IT36025: DB2 BACKUP CAN FAIL WITH PERMISSION DENIED ON DB2ACS*.CFG FILES

APAR status

• Closed as program error.

Error description

• DB2 backup operation with IBM Spectrum Protect Plus can fail
  with permission denied on db2acs*.cfg files if DB2 instance
  user does not use default 022 umask setting. The job log shows:
  
  
  ERROR,1611095738659,<date+time+timezone>,2,,[db2-ip-address]
  PermissionError: [Errno 13] Permission denied: '/mnt/spp/vsnap/v
  pool1/fs1/100_10_20_1/TESTDB/db2backuprepo/db2acs.TESTDB.0.inst1
  .20210209003518.cfg'
  ERROR,1611095738659,<date+time+timezone>,2,
  ,[db2-ip-address] Failed to run backup for db2 agent
  
  There is
  more strict umask value for the DB2 instance owner like 077, so
  the SPP agent user cannot read or write to d2acs*.cfg having
  600 permission.
  
  Versions affected: 10.1.*
  

Local fix

• Add "umask = 022" for DB2 instance owner to /etc/security/user
  file and restart DB2
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users of IBM Spectrum Protect Plus version 10.1.6 and 10.1.7 *
  * for DB2 Databases performing backup operations when DB2      *
  * instance user has default umask value that creates files     *
  * with read permissions to user only.                          *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in the next IBM Spectrum Protect Plus  *
  * level 10.1.7 ifix2 and 10.1.8. Note that this is subject to  *
  * change at the discretion of IBM.                             *
  ****************************************************************
  

Problem conclusion

• IBM Spectrum Protect Plus is fixed to perform backup in case
  when DB2 instace user has different umask values for file
  creation.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels