IOS000I Message with Encryption Failure

If an encryption-related key exchange between the drive and the key manager fails, an IOS000I message is issued indicating that an encryption failure has occurred:

IOS000I 07C2,7D,IOE,06,0600,,**,J1G150,ENCREADA 594                   
804008C022402751 0806FF0000131415 0017181900000092 2004E82061C42111  
ENCRYPTION FAILURE  
CU=08 DRIVE=131415 EKM=171819

Note: The preceding values for CU, DRIVE, and EKM generically represent the byte positions in sense data where the errors would be reported .

The control unit (CU), DRIVE, and Encryption Key Manager (EKM) error codes are from sense bytes 08, 13-15, and 17-19, respectively. For example:

IOS000I 0BD0,60,IOE,01,0E00,,**,JJC046,ATNCMP1                     
	804C08C022402751 0001FF0000000000 0005EE3100000092 2004E82061BA2111  
	ENCRYPTION FAILURE  
	CU=00 DRIVE=000000 EKM=05EE31

In this example, the error was reported by the Encryption Key Manager (EKM).

For an EKM failure, refer to the Problem Determination section of the IBM System Storage Tape Encryption Key Manager, Introduction, Planning, and User's Guide, GA76-0418. When looking up the EKM failure, use the last two byes of the error code (for example, EE31 in the example above).

For a control unit failure, refer to the IBM System Storage TS1120/TS1130 Tape Drive and Controller Operator Guide 3592 Models J1A, E05, E06, EU6, J70 and C06, GA32-0556. Table 1 contains error codes for control unit failures.

Table 1. Error codes for control unit failures
Error Code	Description	Recovery Action
00	Not a control unit reported failure	Refer to the EKM and drive error codes reported in the IOS000I message for failure information.
01	The EKM was not available for an out-of-band key exchange.	Verify the EKM that the control unit is configured to use and also verify the state of that EKM. However, if the intent was to use in-band key management, use the EKM subcommand of the IECIOSxx PARMLIB member or the SETIOS command to specify your key manager(s).
02	Timeout for an out-of-band key exchange	The EKM may have gone down mid-sequence, or there may be a network problem. Verify the state of the EKM and the TCP/IP network. However, if the intent was to use in-band key management, use the EKM subcommand of the IECIOSxx PARMLIB member or the SETIOS command to specify your key manager(s).
03	An in-band key exchange was canceled by the host.	Check for an IOS628E message for further information as to why the in-band proxy may have canceled the key exchange. For additional information on these error codes, see z/OS UNIX System Services Messages and Codes.

For more detailed information about the drive-reported conditions, and also about the EKM-reported conditions, see the Problem Determination section of the IBM System Storage TS3500 Tape Library Operator Guide, GA32-0560.

If there are multiple error codes reported, start with the EKM error code.

In addition, any system-managed tape library scratch tape that receives the IOS000I ENCRYPTION FAILURE message along with an IEC512 I/O ERR, remains in a scratch status, but is updated in the Tape Control Data Base (TCDB) with a VOLUME ERROR STATUS of I/O ERROR. This causes it to be placed in the software error category, and the tape is unusable until the I/O ERROR condition is cleared through manual intervention (for example, use ISMF volume ALTER from scratch. Scratch moves the volume from the software error category back to the scratch category). Periodically, use the DISPLAY SMS,LIBRARY command with DETAIL to display the number of scratch volumes in the software error category.