IT34302: REGISTERING OR UPGRADING VADP HOST STOPS WITH MESSAGE "FAILED TO EXECUTE REMOTE ACTION ON VADP PROXY"

APAR status

• Closed as program error.

Error description

• In the IBM Spectrum Protect Plus GUI, attempting to register a
  new
  host for the VADP or upgrading an existing one will stop
  with a
  pop-up message containing the information :
  
   "id":
  "RemoteInstallerException",
  "description": "Failed to execute
  remote action on VADP proxy.
   Ensure that the VADP proxy is
  reachable and meets
   the installation criteria (such as
  properly
   configured ports and environment).
   See logs for more
  information.",
   "title": "Remote Action Failed"
  
  In the virgo
  log, the following type of messages will be seen
  :
  
  [<timestamp>] INFO .. Executing command on remote VADP
  proxy
   [input = {"input":{"command":"install.sh",
  
  "argument":"<vADPHostIP> <vADPHostFQDN>",
  
  "uniqueID":"xxxxxxxx"}},
   target=[host
  address=<vADPHostFQDN>]]...
  ...
  [<timestamp>] ERROR .. Failed
  to retrieve data from VADP
   (URL:
  https://<vADPHostIP>:8098/ping):
   org.springframework.web.client
  .HttpClientErrorException
  ...
  [<timestamp>] INFO .. File
  download failed on host(<vADPHostFQDN>).
   Error({})
  com.jcraft.jsch.SftpException:
   No such file
  [<timestamp>] INFO
  .. diag.tar.gz excluded from log collect. e=2:
   No
  suchfile
  ...
  [<timestamp>] INFO .. File download failed on
  host(<vADPHostFQDN>).
   Error({})
  com.jcraft.jsch.SftpException:
   Permission denied
  [<timestamp>]
  ERROR .. com.catalogic.ecx.vadp.common.error.
  
  RemoteInstallerException: Failed to retrieve
   output.json from
  <vADPHostFQDN>. e=3:
   Permission denied
   at ...
  Caused by:
  com.syncsort.dp.xsb.commons.XSBException: Failed to
   retrieve
  output.json from <vADPHostFQDN>. e=3:
   Permission denied
   at
  ...
  [<timestamp>] ERROR http-nio-8082-exec-9
  c.s.dp.xsb.api.commons.
   exception.ExceptionMessageTranslator
  
  com.catalogic.ecx.vadp.common.error.
   RemoteInstallerException:
  Failed to execute
   remote action on VADP proxy. Ensure that
  the
   VADP proxy is reachable and meets the
   installation
  criteria (such as properly
   configured ports and environment).
  See logs for
   more information.
  
  So the informational pop-up
  message about failing to execute a
  remote action on the VADP
  proxy is actually caused by a permission
  error, in this case
  here due to the umask values being set to 0077
  on the VADP
  host.
  
  IBM Spectrum Protect Plus Versions Affected:
  IBM
  Spectrum Protect Plus 10.1.x
  
  Initial Impact:
  Medium
  
  Additional Keywords: SPP, SPPLUS, TS004124307, umask,
  permission
  

Local fix

• Set the umask values for the VADP user and root user to 0022
  just
  to allow the vADP install/registration.
  It then can be set
  back to the original values for normal operations.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.5 and 10.1.6.           *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is       *
  * currently projected to be fixed in IBM Spectrum Protect Plus *
  * level 10.1.7. Note that this is subject to change at the     *
  * discretion of IBM.                                           *
  ****************************************************************
  

Problem conclusion

• The VADP proxy installer contains some scripts that run with
  elevated privileges using sudo. Temporary files generated by
  these elevated scripts are later read by other less privileged
  processes. Depending on the default umask of the system, output
  files generated by the elevated process may not be readable by
  other processes which leads to failure. The problem has been
  resolved by temporarily overriding the umask for the scope of
  the proxy installer process so that files created by it remain
  readable. The temporary files are then cleaned up as soon as the
  installation process ends.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels