anchor.diff:  
   This is also where you can change the default Kill Bill admin credentials: specify `org.killbill.security.shiroResourcePath=/var/lib/killbill/config/shiro.ini` and create the `shiro.ini` file accordingly (see our https://docs.killbill.io/latest/user_management.html[RBAC guide] for more details).
   
  +=== TroubleShooting Section
  +
  +
  +After launching the EC2 instance, the full stack should come up, with all services enabled and running, that is:
  +
  +* An nginx instance receiving traffic on port `443` and `8443`
  +* A instance of Kill Bill server listening on `127.0.0.1:8080` (and receiving external traffic through nginx on port `8443`)
  +* A instance of Kaui listening on `127.0.0.1:3000` (and receiving external traffic through nginx on port `443`)
  +* A local `mysql` server running on port `3306`
  +
  +In this section, we will provide some tips to verify the health of the system, and what to do when things are not working
  +
  +**SSH to EC2 Instances**
  +
  +From the EC2 dashboard, in the instance `Description` tab, you can copy the public DNS, called `Public DNS (IPv4)`.
  +Then, using the private key you specified when creating the instance:
  +
  +```
  +# SSH as ubuntu user
  +> ssh -i  <LOCATION_KEY>/<KEY_NAME>.pem ubuntu@<PUBLIC_DNS>
  +# Move to tomcat user
  +> sudo su - tomcat
  +```
  +
  +**Service Health**
  +
  +All services are started using System V init scripts, and so the status of the service can be retrieved:
  +
  +* Kill Bill server: `service killbill status`
  +* KAUI server: `service kaui status`
  +* Nginx server: `service nginx status`
  +
  +Similarly one can `start`, `stop` the services using simalr command -- e.g `service kaui stop` to stop KAUI.
  +
  +In order to verify the health of the Kill Bill server instance, you can issue the following commands:
  +
  +* Healthcheck endpoint: `curl http://127.0.0.1:8080/1.0/healthcheck`
  +* System info: `curl -u admin:password http://127.0.0.1:8080/1.0/kb/nodesInfo`
  +
  +**Log Files**
  +
  +Tomcat logs are under `/var/lib/tomcat/logs/`:
  +
  +* KAUI logs: `/var/lib/tomcat/logs/kaui.out`
  +* Kill Bill server logs: `/var/lib/tomcat/logs/catalina.out`
  +
  +Nginx logs can be found under `/var/log/nginx/`
  +
  +* Access logs: `/var/log/nginx/access.log`
  +* Error logs: `/var/log/nginx/error.log`
  +
  +**Database**
  +
  +In order to access the database, one can use the following command  `mysql -u root -proot`. There is one `killbill` and one `kaui` database
  +created and used by the respective application
  +
  +
  +**Nginx**
  +
  +The configuration files are located under `/etc/nginx/` -- e.g `/etc/nginx/sites-enabled/killbill.conf`
  +
   === Upgrade steps
   
   Note: you must switch to the `tomcat` user first in order to upgrade Kill Bill or Kaui (`sudo su - tomcat`).
  
positive.code: Upon success, once the instance is running, Kill Bill is running on port 8443 and Kaui on port 443.
  
  
  
  You can log-in to Kaui by going to https://<INSTANCE_IP_>:443 (make sure your IP address can address this port, or add it to the security group as needed). Default credentials are: *admin/password*. The first few requests might be a bit slow as Kill Bill initializes itself.
  
  Take a look at our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide for an introduction to Kaui.
  
negative.code: The configuration file `/var/lib/killbill/kpm.yml` specifies the Kill Bill version (and its plugins) running on the instance. After updating this file with the new version(s), simply execute `$KPM_INSTALL_KB_CMD`, delete the cached directory `/var/lib/tomcat/webapps/ROOT` and restart the instance.
  
  A similar process can be used for Kaui: update `/var/lib/kaui/kpm.yml`, run `$KPM_INSTALL_KAUI_CMD`, delete the cached directory `/var/lib/tomcat/webapps2/ROOT` and restart the instance.
  
  
  == Installation via CloudFormation
  
  