Fixes are available
APAR status
Closed as program error.
Error description
When node replication is configured and the dsmc -forcefailover=yes command is issue to intentionally connect to the replication server, it can fail with ANS5216E error. For example, if the secondary server's hostname is "tsmserver1" and REPLTCPPORT is set to 21500, the following message sequence can be observed on the client: ANS2107I Attempting to connect to secondary server tsmserver1; at tsmserver1; : 21500; ANS5216E Could not establish a TCP/IP connection with address 'tsmserver1:1500'. The TCP/IP error is 'No connection could be established No connection could be made because the target machine actively refused it' (errno = 10061). A Client SERVICE trace will show the following: 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1329): optReplServerCallback: Processing OPT_REPLSERVERNAME 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1346): optReplServerCallback: added new replication server to list: TSMSERVER1 2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp (9065): Fail Over TCP Server Name: TSMSERVER1 Address: N/A Port: 1500 SSL Port: 1500 GUID: N/A Used: no 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1285): Entering optReplServerCallback(), source = 1 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1421): optReplServerCallback: Processing OPT_REPLTCPSERVERADDRESS 2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp (9065): Fail Over TCP Server Name: TSMSERVER1 Address: tsmserver1 Port: 1500 SSL Port: 1500 GUID: N/A Used: no 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1285): Entering optReplServerCallback(), source = 1 2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp (1435): optReplServerCallback: Processing OPT_REPLTCPPORT 2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp (9065): Fail Over TCP Server Name: TSMSERVER1 Address: tsmserver1 Port: 21500 SSL Port: 1500 GUID: N/A Used: no ... 2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp (1727): TcpOpen: Trying to connect to server at: 2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp (1728): Domain Name: tsmserver1 2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp (1730): Port #: 1500 2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp (1756): TcpOpen: using blocking sockets 2017/09/15 11:25:00.219 [029922] [4159158080] : pscomtcp.cpp (1224): psTcpConnect(): Attempt socket 7 (IPv4) connection -> rc=-1, errno=111 2017/09/15 11:25:00.219 [029922] [4159158080] : commtcp.cpp (1844): TcpOpen(): connect(): errno = 111. Re-trying connect 1 The symptom observed is that client is attempting to connect to REPLSSLPORT (SSL Port: 1500) instead of REPLTCPPORT (Port: 21500). REPLTCPPORT should be used to connect to a server socket instead of REPLSSLPORT unless SSL option is explicitly set to YES IBM Spectrum Protect Versions Affected: IBM Spectrum Protect client on all platforms Initial Impact: Medium Additional Keywords: Spectrum Protect; TSM; client; replication; REPLTCPPORT; REPLSSLPORT; ANS5216E
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: * * IBM Tivoli Storage Manager backup archive client version 7.1 * * running on all platforms. * * IBM Spectrum Protect backup archive client version 8.1 * * running on all platforms. * **************************************************************** * PROBLEM DESCRIPTION: * * See ERROR DESCRIPTION * **************************************************************** * RECOMMENDATION: * * Apply fixing level when available. This problem is currently * * projected to be fixed in level 8.1.4.1 and 8.1.6. Note that * * this is subject to change at the discretion of IBM. * ****************************************************************
Problem conclusion
Background: backup archive client tried to use SSL port to connect to the server, when establishing secure connection. Spectrum Protect server starting from versions 7.1.8 and 8.1.2 enforces all connections to be secure. The client is expected to use regular TCP port if replication server stanza does not explicitly prescribes SSL port usage with "SSL yes" option. Problem: client tries to connect to the server using SSL port when notices the connection is secured. Fix: the client now uses TCP port to connect to the server unless the replication server stanza contains "SSL yes" option. Backup archive client now uses proper port to connect to replication server.
Temporary fix
Comments
APAR Information
APAR number
IT23216
Reported component name
TSM CLIENT
Reported component ID
5698ISMCL
Reported release
81L
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2017-11-23
Closed date
2018-01-30
Last modified date
2018-03-14
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Modules/Macros
dsmc
Fix information
Fixed component name
TSM CLIENT
Fixed component ID
5698ISMCL
Applicable component levels
R81L PSY
UP
R81A PSY
UP
R81W PSY
UP
R81H PSY
UP
R81S PSY
UP
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSGSG7","label":"Tivoli Storage Manager"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"81L","Line of Business":{"code":"LOB26","label":"Storage"}}]
Document Information
Modified date:
10 January 2022