Manage update access keys with IBM Electronic Service Agent (ESA) on IBM i

Troubleshooting

Problem

IBM® Electronic Service Agent (ESA) on IBM i has introduced a new feature to help clients easily manage the refreshment of their update access keys (UAK) for IBM i stand-alone partitions.
For several IBM POWER8 processor-based server models and higher, the initial UAK is installed during the manufacturing process with an expiration date that corresponds to the server's warranty period.
When the UAK is unexpired, the application of entitled firmware updates is permitted.

Environment

UAK and current active Hardware Warranty or Hardware Maintenance Agreement expires on the same day.

UAK's are issued with the following conditions:

Active Warranty or Hardware Maintenance (HWMA) is required to request a UAK.
Warranty UAK's are issued for the duration of the Warranty.
HWMA UAK's are issued with a (180) day duration, unless HWMA End Date is before, then the UAK expiration matches the HWMA End Date.
A new UAK will not be issued beyond the expiration date of the current active HWMA.
A renewal HWMA with a future start date is not an active agreement, a new HWMA UAK is not available until the contract is active (the Start Date, or after if a contract is signed with a retroactive date).

If your machine will be covered by an HWMA renewal with a future start date, you have two options:

Request the new UAK on the HWMA Start Date
Request an HWMA UAK before the HWMA start date by providing Proof of Purchase.*

If want to request an HWMA UAK prior the start date, need to provide the renewal contract number, or a water marked final copy of the Schedule for Servicelite. If the renewal has been registered with IBM and is "Order Firmed" and, there are no gaps between current UAK expiration date and HWMA Start Date, we will issue you a new HWMA UAK with a (180) day duration from the date of UAK issue.

Diagnosing The Problem

Previously, when the UAK was about to expire, users were required to confirm the UAK expiration date, as well as download and refresh each UAK manually. This new feature allows the user to have the UAK's expiration date checked and the UAK refreshed automatically on IBM i systems by using Electronic Service Agent on IBM i.

Moreover, clients might administer this process manually or automatically on a weekly basis.
The UAK management feature is designed to perform the following tasks:

Check the entitlement date (expiration date) of the UAK weekly.
Download a new UAK if the expiration date is within 30 days.
Apply the new UAK after it is successfully downloaded.

Entitled Systems Support (ESS) website can be used to check HWMA, UAK and to request a new one if needed. Can find it in:

My Entitled Hardware -> Update Access Keys

If a new UAK is not available on ESS, the ESA process to update fails.

Resolving The Problem

This improved UAK management feature can be installed on IBM i 7.2 and 7.3 releases by applying PTF SI58783 (IBM i 7.2) and PTF SI58566 (IBM i 7.3). For higher releases are included in OS base.

For Hardware Management Console (HMC) controlled IBM i partitions, Electronic Service Agent on HMC updates the UAKs. The Electronic Service Agent on IBM i will only handle partitions not managed by any management system such as the Integrated Virtualization Manager (IVM). Also, note that the UAK management feature is applicable for POWER8 (and later) systems with firmware 840 and later versions.

NOTE: If UAK is expired, the only 'problem' is that firmware cannot be updated. There is no impact to production or system's performance.
Technically, the UAK expiration only means that cannot apply firmware created after the expiration. If it expires today, and is not extended, can apply firmware built before today. So, can apply firmware, not firmware that is past the expiration date of the UAK.

To display the expiration date, issue DSPFMWSTS and see the "Update access key expiration date". If UAK date is not shown, can cause the UAK to fail. In order to correct, assure the following PTFs are on system:

V7R3: MF68127 SI72749 SI72750
V7R4: MF68134 SI72691 SI72697

There are two ways of using this UAK management feature:

Manual: A system administrator can manually launch the process of checking UAK's expiration date, downloading UAK, and applying UAK. This is accomplished by running the WRKSRVAGT TYPE(*UAK) command. This can also be accomplished by running the GO SERVICE command to access the Electronic Service Agent on IBM i main menu, then selecting Option 20. Check and refresh Update Access Key, as shown in Figure 1 and Figure 2.

Figure 1 Electronic Service Agent on IBM i main menu option 20

Electronic Service Agent on IBM i main menu option 20

Help instructions on option 20 can help clients to understand this feature.

Figure 2 Help information on Electronic Service Agent on IBM i main menu option 20

Help information on Electronic Service Agent on IBM i main menu option 20

Automatic: The Change Service Agent Attribute (CHGSRVAGTA) command can be used to enable automatic checking. The CHGSRVAGTA command parameter (REFRESHUAK) can be used to establish automatic UAK management. By default, a job named QS9UAK, will be run every Sunday, but can be easily customized.
Enablement steps:
1. Enter CHGSRVAGTA and press F4.
2. Enter Yes for Enable.
3. Press Page Down.
At this point, the Change Service Agent Attribute panel appears as shown in Figure 3. Specify the weekday and time to use for UAK refresh processing.

Figure 3 Change Service Agent Attribute – refresh UAK configuration panel

Change Service Agent Attribute – refresh UAK configuration panel

In addition, an incorrect country or region ID in the system contact information can cause the download to fail. Use the CHGCNTINF command and press F4=Prompt. Page down to the address information and specify the Country or Region as a two-character abbreviation for the country or region, such as US for United States, CA for Canada, SE for Sweden, GB for United Kingdom, etc. To learn the correct two-character code for your region, place a question mark followed by a space on the Country or region parameter of the contact information and press <ENTER>. This brings up a list of the various countries and regions with their respective two-character ID.

When the UAK management job is completed, one of the following two different messages will be provided as the result:

CPIEF87: Update Access Key has been handled successfully.
This message indicates that the UAK refresh processing determined that the expiration date of the UAK was within the next 30 days. The processing downloaded the new UAK and applied the new UAK successfully.
CPIEF88: Download and apply Update Access Key stopped.
The refresh processing stopped due to one of the following reasons:
- RC 1 -- This is not a stand-alone partition, so the key will be handled by its managing system (for example, HMC).
  Electronic Service Agent on IBM i does not do the management of UAK for such partitions. It does not mean a failure, but only means that the client does not need to do the management of UAK on the current partition. REFRESHUAK parameter could be disabled (*NO)
- RC 2 -- This is not a power 8 system (or higher), which doesn't support apply key action.
  It does not mean a failure, but only means that the client does not need to care about managing UAK of the current partition. REFRESHUAK parameter could be disabled (*NO)
- RC 3 -- Error happened during accessing and processing UAK expiration date by
  DSPFMWSTS.
  Users can examine the details in the audit log and trace for Electronic Service Agent on IBM i. Also, check DSPFMWSTS date displayed.
- RC 4 -- Expiration date is far away from now (more than 30 days). No need to worry for now.
- RC 5 -- Downloading the key was stopped. Please read into audit log for details.
- RC 6 -- Error happened when applying the key. Please read into audit log for details.
- RC 7 -- The firmware is unavailable in this system.
- RC 8 -- Spawn process error. Try again.
  See any previously listed messages and the Electronic Service Agent audit log for additional information. Fix any errors, then try the request again.
  If the problem continues to occur, contact your local IBM service representative.

Note: If the amber or attention light is ON due to expired UAK, assuming these are SRCA700xxxx codes such A7004761, then need to go into the SAL entries from SST, close the event, then F6 to acknowledge all of the events, in order to turn off the light.

Steps are:

From IBM i command line:

STRSST

1. Start a service tool
 7. Hardware service manager
  6.  Work with service action log

Select period of the issue. Use either 7=Close and delete an entry or 8=Close a NEW entry to remove the entry. Only delete it when know that problem is resolved, UAK date updated, similar to WRKPRB entries.

Summary:

The new feature in Electronic Service Agent on IBM i provides clients that have Standalone systems on POWER8 and later processor-based servers with IBM i 7.2 or higher operating systems, an easier, and automatic way to manage the Update Access Key. By launching this function in Electronic Service Agent on IBM i, the whole process of refreshing the UAK (check expiration date of UAK, download new key, and apply it) will be automatically managed, easing the systems management burden for system administrators.
It needs Inventory data to be sending by ESA. To enable it, review the Configuration Instructions for Electronic Customer Support (ECS), Electronic Service Agent (ESA) and PM Agent for V5R4 and Higher releases document.

Extra Resources:

[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CGRAA2","label":"Electronic Service Agent"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2.0;7.3.0;7.4.0;7.5.0"}]

Tips