IT41127: AFTER UPGRADING THE BACKUP-ARCHIVE CLIENT TO VERSION 8.1.9.2 OR HIGHER THE CLIENT MAY HANG

APAR status

• Closed as program error.

Error description

• In rare circumvention's, after upgrading the Backup-Archive
  Client to Version 8.1.9.2 or higher the client appears to hang.
  The client might take a long time to authenticate with the IBM
  Spectrum Protect Server. This problem can affect backup-archive
  clients and applications using the API.
  
  The problem can be identified by:
  -The application appears to hang.
  
  -The command
  ?gsk8capicmd_64 -cert -list -db dsmcert.kdb -stashed"
  appears to hang.
  
  The problem does not occur on new installations, since there are
  no pre-existing dsmcert.* files.
  
  IBM Spectrum Protect versions Affected:
  
  IBM Spectrum Protect Version 8.1.9.2 and above on all supported
  platforms
  
  Additional Keywords: TS009109119 GSKit certificate client node
  session
  

Local fix

• The dsmcert.* files can be found on the following locations on
  the client.
  
  API
  Windows ? C:\Program Files\Common Files\Tivoli\TSM\api64
  Linux - /opt/tivoli/tsm/client/api/bin64
  AIX - /usr/tivoli/tsm/client/api/bin64
  
  B/A client
  Windows ? C:\Program Files\Tivoli\TSM\baclient
  Linux - /opt/tivoli/tsm/client/ba/bin
  AIX - /usr/tivoli/tsm/client/ba/bin64
  
  If the user does not have write authority to the client
  installation directory the files are stored in the user?s home
  directory
  Windows ? C:\users\<username>\IBM\SpectrumProtect\certs
  Linux/Unix - /home/<username>/IBM/SpectrumProtect/certs
  
  Based on the client?s user authority, delete the dsmcert.kdb and
  dsmcert.sth file on the client side and change the node's
  sessionsecurity to transitional on the IBM Spectrum Protect
  Server?s dsmadmc command line:
  UPDATE NODE xxx SESSIONSECURITY=TRANSITIONAL
  
  A new client connection will recreate the previously deleted
  dsmcert files. There is no need to touch the dsmcert.idx file.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum protect backup-archive client and APIs versions *
  * 8.1.9.0 - 8.1.15.1 running on all platforms                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * The problem was introduced in GSKit version 8.0.55.10 where  *
  * an invalid iteration count field in the dsmcert.kdb keystore *
  * can lead to a very high number of loops, giving the          *
  * appearance of a hang.                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in version 8.1.15.2 and 8.1.17. Note   *
  * that this is subject to change at the discretion of IBM.     *
  ****************************************************************
  

Problem conclusion

• GSKit, 8.0.55.28 is added to the backup-archive client. This
  version includes a fix that validates the interation count
  first. Thus, instead of looping for a very long time, it
  immediately returns error GSKKM_ERR_DATABASE_INVALID_FILE_TYPE.
  The backup-archive client displays the following message:
  
    ANS5283E The operation was unsuccessful.
  
  The dsmerror.log (dsierror.log for the API) includes these
  messages:
  
    ANS1579E GSKit function GSKKM_ImportKeys failed with 17:
             GSKKM_ERR_DATABASE_INVALID_FILE_TYPE
    ANS9020E A session could not be established with a IBM
             Spectrum Protect server or client agent.  The return
             code is -1.
    ANS5283E The operation was unsuccessful.
  
  When this problem occurs, the dsmcert.kdb file cannot be
  repaired. The corrective action is:
  
  1. Manually delete the dsmcert.kdb and dsmcert.sth files
  
  2. Run the following command on the IBM Spectrum Protect server:
       UPDATE NODE node_name SESSIONSECURITY=TRANSITIONAL
  
  3. Start a client or application session with the IBM Spectrum
     Protect server to generate a new dsmcert.kdb keystore. The
     node's session security is reset to STRICT.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• dsmagent dsmc     dsmcad   dsmcsvc  tsmapi64
  

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels