IZ96919: TACMD UDPDATEAGENT ON HP-UX FAILS WITH GSKIT UPGRADE ERRORS

IBM Tivoli Monitoring 6.2.2 Fix Pack 8 (6.2.2-TIV-ITM-FP0008)
IBM Tivoli Monitoring 6.2.2 Fix Pack 9 (6.2.2-TIV-ITM-FP0009)

APAR status

• Closed as program error.

Error description

• tacmd updateagent to version 6.22.03.00 fails when the
  UX agent has been installed as follows:
  
  - HP-UX platform
  - version 6.22.02.00 or earlier
  - installed via non-root user
  - SetPerm -a run on agent
  - agent started as non-root
  
  When the above conditions are met, the update fails with
  the following symptoms:
  
  - tacmd getdeploystatus reports that the request did not
    succeed.
  - The agent is no longer running.
  - CANDLEHOME/tmaitm6/agentdepot/stderr.txt contains these
    messages:
       runGSkit: ----- Running command:
       /opt/IBM/ITM/hp116/gs/bin/private_verifyinstall_64 -x -----
       runGSkit: return code from command is 99
  - CANDLEHOME/logs/candle_installation.log contains these
    messages:
       runGSkit: ----- Running command:
       /opt/IBM/ITM/hp116/gs/bin/private_verifyinstall_64 -x -----
       /usr/lib/pa20_64/dld.sl: Unable to find library
       'libgsk7kjni_64.sl'.
       Error: Verify Failed
       Expected Details of gskit in /opt/IBM/ITM/hp116/gs
       Got
       runGSkit: return code from command is 99
  - cinfo -t/-i indicates that the installer level was upgraded to
    6.22.03.00, but GSkit and the agent were not upgraded.
  
  
  RECREATE INSTRUCTIONS:
  
  1. Install, configure, and start the TEMS.
  2. Install the 6.22.03.00 version of the UX agent to the
     TEMS depot.
  3. Install, configure, and start the agent as described
     in the problem description.
  4. Use tacmd updateagent to update the agent to version
     6.22.03.00 and observe the behavior described in the
     problem description.
  

Local fix

• Update the agent locally with a manual install.
  

Problem summary

• The command "tacmd updateagent" fails with the error code
  KCIIN2374E.
  
  "tacmd updateagent" fails under these conditions:
  
  - The UNIX OS agent is version 6.22.02.00 or older.
  - The UNIX OS agent was installed via non-root user.
  - "SetPerm -a" was run on the agent endpoint.
  - The UNIX OS agent was started by a user other than root.
  - The UNIX OS agent is being upgraded to 6.22.03.00 or above.
  
  When the above conditions are met, the update fails with these
  symptoms:
  
  - tacmd getdeploystatus on the management server reports that
  the request did not succeed.
  - tacmd listsystems on the management server reports that the
  agent is still running at the prior level.
  - cinfo in the agent endpoint reports that the agent is still
  running at the prior level.
  - cinfo in the agent endpoint reports that Java RunTime
  Environment (JRE) is newer than before the failed upgrade
  attempt. Specifically, the JRE level shows 05.11.01.00 or higher
  in cinfo output.
  - The file CANDLEHOME/tmaitm6/agentdepot/stdout.txt on the agent
  endpoint contains this error message:
  KCIIN2374E ERROR - could not access CANDLEHOME
  

Problem conclusion

• The problem has to do with the JRE upgrade that occurs as part
  of the overall agent upgrade. In the problem scenario, the JRE
  upgrade leaves a file with ownership and permissions such that
  the rest of the upgrade process does not have the access it
  needs. The installer now maintains proper ownership and
  permissions for the problem file.
  
  Install Action
  
  The IBM Tivoli Monitoring Installation and Setup Guide provides
  a section entitled "Changing file permissions for agents". If
  you followed those instructions to install the UX agent with a
  nonroot user and want to use the "tacmd updateagent" command to
  update that agent, you must run this command first:
  
     secureMain -g <group> lock
  
  The value of <group> is the group name you used when you
  originally installed the agent.
  
  
  The problem is triggered by an ownership change to
  CANDLEHOME/registry/jr<plat>.ver. When the JRE is upgraded, the
  old JRE is removed and a new one is laid down in its place. As
  part of this, jr<plat>.ver is deleted and recreated. Since the
  UNIX OS agent is running with the SETUID bit on, the new file is
  owned by root instead of the original non-root user. As a
  result, the non-root user no longer has write-access after the
  JRE has been upgraded. And that lack of write-access is the
  cause of the KCIIN2374E error message.
  
  The code change was to empty the old jr<plat>.ver file instead
  of creating a new one. This empty file is then overlaid by the
  new one, so the ownership and permissions are retained during
  the process.
  
  
  
  The fix for this APAR is included in the following maintenance
  
  vehicle:
      | fix pack | 6.2.2-TIV-ITM-FP0007
      | fix pack | 6.2.3-TIV-ITM-FP0001
  

Temporary fix

• After the failed deploy, change ownership of the files in
  CANDLEHOME to the non-root user who installed or started the
  UNIX OS agent, run SetPerm, and then attempt the deploy again.
  Because the JRE was upgraded by the first attempt and the
  ownership has been fixed, the second attempt will succeed.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  OMEG DIST INSTA

• Fixed component ID

  5608A41CI

Applicable component levels

• R622 PSY

     UP