Encryption Key Manager reported errors
Error messages are reported by the IBM® Encryption Key Manager and are related to the TS1120 and later tape drives. The table includes the error number, a short description of the failure, and corrective actions. Refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en for information about the EKM debug tool.
| Error Number | Description | Action |
|---|---|---|
| EE02 | Encryption Read Message Failure: DriverErrorNotifyParameterError: "Bad ASC & ASCQ received. ASC & ASCQ does not match with either of Key Creation/Key Translation/Key Acquisition operation." | The request is for an unsupported action. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check the versions of drive or proxy server firmware and update the firmware to the latest release, if needed. Enable debug-tracing on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE0F | Encryption logic error: Internal error: "Unexpected error. Internal programming error in EKM." | Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check the versions of drive or proxy server firmware and update them to the latest release, if needed. Enable debug-tracing on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| Error: Hardware error from call CSNDDSV returnCode 12 reasonCode 0. | With hardware cryptography, ensure that ICSF is started. | |
| EE23 | Encryption Read Message Failure: Internal error: "Unexpected error........" | The message received from the drive or proxy server cannot be parsed because of general error. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Enable debug on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE25 | Encryption Configuration Problem: Errors that are related to the drive table occurred. | Ensure that the config.drivetable.file.url is correct in the KeyManagerConfig.properties file,
if that parameter is supplied. Run the listdrives -drivename
<drivename> command on the Encryption Key Manager server
to verify whether the drive is correctly configured (for example,
the drive serial number, alias, and certificates are correct). Ensure
that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check
the versions of drive or proxy server firmware and update them to
the latest release, if needed. Enable debug tracing and retry the
operation. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE29 | Encryption Read Message Failure: Invalid signature | The message received from the drive or proxy server does not match the signature on it. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Enable debug on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE2B | Encryption Read Message Failure: Internal error: "Either no signature in DSK or signature in DSK cannot be verified." | Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check the versions of drive or proxy server firmware and update them to the latest release, if needed. Enable debug-tracing on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, Whom do I contact for Encryption Key Manager support? |
| EE2C | Encryption Read Message Failure: QueryDSKParameterError: "Error parsing a QueryDSKMessage from a device. Unexpected dsk count or unexpected payload." | The request to the Encryption Key Manager is an unsupported function. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check the versions of drive or proxy server firmware and update them to the latest release, if needed. Enable debug-tracing on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, Whom do I contact for Encryption Key Manager support? |
| EE2D | Encryption Read Message Failure: Invalid Message Type | The Encryption Key Manager received a message out of sequence or received a message that it does not know how to handle. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Enable debug on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE2E | Encryption Read Message Failure: Internal error: Invalid signature type | The message received from the drive or proxy server does not have a valid signature type. Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Enable debug on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE30 | Prohibited request. | The request to the tape drive is an unsupported function. Enter the correct, supported command for the target tape drive. |
| EE31 | Encryption Configuration Problem: Errors that are related to the keystore occurred. | Check the key labels that you are trying to use or configured for the defaults. You can list the certificates that are available to the Encryption Key Manager by using the listcerts command. If you know that you are trying to use the defaults, then run the listdrives -drivename drivename command on the Encryption Key Manager server to verify whether the drive is correctly configured (for example, the drive serial number, and associated aliases/key labels are correct). If the drive in question has no aliases/key labels that are associated with it, then check the values of default.drive.alias1 and default.drive.alias2. If this check does not help or the alias/key label exists, then collect debug logs and contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EE32 | Keystore-related problem. | Most likely cause is either that tape
was encrypted with a different Encryption Key Manager with
different keys or the key that was used to encrypt this tape was renamed
or deleted from the keystore. Issue list -keysym and
ensure that the request alias is in the keystore. |
| EEE1 | Encryption logic error: Internal error: "Unexpected error: EK/EEDK flags conflict with subpage." | Ensure that you are running the latest version of the Encryption Key Manager (refer to http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en to determine the latest version). Check the versions of drive or proxy server firmware and update them to the latest release, if needed. Enable debug on the key manager server. Try to re-create the problem and gather debug logs. If the problem persists, contact IBM for support. See Whom do I contact for Encryption Key Manager support?. |
| EF01 | Encryption Configuration Problem: "Drive not configured." | The drive that is trying to communicate with the Encryption Key Manager is
not present in the drive table. Ensure that the config.drivetable.file.url
is correct in the KeyManagerConfig.properties file,
if that parameter is supplied. Run the listdrives command
to check whether the drive is in the list. If not, configure the drive
manually by using the adddrive command with the correct
drive information or set the "drive.acceptUnknownDrives" property
to true using the modconfig command. Enable debug
tracing and retry the operation. If the problem persists, contact IBM for
support. See Whom do I contact for Encryption Key Manager support?. |
Whom do I contact for Encryption Key Manager support?
The entitlement for software support varies depending on the operating system on which the Encryption Key Manager is running, and depending on whether the support requirement is defect-related or implementation-related.
| Type of Support | IBM Operating Systems: zOS, AIX®, i5OS Linux™ | Non-IBM Operating Systems: Windows™, Solaris, HP/UX | |
|---|---|---|---|
| Defect Support | Contact IBM Service with IBM operating system 's name or identifier and customer number. | Contact IBM Service with IBM Tape Library 's machine type/model and serial number. | Contact IBM Service with TPC/BE name or identifier and customer number. |
| Implementation Support 1 | Contact SupportLine IBM Service. | Contact SupportLine IBM Service. | Contact SupportLine IBM Service. |
| 1 An IBM Supportline contract offers the best Encryption Key Manager implementation assistance. Some basic implementation assistance can be obtained by contacting IBM Service. Use the same machine type-model that would be used to report a defect. Should your customer require more extensive implementation assistance, billable onsite services are available from IGS and Lab Services. Contact IGS Inside Sales (888-426-4343 option 3) to obtain a Statement of Work (SOW). | |||
If there is a defect, IBM Service is always the first point of contact. The method to engage IBM Software Service varies depending on the operating system on which Encryption Key Manager is being run.
For the following IBM operating systems: z/OS®, AIX, and i5/OS®, contact IBM Service (For US customers call 800-IBM-SERV). Select the software option, then identify the operating system and the same customer number that was used to order the operating system.
For Linux, select the hardware option, and use the Machtype-Model of the tape library to report the defect.
For the non-IBM operating systems; Windows, Solaris, and HP/UX, select the software option. Then, identify the software as TPC/BE and supply the same customer number that was used to order TPC/BE.
Note: The
relevant operating system here is the operating system on which Encryption Key Manager is
running, not the operating system that is generating the encrypted
IOs.
To search the IBM Tivoli Key Lifecycle Manager Knowledge Center, visit the web at http://www-01.ibm.com/support/knowledgecenter/SSB2KG/welcome.
To search the IBM Security Key Lifecycle Manager Knowledge Center, visit the web at http://www-01.ibm.com/support/knowledgecenter/SSWPVP/welcome?lang=en.