.jndi.dns.disableAAAA=true -Djava.net.preferIPv4Stack=true
• 或在repository/conf/deployment.toml中添加：

  [jvm]
  extra_params = "-Dcom.sun.jndi.dns.disableAAAA=true -Djava.net.preferIPv4Stack=true"
  

4. 深层验证防火墙与安全策略 #

• 测试本地连通性：用telnet 192.168.40.6 9712或openssl s_client -connect 192.168.40.6:9712手动确认端口是否能建立连接
• 检查本地防火墙（Windows Defender、iptables）是否允许WSO2进程绑定和访问目标端口
• 确认是否有应用层防火墙或DLP策略拦截了SSL/TLS连接（日志显示SSL连接失败，可能涉及证书或加密协议限制）

5. 确保配置文件端口修改的一致性 #

端口调整后，需同步更新所有相关配置文件：

• repository/conf/deployment.toml中的所有端口配置（如[transport.https]、[broker.transport.amqp]等）
• repository/conf/axis2/axis2.xml中的传输端口配置
• repository/conf/dashboard/deployment.yaml中的DataEndpoint配置

内容的提问来源于stack exchange，提问作者Erin J