Guardium Windows S-TAP 12.1.0.195, 12.0.1.295, and 11.5.1.437 might cause Microsoft SQL Server instability when using Kerberos authentication.

Content

Issue description

Due to recent changes, customers who deployed Guardium Windows S-TAP 12.1.0.195, 12.0.1.295, or 11.5.1.437 might experience server instability. This event is triggered when you use very short Kerberos connections. It is a timing issue due to certain Kerberos events.

Remediation

IBM removed the following affected Windows S-TAP agents from the IBM Support Fix Central website:

• For base version 12.1: Windows S-TAP 12.1.0.195
• For base version 12.0: Windows S-TAP 12.0.1.295
• For base version 11.5: Windows S-TAP 11.5.1.437

If you are preparing to deploy any of these Windows S-TAP agents, you are advised to wait until the following new versions of the Windows S-TAP agents with the remediation are released by the IBM Guardium team on the Fix Central website: 

• For base version 12.1: Windows S-TAP 12.1.23.230 (see release note)
• For base version 12.0: Update in process
• For base version 11.5: Windows S-TAP 11.5.10.478 (see release note)

This alert will be updated when the new versions of the Windows S-TAP agents are available on the Fix Central website.  

If you already deployed one of the affected Windows S-TAP agents, you can apply one of the following methods to deploy the fixed Windows S-TAP agent when it becomes available.

Method 1: Using Windows S-TAP upgrade

1. Log in to the database server where the S-TAP agent is installed.
2. Stop all database instances.
3. Use the GUI installer or Guardium Installation Manager (GIM) to upgrade the Windows S-TAP agent to the new version with the remediation.
4. Reboot your database server immediately after you upgrade the Windows S-TAP agent.
5. Start your database instances.

Method 2: For a large collection of servers

1. Log in to the collector.
2. Navigate to the GIM "Set up by client" page.
3. Stop all database instances.
4. Select the S-TAP clients and upgrade the database server to the fixed Windows S-TAP version.
5. Reboot your database server immediately after you upgrade the Windows S-TAP agent.
6. Start your database instances.