HSBC Secure Epayments to Global Iris (Realex)

[tantronics]

Hi Chris,

I can understand you being very protective and sensitive about Sellerdeck, I think we are all the same about our companies, and to a degree those we choose to work with.

After all, we chose Sellerdeck (or Actinic version 3 as it was when we started) for good reasons, over and above any other offerings, and many of us will champion it for you.

However ... (you knew there was a but on the way)

I do think that Sellerdeck have a responsibility to ensure any "third party" or "approved" integrations, that are distributed by Sellerdeck, function correctly and fully for your customers.

From your customers point of view the integration is provided by Sellerdeck and we shouldn't have to fiddle with it to make it work. The fact the Realex produced the code and provided it to you to redistribute really shouldn't be our problem.

An analogy relevant to us (we sell batteries):

If we sold a torch bundled with some Duracell batteries (that Duracell told us would work with this torch) and our customer found them to be the wrong size, we wouldn't expect them to go Duracell to get it resolved, they would come to us and we would go to Duracell.

We would get it working properly for our customer because they have paid us for a torch that doesn't work with the batteries we recommended.

this may be over simplistic, but you get my meaning.

[cbarling]

David, I couldn't agree more that it shouldn't be your problem. I also think you have caught some of the issues in your post.

However, given that Realex get 100% of the revenue and we get 0% I don't understand why it isn't Realex's problem.

My analogy would be if you had a shop and had kindly agreed to let someone put a photo machine in. The people who put it in would turn up monthly to collect the takings. But it you made nothing from it would you be expected to fix it if it went wrong?

Chris

[feemish]

but it hasnt gone wrong.. it seems that it never really worked properly.. should you let your customers use a faulty photo machine? Dont you owe it to them to check it all works ok? If it's on your premises then you have to take a degree of responsibility, because you are promoting it. Plus using your analogy.. that you receive no income.. Would people buy actinic at all if it didnt come with built in psp integrations? So in one way you already benefitted from having the integrations built in, and people upgrade actinic many times. So there is a revenue source from providing integrated psp services.

I can understand your perspective, really I can.. and I'm a big fan of Actinic/Sellerdeck.. have been for years, and I often tell people that actinic is an excellent piece of software for entry level ecommerce. But I cant help having the feeling that since Actinic Payments came along, there seems less urgency in sorting out problems with other psp's... and really how much actual coding work is involved in making these fixes for an expert.. probably very little.. it feels like there is a drive to get everyone onto AP.. thats fair enough.. it makes business sense for you.. but it shouldnt be at the expense of those who for whatever reason want to use other psps. I hope thats fair.. I do like actinic a lot.

[tantronics]

And it's the shop owner that would get it in the neck from the customer - and in your analogy I'm afraid you're the shop owner Chris!

[feemish]

It was great that David took the time to modify the file, and his mod works

By the way Accrding to Realex, it was one of their staff who wrote this modification for the editing the "OCCRealexScriptTemplate.pl" file, and then gave it David who posted it here.. So Realex are making an effort to improve the code.

[tantronics]

Hi Mark,

This is true, but I was asked not to credit them with it because it wasn't official and more like one of their engineers saying "try this see if it works" - at the time I was taking the stance that if it didn't work we wouldn't use Realex, so perhaps this had an influence

[feemish]

I see.. I can edit that post regarding this if you think its breaking confidence.

[tantronics]

Hi Mark,

I wouldn't worry, I'm sure it's not a problem.

[feemish]

WARNING!

Realex

A few weeks ago I had a customer call asking where his order was. I couldnt find an order from him, but he insisted that the money had left his account. On looking closer indeed it had !
The callback/response had failed. So I had taken money from his account but his order was still in 'pending payment provider'
I complained to Realex who told me that an alert had been generated, but that due to some error I had not been notified. They promised that I would be notified in future.

I was looking at transactions on Realex today due to a refund.. and I noticed a duplicate payment.
On comparing with Actinic I noticed that this order was still in pending.. but it was paid for, I checked other orders and discovered that over the weekend 5 payments had been made for orders that were still in payment pending!!! The resonse/callback had failed... but I had received no alert, and it was only by chance that I saw these payments.

If I hadnt looked, then 5 people would have been waiting for Christmas orders that they have paid for but I didnt know about !! This is obviously a very serious issue. My confidence in Realex and the integration is becoming severely eroded. In 5 years of using the HSBC Secure Epayments service, this never happened ONCE.

[feemish]

From bad to worse

I have now received a reply from Realex as to why they didnt 'alert me' (which is what they are supposed to do if a callback fails) They are now telling me that according to their system, the callback didnt fail on these orders ! so thats why I wasnt alerted.

There were 20-30 orders that day that successfully completed and went into 'pending' ... 5 orders that were paid for stayed in 'payment pending'

We have reviewed the below transactions, and cannot see that there was any issues in connecting back to the response page.
There was no issue in logging these on the 8th of December, as we generated these alerts for other merchants successfully.
There were approx. 20 transactions performed on that day, and for each one we have connected back to the response page.

Can you confirm via your IIS logs that we did fail to connect back, as our system does not indicate this.

This raises some serious issues.

IF the callback didnt fail,as they say it didnt... why did these orders stay in payment pending ?

To clarify, these orders stayed in payment pending, but Realex say the callback didnt fail.

I wonder if someone could tell me;
A/ Is that possible?
B/ what are IIS logs ?


I think ISS logs are a windows thing.. I have a linux server. Would I look at my error logs?
Does anyone know where on my linux cpanel server I should look to be able to confirm that the callback failed.

Thanks in advance for anyhelp...
Again, as the shop owner, I am stuck between the psp and actinic.

[gcamley]

There are a couple of things we can do to try to find what is going wrong.

Firstly, in the server folder (usually acatalog) there may be an error.err file. This can be viewed in a browser by going to 'Help | Troubleshooting' and selecting 'View Error Log'. Look for any errors around the time the failed orders were placed.

Secondly, the web server will keep logs of all requests and details of failed requests. Probably you have Apache web server in which case the files are normally access_log and error_log. Where these files are will depend on the server configuration. Maybe your ISP can assist with getting hold of these files or at least extracts from them around the time of the orders were failing. We would need to look for requests that call the OrderScript.pl. Without details of your network settings I can't say exactly what the request would be but if your Network Settings use a perl script ID of 1 then the request should contain 'os000001.pl?PATH=' depending on what is found in the logs we can determine if the callback reached the server.

If the problem is continuing there is a debugging switch in the OrderScript that will allow us to see the call back details and the response from the server to the PSP.

• edit OrderScript.pl in your site folder with a text editor such as Notepad.exe
• search for nDebugLogLevel, you should see

my $nDebugLogLevel = 0;

• change the value from 0 to 1 so it reads

my $nDebugLogLevel = 1;

• save the file and exit Notepad
• update the web site
• next time the payment fails check the error.err file as described earlier
• once the problem is solved this debug setting should be reverted to 0

To take this further I suggest you raise this with SellerDeck support mentioning this thread and asking for the issue to be escalated directly to me.

[feemish]

thanks very much for the swift reply.

I have just checked the error log (error.err) There are many errors going back over a year or so. There is only one error on the day these transactions failed, and it is not at the time of the orders.

my error log is where it should be, the url of my shop is www.arka-shop.co.uk

the error on the day of these orders is as follows;

Program = ORDERSCR, Program version = 25252 , HTTP Server = Apache/2.2.22 (Unix) mod_ssl/2, Return code = 999 , Date and Time = 2012/12/08 16:13, Internal Errors = The transaction cannot complete successfully. Instruct the customer to use an alternative payment method.

The times of the orders where the callback failed are
03.13
10.18
21.31
21.57
22.02

all on the 8th December.

I will now look into your second suggestion regarding the server logs.
Thanks for your help.

[feemish]

I rent a virtual server and host a number of sites using whm and cpanel
I have download the error_log and access_log from the server.
However these seem to be logs for the actual server not my shop account, as they seem to be higher level logs. The error log I seem to have for the account only has the last 300 entries, and the access log only todays access, so both do not go back enough.

I will contact support and see if they can help get logs going back a few days.
I'll post tomorrow.
I opened a support ticket before I posted this problem, when I hear back I will tell them to escalate it to you as you suggest.
Thanks again.

[Darren B]

interesting comments from earlier posts

I maybe wrong but i thought Actinic/sellerdeck sold the PSP intergration kit to PSP's and not for a small sum either so does this not mean that you guys did receive a payment of sorts so the analogy used is incorrect?

[feemish]

Hi gcamley,

I have been looking into the server logs.
I downloaded and examined;

> /usr/local/cpanel/logs/access_log
> /usr/local/apache/logs/error_log

However these seem to be general logs for the WHM/cPanel interface, and there was no domain specific info in them at all.

I then contacted my server support who told me the domain web logs are at:

/usr/local/apache/domlogs/domain.com

There was only one file in this location, named after the domain (mydomain.co.uk) Nothing there called error_log or access_log. I opened the file, it only contained data from today.. evidently at the end of the day once the data is processed by the webstat tools each evening it is deleted. However, on inspection there were NO instances of 'os000001.pl?PATH=' at all.
Even though there have been lots of orders today.

I can see
os000001.pl?ACTION=Start
cgi-bin/os000001.pl?ACTION=GETPSPFORM&PAYMENTMETHOD

and others... but not os000001.pl?PATH=

am I looking in the right place. To be fair I am a little out of my depth with all this.
Even if this is the right file, its only got data from today anyway, so it will not help in solving the problems from the 8th.

However I would like to know what a callabck request would look like. Am I able to send you the file so you can highlight the callback requests in todays log?