Skip to content

Troubleshooting FAQ

Source: RaaS FAQ (TRIB 53282356) · Operational experience

General

What is the RaaS architecture?

RaaS (Rhapsody as a Service) is a managed deployment of the Rhapsody Integration Engine running in AWS. The standard deployment is a 3-tier AWS architecture:

  1. EC2 instances — running Rhapsody on RHEL/Amazon Linux, in an Auto Scaling Group
  2. VPC — isolated network per customer account with managed security groups and routing
  3. VPN/Connectivity — either Site-to-Site VPN, Transit Gateway, or VPC Peering to connect the customer's hospital network to the RaaS VPC

What factors affect RaaS pricing?

Pricing is calculated based on:

  1. Messages per day — daily message throughput
  2. % large messages — the proportion of messages that are "large" (e.g. DICOM, CCD/XML)
  3. Archive retention period — how long processed messages are retained in the datastore
  4. Connectivity type — the network connectivity option (VPN, TGW, Peering)

Is RaaS HITRUST certified?

Not yet. HITRUST certification is on the roadmap.

Networking & Connectivity

What VPN/connectivity options are available?

Option Description
Site-to-Site VPN Standard IPSec VPN; customer provides public IP and subnet
Transit Gateway (TGW) AWS TGW attachment for high-bandwidth or multi-VPC connectivity
VPC Peering Direct AWS VPC peering (within-AWS scenarios)

How do I whitelist a new URL for outbound access?

Add the URL/domain to the whitelist section in the customer's config YAML (deploy-raas repo) and run a changeset deployment.

whitelist:
  - "api.external-system.com"
  - "ftp.hospital.org"

For IP whitelisting (inbound to Rhapsody), update the AWS Security Group rules.

What proxy server do RaaS instances use?

All outbound HTTP/HTTPS from RaaS instances goes through:

Proxy Type: HTTP
Proxy Hostname: proxy.service
Proxy Port: 3128

Use these settings in any Rhapsody communication point that requires outbound internet access.

Data & Backups

What is backed up?

Backed up daily (to S3 backup bucket): - Rhapsody Configuration (routes, communication points, filters) - Rhapsody Administration settings (users, roles, access controls)

NOT backed up: - The Rhapsody message store (datastore) — this is stored on persistent EBS volumes that survive instance replacement. The datastore is not backed up by design.

Is data encrypted?

Yes. All data at rest is encrypted using AWS KMS-managed keys (EBS volumes, S3 buckets). All data in transit is encrypted via TLS (Rhapsody WMC: port 8444, VPN tunnels: IPSec).

Common Operational Issues

Rhapsody WMC not loading after instance replacement

Symptoms: Browser shows connection refused or TLS error on port 8444.

Cause: Instance is still bootstrapping (can take 10–15 minutes after launch), or bootstrap failed.

Fix: 1. Check bootstrap log via AWS Systems Manager Session Manager: 

less /var/log/rhapsody-bootstrap/playbookError.log
2. If Rhapsody is installed but not started: check service status 
sudo systemctl status rhapsody.service
3. If bootstrap errors are present: raise with senior engineer before taking action

High disk space alert

See Operations → Disk Space Management for the full threshold-action matrix and common causes.

VPN tunnel down

  1. Check AWS console: VPC → Site-to-Site VPN — verify tunnel status
  2. Check StrongSwan on the RaaS instance: 
    sudo systemctl status strongswan
sudo ipsec statusall
  3. Review incident history: 2022-04 Westherts HSCN VPN for a known pitfall with config strongswan without vpn_role

Alert firing but Rhapsody appears healthy

Possible causes: - Alert has not cleared after the retrigger interval (check alert history in Coralogix) - Metric name typo in PromQL (especially raas_mem_usage__ with trailing underscores) - OTEL collector not running: sudo systemctl status otel-collector

Bootstrap error after new deployment

  1. Check playbookError.log (see above)
  2. Do NOT restart the instance — contact a senior engineer
  3. Check Ansible Tower for any failed job that may have left the instance in a partial state