2004-05

Attempts to install ITIM 4.5.1, and configuration issues at a major Utility.

12/18/04 PMR 06615-122 – Error dll in use while upgrading to Websphere 5.0 fp2

12/19/04 PMR 06745-122 – Cannot find jar file (fix) when installing fix using Update Installer

12/19 PMR 06786-122 – No installable fixpacks that can be applied to the currently selected product

12/19/04 PMR 06813-122 – Please input an existing DN – Fon Kwok – set up ref integ per doc
– 12/22 set up ref integ, and doc is junk – forward slashes???
– 12/30 yes, forward slashes on both of those paths.  now getting rolledbackException, sent logs    – 1/2 tried reinstalling 3x, same error, now getting failed to create MQ queue manager
– 1/5 check on amq6119 (pmr 08801)
– 1/7     -check systemout.log for queue mgr
* during fixpack2 – check embedded msging box to upgrade that too
* check queue mgr & broker start successfully
* Dave Titzler
– closed when reinstall started mqm ok
– reopen to yell about service installed w/ no exe
**

12/30 PMR 08100-122 – (WAS queue) CSITransactionRolledBackException when trying to reset the ITIM mgr password
– In log, NoClassDefFoundError: com/ibm/ws/spi/txhelper/TransactionHelperFactory
– ITIM probably got confused between WAS and WAS express and installed pointers to Express – uninstall and reinstall WAS and ITIM

01/02/05 PMR 08370-122 – Port 8880 conflict on Websphere    Anita, Sherry – reinstall (worked)

01/05 PMR 08680-122 – ITDS install error – fatal DB2

01/05 PMR 08801-122 – Trying to create MQ queue manager, and getting amq6119, etc
– Lev 1: run collector and transferred to lev 2
– Lev 2: called after 2 hours and needed to research – 3 more hours later, try setting 2 log settings
– 1/6 waited for callback 10:30-2:10 (3:40)
– 1/6 – need to be at mq 5.30 w/ csd 4
– 1/7 – Matt Davis
– 1/7 – Dave closed – dup01/07 PMR 09133-122 – bipservice.exe – Dave closed – dup

01/08 PMR 09462-122 – Tim DeCoursey – noclassDefFound

01/30 PMR 18631-122 – Websphere service did not install    – Nasar – reinstall, he will call back

02/02 PMR 18923-122 – ITDS user ID or password is invalid    Tom – AD domain, moved to res & worked

02/12 PMR 26148-122 – java.io.NotSerializableException: com.sun.jndi.ldap.LdapCtx is not serializable
– also, Agent Profile installations give errors: LDAP: error code 16 – No Such Attribute]; remaining name ‘erobjectprofilename=NT40Profile,ou=serviceProfile,ou=itim,ou=Tivoli, dc=com’
–  Rick Schlosser – try deleting databases and recreate create in db and separate ldap db    – make sure that you run ldapcfg on suffix.ldif to add the suffix object to the ldap db

02/19 PMR 27531-122 – How do you get to 50 canned challenge reponse questions.    – Gary Larson   – there are none

02/23 PMR 27961-122 – Error 2 when trying to remove evt notif context – unable to remove it
Error 1810 when trying to generate private key pair and cert request: Error gen PKCS10 request
Error “java.lang.NullPointerException” when testing Novell agent service
Error “Connection refused: connect” when testing NT agent service    Noel – Grey Thrasher in Irvine has latest doc for AD pwd sync, Fernando – NovAgntFernando: ** Don’t set up evt notif until test user add, modify, suspend, delete, recon **erservicename=novellservice,o=Test,o=test,dc=comreg hklm/software/agent360/novellagent1. load new profile from 4.52. remove old profile (will tell you in slapd.err what object is problem –  remove it)

03/03 PMR 29922-122 – Can you expire the ITIM password after 90 days
– yes, config, properties
– How do you get a certificate for the NT and Netware agents?
– ** How do you change the console timeout?
– Charles will send files to change.
– ** How do you change the default username format?        Charles will send sample
– Testing RACF: ERMA connection Create operation failed: Protocol specific error: 20, ‘INTERNET_OPEN_ERROR’.
– ftp doesn’t work, daml version coming out 3/4, new erma libraries coming out in a week
– Charles will send when available    – NT: Connection reset by peer:  socket closed
– httpS: required

03/?  PMR 31625,122 CORBA BAD_PARAM JNDILDAP.LdapCtx is not serializable
Recommended to reinstall ITIM, Websphere.

03/15 PMR -122 – Tenant not found – Marie: ldap config thing

03/16 PMR 32249-122 – Access denied when creating an NT account
Fix:  change the service to logon as the Domain Admin account

03/16 PMR 32258,122 – When trying to reset pwd as a user, NT service is not listed as an option.
Valentina Sessa, Italy – add Account ACI under My Org and grant password attribute perm    Fon Kwok – NT pwd should reset when pwd sync is enabled    Bruce Larson 3/23

03/17 PMR 32457,122 – Cannot create Novell account
FB- prov policy, entitle, advanced, add container name      – upgrade to 1013 – how?
– 1013 version produced “unable to save 219 bytes to server” on recon

03/18 PMR 32575,122 – bring up racfssl – BPXP005I A FORK OR SPAWN ERROR WAS  ENCOUNTERED. RETURN CODE 00000070 REASON CODE 0BFC0434        – Gary – use racf ssl agent 4.5.2

03/23 PMR 33471,122 – Attempting a recon w/ RACF SSL – “racfSearch: Unable to create APPC transaction”    – Bill Palmer, John Young

03/?  PMR 33523,122 Warning during DSML feed.                Recommended to review ITIM trace.

03/?  PMR 34115,122 How to link NT Account to LDAP User                Recommendation was to add alias attributes to dsml feed.

03/31 PMR 40005,122 – 2 NT IDs didn’t show up in orphan accounts    – Charles
03/31 PMR 40041,122 – Hanging when deleting mq queue manager
– fp2 does not update csd if install fails once, have to uninstall was completely

4/1   PMR 40212,122 – RACF – password max 8 char on racf
– FR? – how to unlock accounts – need to restore acct- Gary Larson
– what rights it needs – pg 26, step 5.5 of RACF SSL install guide
–
4/1   PMR 40232,122    – feature request: ability to reset racf w/ lan or w/o

4/2   PMR 40397,122 – With RACF linked account, Passwords are not sync’d (Russ’ and dhanson1 accts)        Rick Schloss

4/5   PMR 40776,122 – Password requirements/conform error is always the same (Password does not contain required minimum digit characters)
Noel Lewis – message is unique to that case, but I said it should be more clear
– became enhancement request MR0414044252

4/5   PMR 34697,122 – Request product developer to resolve design defect issues:     In the latest LDIF export there are 870 “erisdeleted: Y” records.  We ran the command     e:\itim45\bin\win\ldapclean.cmd
to clean up these records, but zero entries are deleted for this tenant.       The response message to the ldapclean.cmd points to Recycle Bin DN: ou=recycleBin,ou=tim,ou=test.       This is not critical day one, but over time the LDIF will be filled with garbage.  The LDIF shows there are approximately 23000 orphans and 18000 accounts.  Field “erAliases” has been added to the dsml records.  Service recons are hanging.   There has been some associations between services and people records, but far fewer then expected.   Recons are hanging and this may be the cause of the large number of orphans.  Recons should continue to run when an error is not fatal, or the program should abort when the error is fatal.
RACF Accounts          4,000
RACF Orphans          18,000
NT Accounts            7, 814
NT Orphans             2,273
NV Accounts        6,708
NV Orphans        2,105
Service recons can modify  data on the server.   Is this true?  We are not sure if this is true, and need to be certain that the end-user data on the server is not changed by doing a recon.  It is essential that the ITIM product not modify data on the NT, NV, and RACF server when doing a recon. Recons are running in excess of 12 hours.  This is slow and sequential.  Twelve minutes would be more acceptable using some hashing algorithms.

By design adoptions can only take place when service recons are done.  Adoptions should take place
with the DSML recon as well by having the existing orphan record population examined.

Filtered recons to test a single adoption take almost as long as a full recon because all the server
service entries are loaded into ITIM each time a recon is done.  (You mentioned this will be redesigned
with ITIM 4.6) .

4/5   PMR 40832,122 – Cannot unlock NT accounts – Gary – change the registry hklm/sft/acc360/nt/unlockOnChgPwd=TRUE

4/5   PMR 40953,122 – Cannot add console servers to manage under ITDS console

4/7   PMR 41353,122 – Netware 1013 agent giving obj class viol’s on NetwHomeDirServer during recon
****  Performance:  agentcfg & itim45/data/enrolelogging.prop & ibmslapd.conf (syslog) – log file location
edit plus – charles’ editor
– In itim.log getting “Corba.no_memory:unable to write value” error
– FIX: WAS console – servers, app servers, server1, proces def, max heap size: 512 or increase, apply, save to master config (at the top), save, restart was
** ADD to BUILD **

4/13  PMR 42494,122 – NullPointerException – ITIM not working but shows started in WAS console
– http server was stopped for some reason, started, worked

4/?   PMR 42996,122 Is there a best way to do a mass delete of people records.
Recommended to delete from MI. ldap browser
and  then run a small import load from Dan’s prior work

4/22  PMR 44180,122 Schema Violation Exception during Netware RECON
Gary Larson
4/26 opened crit-sit, Jane Harris is contact
4/27 India tried to repro w/ 48 char group name and no problems
4/28 sent full logs
4/30 Irvine posted the logs to devtrack
5/03 Shashank is dev that is working this, GL will set up conf call w/ me and India for tomorrow
– closed when APAR was closed that resolved 100 object class viols
– still have viols but only 12 so they want a new PMR opened
– APAR/devtrack# IY56076/dt# s12843

4/24  PMR 44649,122 – If a completed req shows warning or failed, no more detail on # of warnings is available

4/27  PMR 55141,122 – When submitting prov policies, received blank screen and when refresh, multiple errors
– Fon Kwok: e-mailed recommendations on 4/28 – increase appl_heap_size and possible script errors in our workflow

4/28  PMR 55425,122 – While tuning ccc2kitim1, I found the LDAP db and the ITIM db are both named ITIMDB.  Now what?  Must we
rebuild, or can we survive as is?  — Charles says we should keep itimdb & ldapdb separate.  Can retrofit.
Got instructions to do so.

4/29  PMR 55593,122 Gail Gladney – IDS tables in ITIMDB instead of LDAPDB – what are table names, how can we separate?
update — why do we have 2 db systems, one in caps, one in lower?  There are db instances called itim,
itimdb,    and db2admin; databases named itim, itimdb, and test1 — where did these come from?
*- Kevin Gehrlein-* on callback; sent note w/DB2, IDS, & ITIM interplay questions; he will take to his DB2             resource
4:30 — escalated ticket
Fix: set db2instance=db2admin then connect to ldapdb

4/28  PMR 55737,122 Gary Larson – Novell RECON hands with a PDU 3000 limit message
“PDU has reached released entry limit of 3001, limit is current set to 3000”
Gary indicated it would continue after a period of time

4/29  PMR 55924,122 Rick Schlosser –  Clarification of RACF attribute erracupassdate
Recommended to filter out disabled accounts (erAccountStatus=0)
to remove disabled account records.
Received 5/5 closing 55924,122
…    I’m afraid I gave you some bumb information – I told             you to do a filtered recon thinking that since the RACF agent is now
DAML instead of ftp that filtering would work just like the other DAML-based             agents – unfortunately, I noticed in the release.txt file for the agent
that filterered recons are not supported – yet.

5/3   PMR 56399,122 – RACF agent cert install gives error (dat file missing)
– GL get exact error & make sure that he’s running certtool w/ switches & make sure rwe perms are on the         file

5/3   PMR 56405,122 – Refreshing with an existing pending request returns zero pending, then 1, then 0, etc
– Gary Larson: set webclient to debug in enrolelogging.properties, recreate, and send itim.log(S)
– 5/11 have not been able to recreate, asked Gary to close – dh

5/4   PMR 56529,122 – Dup Accounts on RACF East (use Nancy Jones Racf East Inactive as example)
– Fon Kwok – send him logs

5/4   PMR 56673,122 – How to set up security in DB2 for multiple domain user IDs
David Guliano –    x3606
db2 set db2_grp_lookup=domain
db2 get dbm cfg
db2 update dbm cfg sysadm_group <group>
change account that services is using
– did not work, asked for callback 5/10 – did not receive
– 5/11 escalated and raised severity
– 5/12 did a trace – IDs with IBM in the name do not work

5/5   PMR 56882,122 – How to set up ACI to browse all accounts & people
Charles:
Add ACIs for all these Object types: All classes of accounts, Identity Manager User, Location, Organizational Unit, Person

5/5   PMR 56920,122 – corba errors on login – bad param 0x4f4d0006 java.io.NotSerializableException: com.sun.jndi.ldap.LdapCtx is not serializable
– Charles:  disable check policy to speed up recons
Check db2cli.log in ldap/var –> buffer pool too small
FIX:  set bufferpools to 4096 and 48000 -dh

5/7   PMR 57180,122 – sev1 RACF recons are failing – started task is crashing – <Message Id=”The element type “SearchResponse” must be terminated by the matching end-tag “</SearchResponse>”.: null”></Message>
Cynthia  what os agent is on and what
Noel Lewis , ,  – send racf agent log, itim log & screenshot of error
Last (& last successful) recon on 4/21
-5/14 set up 2 server config, 5/15 still failing
-5/21 try allocating 1Gb to RACF – 5/23 still failing
-5/24 asked for callback
– Casey Peel & Scott Pierce – ITIM tuning experts
-6/4 tried Fernando’s () suggestions to try scoped recon and get surrogate error
Fern cell
-6/9 Fern found a problem with brackets on one account, ZIO57 – changed that and got warning instead of failures, # signs in group names causing warning -> they will make it an APAR
– 6/17 APAR/devtrack# IY57993/dt# s13035 – “racf translation code pages not translating correctly”
– scheduled for next release of RACF agent – due in mid August

5/10  PMR 57579,122 – NT recons are dropping accounts.
Steve Runyon  –  email to
– 5/11 – ftp’d logs to service2.boulder.ibm.com and e-mailed Steve, idmgr, and Brian M. -dh
– 6/3 – Steve checking with Fernandon
– 6/15 – John Pontius  called to help troubleshoot
– spent weeks at Kmart w/ ITIM 1.2 in 2001 – with – Daniel Crum, Andy Rucker – other dev
– has worked a lot with tuning
– we only need 5-10 OChandlers for LDAP
– 6/17 sent them new logs for user & harped on the lack of retransmit wait states in the code. – DH
– I did some more checking and ran network traces and found that itim2 was having trouble talking to itim1.  Changed the agent to run on itim2 for user and got 954 more NT accounts – fixed!
– asked for APAR – need to handle transmits
– 2nd APAR – should report “failed” if recon stops at “S” or “T” rather finish
– Rick Schlosser

5/11  PMR 57870,122 – bufferpool error in logs (IDS), within TIM — “no pages currently available in bufferpool ‘2’” -rjb
Thomas – sent error log, tuning doc, db2diag.log
5/12 3:30 – status update – rjb
5/12 4:20 – Thomas Aaron/Austin (IDS team) sees no prob with IDS – re-routes ticket to ITIM queue

5/25  PMR 65644,122 – WAS crashing – Dr. Watsons
Fon – set APP_CTL_HEAP_SZ value on the itim db (default 128) to 1024
** incorporate this into build **

5/26  PMR 67027,122 – RACF recons don’t abort
– Changed to FITS MR0608041221

5/31  PMR 67028,122 – Stopping WAS service – get error service is not responding to control function even though java.exe stops

6/01  PMR 66831,122 – Netware accounts missing after running recons – not orphans or accounts
– Fon Kwok – Fern said try new ldap and new profile, but got original obj class violations
–  # signs in the groups causing problems – APAR IY58402

6/8   PMR 67924,122 – HTTPS setup – getting port 443 thru, but not https
– 6/16, escalated to sev 1: can’t get http://password/enrole to respond
– 6/16, based on redbooks research, I found the solution and closed ticket before callback – rjb

6/09  PMR 68263,122 – Invalid Http Request Target when selecting Administrators under Configuration
Charles –
– Caused by an itim account that is an administrator where the people record (owner) did not exist
– deleted systemuser record (itim account) from ldap, and tested good

6/16  PMR 69482,122 – 1300 RACF East accounts missing
Charles –  – sent logs
6/18 – ran recon with just 7 of the missing accounts in a dataset that Russ created, and all 7 came into LDAP.  ran another full recon and all but 2 or 3 accounts are in there now

6/22  PMR 70552,122 – send to Jane – sev1 – RACF accounts do not unlock when password is reset
Fon – not supported, can make FITS – became FITS # MR0722046856

6/25  PMR 71122,122 – When pwds are reset, they are sent in clear text over e-mail.
– combine e-mails into one for multiple resets and inhibit pwd in e-mail
– Rich Schlosser  – set notifyPassword=false in enrole.properties

6/25- PMR 71177,122 \Ran recon on Novell RECON, the account dropped from 13K to 1K records.   12K have been lost.

Interim Fix 14 – released May 14

….    Hi Phil – got your PMR 71177,122,000  – from the description it sounds like there was some sort of failure in the agent recon that caused only a portion of the total number of accounts to be returned – ITIM, of course, thinks those accounts were deleted from the managed platform and in turns deletes them from ITIM – check the agent log for any errors
…    Is there an apar for this/
…    ?
…    No – various conditions that seem legit to the agent can cause this sort of thing – for example, someone changing the security authority of the agent account such that it now can no longer access all the users – only a subset – not apar-able
…    I didn’t know recons removed accounts
…    Do recons remove accounts?
…    hold on
…    the purpose of a recon is to have itim mirror the managed platform – if attributes change on the managed platform the attributes will change in itim (and policies will be optionally checked and enforced).  If an account exists on ITIM today and tomorrow a recon is run and that account no longer exists, itim will reflect the reality of the managed platform and delete the account from itim.
…    We had 13K accounts, and now have only 1K.
…    and?
…    12K accounts should not have been deleted.
…    unless 12k accounts were not returned in the recon
…    that’s why you need to look at the agent log
…    Why would the recon end with a warning?  I was told this was OK?
…    Why would the recon make any change if the download was not successful?
…    I don’t know Phil – if we knew what was going on in the agent log we might be able to piece it together
…    If I tar up the NetwareAgent.logs, can you look at them with me.
…    sure
…    It is 218 MB, where do I send it?
…    218mb tar’d?
…    yes, I’ll try a compress
…    try feathering too
…    got it
…    It is down to 25 MB
…    Where do i send it?
…    hold on
…    ftp testcase.boulder.ibm.com
User (testcase.boulder.ibm.com:(none)): anonymous
Password: your email address
ftp> cd software
ftp> cd toibm
ftp> cd tivoli_support
ftp> bin
ftp> put yourfilename
…    it has been sent
…    I’ve found 22,000+  NDS Error 34841  Attribute value retrieval failure in SearchConnection
…    Check with your NDS admin or systems person on what that error means …
…    or Google it
…    It is not acceptable that 12k account records were removed from ITIM.
…    that’s fine – and I agree – but first line of defense will need to be fixing your 22000+ errors
…    How?
…    what does error 34841 mean?  Whatever it’s saying needs to be fixed …. that’s why you should talk to your NDS admin or systems person
…    OK, but I need an APAR open’ed.  If I am in production this becomes a fatal flaw.   If a download is unsuccessful, or some error occurs the product should make no changes.   The recon must be broken into multiple steps, first download, and then build…  This must be known by the ITIM by now.
…    agreed
…    you may not get the rapid response you want, though, once it gets to apar-land – unless someone takes a strong advocacy role with the powers that be
…    OK, I really want an APAR.  This has happened to us at  before.   I’m sure it will happen again.  It only affects me this weekend, but it will affect the entire IBM  account once it moves into production.   I am a very bad negotiator, but I feel very strongly that this part of the product is broke.  Can I have an apar number?
….    I don’t assign apar numbers – I write up the bug information in the pmr and requeue it for someone to actually assign the apar – so use the PMR number for now
…    I want an APAR, please pass me to someone who writes APARS
…    you’re 4.5.1 with what level of fix?
…    os for server?
…    was/db2?
…    I’m 4.5.1 on Win2000
…    fix level?
…    sp 4
…    on itim, not w2k
…    Build 5147
…    that’s the base – any interim fixes on top of that?
…    I’ve written up your PMR and pushed it to the queue that will drive the creation of an apar.  The person who ordinarily does this just departed (minutes ago) for a three-week vacation – her standins will take care of this – probably not today but certainly early next week.  If you want immediate action, call Dan Barto at  or Peter Wolf at .  Tell them your PMR number (71177,122,000)  and that you require an immediate apar to be issued.
…    No Rick.  No call is needed.  I just didn’t want this issue to slip through the cracks.    I will update the local management team, and restart on Monday.  Thanks for helping me.

Hello,

Your PMR# 71177,122,000  has had a defect logged in the APAR/devtrack system.  Your APAR/devtrack# IY58359/dt# 13128  has been forward to Level 3 group for research.  I will let alert you of any updates as Level 3 progress.

Thanks
meghan

Meghan Ritschel

6/28/05 PMR 50143,122  Created for DAML_SSL data transfer error during ITIM Netware Recon.   Number of Netware accounts is 7661.

7/15  PMR 74793,122 – After applying if09, logins hang, sev1
Gary Larson  – send itim.log w/ 4 debug options set
LDAP was down – DB2 db was not starting due to error SQL1042C – reboot fixed

7/16  PMR 80147,122 – After applying if09,14, cannot reset passwords, sev1, CLI0610E Invalid column number SQLSTATE=S1002
Ivan Watkins –   Apply fixpack 16, worked

7/20  PMR 80859,122 – How to reset Netware passwords to not force 2nd change upon logon
Fon Kwok – dev could not recreate, so I recreated & sent him detailed steps
– became APAR/devtrack# IY59507/dt# s13203

7/22  PMR 81234,122 – Cannot delete ITIM accounts, Account is not a DirectoryObjectEntity
Gary Larson – send itim log, properties files, systemout & err

7/23  PMR 81474,122 – User IDs with # signs cannot register.
ITIM accounts are not created due to ldap error 34: invalid DN syntax
-was already opened as an apar – IY58402 – no ETA
7/26 – Need update asap on how to rollback to 4.5.1 base.  Cannot uninstall fp’s
Ivan Watkins

7/23  PMR 81476,122 – Get strange error when resetting users’ own passwords: com.ibm.itim.webclient.organization.account.ChangePasswordServlet.PASSWORD_CHANGE_RESULT
Barry Evans ,  cell

7/26  PMR 81851,122 – How to set expiration on temp password during registration
Noel Lewis – need to know how the 24 hour setting in Properties is used. (isn’t working for our register.jsp
7/26  PMR 82152,122 – How to rollback to 4.5.1 base
– install 4.5.1.001, say ‘yes’ to upgrade, then redo post build steps

7/27  PMR 82255,122 – sev1 Users unable to reset their own passwords on NT, Novell, RACF since application of FP16
Barry Evans – closed when rolled back to base 4.5.1

7/28/05   82565,122 – Getting JNDI_operation_error when opening Configuration, Entity types, Account, changepassword.  ITIM.log shows LDAP error code 32 – No such object; remaining name ‘ou=category,ou=itim,’

8/4   PMR 83867,122 – Cannot create accounts on agent platforms on itim3

8/10  PMR 85246,122 – XML parser errors in systemout.log on itim3
– update – J2CA0125W error, error parsing XML document at WAS/properties/j2c.properties – which has a May timestamp

8/11  PMR 85542,122 – WAS 5.0.2, CF3 error on itim1 – install of CF3
failed on webui
– Phil found issue with JAVA_HOME and WAS_HOME in setupcmdline.bat file – had been set with double quotes, but found issue with space in ..Program Files/WebSphere…, so changed it to Progra~1; but then had problem with dbl quotes; removing dbl quotes solved problem
– closed 8/13

7/19/2005    PMR 82335,122 – Setting up recon to Active Directory agent.  What is the permissions /auth level required for related userid.
– Clyde Zoch  replied passwordAdmins_Energy should work, but no guarantees since “none of this is documented anywhere”
– Domain Admins is their recommendation
– Closed 7/19

7/19/2005    PMR 82338,122 – recommended ITIM, DB2, WAS, LDAP product levels
– all components supported through 8/06
– closed 7/19

7/19/2005    PMR 82414,122 – is it possible to run Reconciliations based upon previous reconciliations

7/19/2005   PMR 82427,122 – DH – Why ACI for help desk isn’t allowing read/search of person records and password resets
– Checked Org Tree Special Access under Group Detail for the group, and it worked on 1st test, but spotty success after subsequent tests
– Fon Kwok: check accesscontrollist.refreshInterval=5 in enrole.properties and turn on logging for authentication=debug