IT27375: SSL CERTIFICATE OPERATIONS MIGHT CAUSE ANS1579E CLIENT MESSAGE OR DELAY THE IBM SPECTRUM PROTECT SESSION INITIALIZATION

IBM Spectrum Protect client 7.1.8.x interim fix downloads

APAR status

• Closed as program error.

Error description

• Users of the IBM Spectrum Protect client might witness delays
  of several hundred milliseconds while initializing a session
  with the IBM Spectrum Protect server.
  
  These delays are hardly noticeable when large files are sent or
  received, but they can become apparent when an application
  attempts to open sessions at a high rate, where an individual
  session moves only a few bytes of file data or meta data.
  The symptom was discovered with Oracle performing 'crosscheck'.
  
  Other applications performing tasks with a similarly high
  session rate might expose the symptom as well.
  
  Product versions affected: IBM Spectrum Protect client
                             version 7.1 with
                             maintenance level 7.1.8.0 or above,
                             version 8.1 with
                             maintenance level 8.1.2.0 or above
             Initial impact: Medium
        Additional keywords: SSL KM ICC GSKit dsmInit
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect API and backup-archive clients versions *
  * 7.1 and 8.1 on all platforms.                                *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is projected *
  * to be fixed in levels 7.1.8.5 and 8.1.7. Note that this is   *
  * subject to change at the discretion of IBM.                  *
  ****************************************************************
  

Problem conclusion

• The fix introduced a few new testflags which can be used to tune
  overall performance of API and backup-archive clients' sessions
  dealing with SSL certificates handling:
  - testflag CERTFILE_OPEN_TIMEOUT can tune the serialization
  timeouts (if any) in the handling of SSL certificate index
  files;
  - testflag C2S_CERTDIR can be used to specify the specific
  location of dsmcert.* files e.g. a shared directory in a
  clustered environment on UNIX and Linux;
  - testflag C2C_DISABLE can be used to eliminate the processing
  of spclicert.* files completely.
  The latter capability is important for customers who run a lot
  of short API operations e.g. as part of Oracle RMAN 'crosscheck'
  command.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• API
  

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels

• R81A PSY

     UP

• R81H PSY

     UP

• R81L PSY

     UP

• R81M PSY

     UP

• R81S PSY

     UP

• R81W PSY

     UP