IT42081: RESTORE OF FILE SYSTEMS FAILS WITH "SERVICE 'ISPPFSPAFR' REQUIRED FOR RESTORE OPERATION COULD NOT BE STARTED"

APAR status

• Closed as program error.

Error description

• Starting IBM Spectrum Protect Plus version 10.1.6, Microsoft
  Windows New Technology File System (NTFS) and Resilient File
  System (ReFS) protection is available.
  When the Windows IBM Spectrum Protect Plus agent SSL certificate
  used to ensure HTTPS communication with the ISPPFSPAfR
  (IBM Spectrum Protect Plus File System Protection Agent for
  Restore) is invalid for any reason, the job log will display the
  following messages :
  
  SUMMARY,<timestamp>,,CTGGA2398,Starting job for policy
                                 onDemandRestore_<restoreID>
                                 (ID:<SLAID>). id -> <JobID>. IBM
                                 Spectrum Protect Plus version
                                 10.1.10-2709.
  ...
  DETAIL,<timestamp>,1,CTGGL0055,Recovery policy options:
                  {sourceType= Windows
               selectedSource=[<ProtectedHost>]
               sourceSnapshot=[<ProtectedHost> -
                               <RestorePointTimestamp>]
      autocleanupOnJobFailure=true
       continueScriptsOnError=false}
  ...
    ERROR,<timestamp>,2,CTGGT0150,[<TargetHostIP>] Service
                                  'ISPPFSPAfR' required
                                  for restore operation could not
                                  be started.
     INFO,<timestamp>,2,CTGGA3150,[<TargetHostIP>] [<timestamp>]
                                  Ending restore
                                  command.
    ERROR,<timestamp>,2,CTGGA2599,[<TargetHostIP>] Failed to
                                  restore file systems
                                  (<ProtectedHost>) on server
                                  (<TargetHostIP>)
                                  (File system restore aborted).
    ERROR,<timestamp>,2,CTGGA2597,Failed to restore file systems
                                  (<ProtectedHost>)
  
  In the restoreService.log file found in the job log bundle, a
  SSL error will be displayed :
  
  <timestamp> INFO   [xxx MainProcess] [yyyy MainThread]
                     [main.py SvcDoRun:78]
                     Entering Service Start
  <timestamp> ERROR  [xxx MainProcess] [yyyy MainThread]
                     [service_core.py service_main:242] [SSL] PEM
                     lib (_ssl.c:4044)
  Traceback (most recent call last):
    File "C:\PROGRA~1\IBM\IBM Spectrum Protect Plus\tools\file\
          restoreService\service_core.py", line 144, in
          service_main
      ssl_ctx.load_cert_chain(cer, key)
  ssl.SSLError: [SSL] PEM lib (_ssl.c:4044)
  
  Reinstalling the agent does not generate a new valid SSL
  certificate.
  
  IBM Spectrum Protect Plus Versions Affected:
  IBM Spectrum Protect Plus 10.1.6 and later
  
  Additional Keywords: SPP, SPPLUS, TS010384105
  

Local fix

• 1. Delete the SSL certificate.
     The cert files can be found under %LOCALAPPDATA%\FSPA folder
     which usually defaults to
     C:\Users\Administrator\AppData\Local\FSPA.
     Locate the certificate files in that location :
     - localfspagent.crt
     - localfspagent.key
     and delete these.
  2. Upon the next file indexing or restore attempt, these files
     will automatically be recreated.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.6 - 10.1.13             *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is       *
  * currently projected to be fixed in IBM Spectrum Protect Plus *
  * level 10.1.14. Note that this is subject to change at the    *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• If the Restore Service 'ISPPFSPAfR' fails to start due to
  invalid certificate in %LOCALAPPDATA%\FSPA, a new self-signed
  certificate will be created by the service. Using the new
  certificate the service will continue the operation.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• Apps     FileSys
  

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels