IT30094: OFFLOAD OR ARCHIVE JOB FAILS WITH 'CIPHER OPERATION FAILED: TYPE: ENCRYPTIONERROR'

APAR status

• Closed as program error.

Error description

• When running an Offload or Archive job in IBM Spectrum Protect
  Plus, the job fails for one or more VMs/databases and the job
  log indicates:
  
  Failed to create storage replication relationship  message
  :"Cipher operation failed: "type :"EncryptionError"
  
  This error occurs only on the first attempt when a new base
  offload or archive is attempted for the first time from a new
  vSnap. The error no longer occurs on subsequent attempts.
  

Local fix

• Rerun the failed job.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.4.                      *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in IBM Spectrum Protect Plus level     *
  * 10.1.5. Note that this is subject to change at the           *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• On a new vSnap server, encryption keys are initialized during
  the first run of an offload or archive session. If two sessions
  of type offload or archive start simultaneously, both attempt to
  initialize new keys which results in a race condition which
  causes one of the sessions to succeed and the other to fail. The
  failed session can be immediately retried at which point it
  succeeds. The problem has been resolved by adding
  synchronization logic around the process of initializing keys.
  This ensures only one session will attempt to initialize the
  keys and the remaining sessions will then reuse them.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels