Management of POWER8 and Later Update Access Keys

POWER8 (and later) servers include an “Update Access Key” (UAK) that is checked when applying system firmware updates.  Entitled updates are applied if the embedded expiration date of the UAK is later than the firmware release date.  As UAKs expire, users may obtain new UAKs to enable on-going maintenance and application of entitled firmware updates.  An expired UAK does not impede the operation of the server.   

An expired update access key must be replaced before any system firmware updates can be applied to the system (Some Exceptions Apply - A server is entitled to all firmware updates that were made available during the time period for which the server had a valid update access key). Your POWER8 server will provide several warnings in the 30 days prior to the expiration of the system’s update access key and if/when an update access key is allowed to expire

It is possible to check the expiration date using the lslic command:

  # lslic -m 9119-MME*??????? -F mtms,update_access_key_exp_date  9119-MME*???????,04/01/2040  

HMC message screen will be displayed as the "update access key" approaches expiration.

Countdown to Expiration: This screen will be displayed at 30, 20, 10, 5, 4, 3, 2, and 1 day(s) before the "update access key" expires. The message will read:

HSCL0071:The update access key for this server expires in {number} days. 
To renew the hardware entitlement of this  server, obtain a new update access key 
from the website http://www.ibm.com/servers/eserver/ess.  Use the management console 
Capacity on Demand (CoD) Enter CoD Code task to enter the new key on the server.      

This HMC message screen will be displayed when the "update access key" expires:

HSCL0072: The update access key for this server has expired. To renew the hardware entitlement of this server, obtain a new update access key from the website http://www.ibm.com/servers/eserver/ess. Use the management console Capacity on Demand (CoD) Enter CoD Code task to enter the new key on the server.
(image)

The General progress panel has a row for each selected server. As the firmware update progresses, updated status messages are displayed on the panel. If an error happens, it is noted at the end of the install task.

The Welcome page shows the update access key status in the upper right hand corner.

Update Access Key expiration warnings can be seen in the error logs. These warnings will be displayed in the "Extended trace events". They will be listed as an informational event (SRC A7004760), and will be logged at 30, 20, 10, 5, 4, 3, 2, and 1 day(s) before the update access key expires.


After Expiration date (SRC A7004761) will show up, except it will be in the top part of the error log, in the "Serviceable/Customer attention events", not in the lower section of the error log in the "Extended trace events" section as shown above. User Documentation will describe the SRC codes and the action that must be taken to address them. (there is no interactive capability on the ASMI screens). A pointer to the LMS website (http://www.ibm.com/servers/ess) will be included in the description

A new update access key can be acquired by visiting the IBM Entitled Systems Support (ESS) tool: http://www.ibm.com/servers/eserver/ess/index.wss

Step 1: Gather Data you will need to know your server's machine type, serial number, and the country of installation in order to obtain a new update access key.

Step 2: Login to the "IBM Entitled System Support (ESS)" web page using your IBMid

Step 3: Navigate to the "My Entitled Hardware" menu on top and select "Update Access Keys" application.

Step 4: Click on the plus (+) icon above the table, enter your server’s machine type and serial number or click on "Load from profile" action button to either retrieve your machines from the customer numbers registered in your ESS profile or load machines from your renewal history.

Note: You may enter each server machine type and serial number individually, or you can upload a list of servers

Step 5: In the table, you’ll see the machines you added to it and see the particular status of each of them. You will be able to select multiple machines at a time to renew them all at once. You will be also able to download the keys, send them via email, get help from support in case there's any issue, or remove the machine from the particular list you just built in.

Step 6: After retrieving your server’s new update access key, return to your server and enter the key on your HMC (using the “Enter CoD Code” feature) or via the ASMI (using the “CoD Activation” feature)

The initial Update Access Key is loaded during the manufacturing process and is dated to align with the expiration of the initial warranty period.

The term of any subsequent agreement (e.g. IBM hardware maintenance service agreement or special bid agreement) may vary. Therefore, replacement Update Access Keys are issued with a duration of 180 days.

Enter your replacement update access key via the "Enter COD Code" panel on your HMC.

Or From Serviceability -> Service Management -> Transmit Service Information panel.

Enable a scheduled operation to check for keys or run "Send Now" to check now.

Update access keys are a feature on POWER8 and later servers.
 

Enter your replacement update access key via the "COD Activation" Panel on the ASMI menu.

Check the status of your update access key via the “lscfg –p” command (on Linux) or the “lscfg –vpl sysplanar0” command (on AIX). If your update access key has expired, proceed to the website listed in the answer to question 3 to replace your update access key. Sample Linux Screen: - "Update Access Key" is shown in the system firmware content - No "interactive" capability for managing the keys - If an update fails to proceed, a pointer to the LMS landing page is provided



Sample AIX Screen - "Update Access Key" is shown in system firmware content - No "interactive" capability for managing the keys. - A failed system update references the update access key.

Check the status of our update access key via the “Display Firmware Status” screen. If your update access key has expired, proceed to the website listed in the answer to question 3 to replace your update access key. The below image shows what it will look like in the IBM i 7.1 and 7.2 releases. In the 7.3 release, the text will change to "Update Access Key Expiration Date". The line highlighted below will be displayed whether the system is OS managed or HMC managed.



The following image shows the 7.3 release and the change in text:


- The client can access "help" relative to the Update Status field:
Update access key expiration date – Help
- The expiration date of the update access key. Server firmware fix packs with a later date will not be activated until a valid update access key expiration date is detected. For more information, you can go to IBM Entitled Systems Support (ESS) tool or review ESS documentation.
Update status – Help
- Shows the update status of the temporary and permanent copies of the server firmware. If the update status is Staged or Pending when no server IPL is required, a server IPL is recommended to clear the update status. This condition can occur as the result of cancelling the delayed application or removal of a server firmware PTF. The possible values are:

None - No updates are in progress or pending.
In progress - An update is currently in progress from the operating system copy to the corresponding server firmware copy.
Staged - An update has been made from the operating system copy to the corresponding server firmware copy.
Pending - An update may be made when the next server IPL is performed. This value is only valid for the permanent server firmware copy.
Not allowed - An update is not allowed because the operating system copy is incompatible with the server firmware copy.
Key expired -
       The Update access key expiration date is earlier than the date of the server firmware fix pack.
       The fix pack will not be activated until a valid Update access key expiration date is detected.
       For more information, you can go to IBM Entitled Systems Support (ESS) tool or review ESS documentation.

The IBM Systems Director Update Manager extension uses the update access key to validate firmware updates. If a firmware update fails to proceed, the message shown directs the client to the LMS website


(DNZPFW086W Installation of Power System Firmware update ########### failed because the update access key validation failed for the system ####. Go to URL http://www.ibm.com/servers/eserver/ess for information on updating the update access key value.)

Enter your replacement update access key via the "COD Activation" Panel on the ASMI menu.
 

HMC - A Hardware Management Console (HMC) is an appliance used to manage Power Systems servers. In particular, it may be used to create or change virtual machines (LPARs), including dynamically altering the hardware assigned to an LPAR (add and remove) without rebooting the operating system running in the LPAR.

Hardware Management Console
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Power%20Systems/page/Hardware%20Management%20Console