Guardium Windows S-TAP 12.1.0.162, 12.0.0.293, and 11.5.0.437 might cause Microsoft SQL Server instability when using MARS on an encrypted database connection

Content

Issue description

Due to a change in the Guardium correlator DLL, customers who deployed affected Guardium Windows Software TAP (S-TAP) agents (rev. 12.1.0.162, 12.0.0.293, or 11.5.0.437) might experience server instability. This event is triggered when multiple active result sets (MARS) on encrypted database connections are used.

Customers who do not use the MARS feature in Microsoft SQL Server client connection string are not affected.

Remediation

IBM removed the following affected Windows S-TAP agents from the IBM Support Fix Central website:

• For base version 12.1: Windows S-TAP 12.1.0.162
• For base version 12.0: Windows S-TAP 12.0.0.293
• For base version 11.5: Windows S-TAP 11.5.0.437

If you are preparing to deploy any of these Windows S-TAP agents, you are advised to wait until the following new versions of the Windows S-TAP agents with the remediation are released by the IBM Guardium team on the Fix Central website.

• For base version 12.1: Windows S-TAP 12.1.23.230 (see release note)
• For base version 12.0: Update in process
• For base version 11.5: Windows S-TAP 11.5.10.478 (see release note)

If you already deployed one of the affected Windows S-TAP agents, you can apply the following methods to deploy the fixed Windows S-TAP agent when it becomes available.

Method 1: Using Windows S-TAP upgrade

1. Log in to the database server where the S-TAP agent is installed.
2. Stop and set to disabled all Guardium services except the Guardium Installation Manager (GIM).
3. Restart all SQL Server instances on the database server.
4. Upgrade the Windows S-TAP agent to the fixed version by using the GUI installer. Or, if you are using GIM for the upgrade, perform the upgrade and set the S-TAP parameter WINSTAP_ENABLED=1 all in one step.

Method 2: Using Windows S-TAP fresh installation

1. Log in to the database server where the S-TAP agent is installed.
2. Stop and set to disabled all Guardium services except the GIM.
3. Reboot the database server.
4. Uninstall the affected Windows S-TAP agent versions (12.1.0.162 , 12.0.0.293, or 11.5.0.437).
5. Reboot the database server.
6. Perform a fresh install of the fixed Windows S-TAP agent version.

Method 3: For a large collection of servers

1. Log in to the collector.
2. Navigate to the GIM "Set up by client" page.
3. Select the S-TAP clients and update the parameter WINSTAP_ENABLED=0 from the GIM GUI. This parameter disables all Windows S-TAP agents and related services; even after a reboot, the services remain disabled.
4. Reboot the database server remotely from the server management tool.
5. Use GIM to upgrade the database server to the fixed Windows S-TAP agent version. Be sure to set the parameter WINSTAP_ENABLED=1 as part of this upgrade step.