Abhi2271/tech-qa huggingface dataset:
IBM Cloud Orchestrator (ICO) continues to be a strategic solution for IBM - United States  FLASH (ALERT)

ABSTRACT
 Cloud Orchestrator (ICO) continues to be a strategic solution for IBM 

CONTENT
IBM Cloud Orchestrator continues to be a strategic solution for IBM in Hybrid Cloud management and will continue to be actively developed. Future IBM Cloud Orchestrator releases will enable management of external OpenStack environments which are compliant with the RefStack certification, providing more choices and flexibility to clients to select their preferred OpenStack vendor. The current release of IBM Cloud Orchestrator will continue to bundle IBM Cloud Manager with OpenStack (ICMO), while future IBM Cloud Orchestrator releases will no longer bundle ICMO, as it has been announced that ICMO is at the end of market (see reference document below).
IBM Cloud Orchestrator (ICO) and IBM Cloud Manager with OpenStack (ICMO) will continue to be supported until Sept 2020.

Reference: ICMO End of Market announcement:
http://www-01.ibm.com/common/ssi/ShowDoc.wss?docURL=/common/ssi/rep_ca/2/897/ENUS916-062/index.html&lang=en&request_locale=en [http://www-01.ibm.com/common/ssi/ShowDoc.wss?docURL=/common/ssi/rep_ca/2/897/ENUS916-062/index.html&lang=en&request_locale=en]

Question: ICO's Roadmap of supporting next OpenStack versions 

Hello,

ICO 2.5.0.2 is compatible with OpenStack kilo, is there a plan making it work with OpenStack Liberty/Mitika ?

Would you share any information or link about the roadmap, please?

Thanks in advance.

Answer: The current release of IBM Cloud Orchestrator will continue to bundle IBM Cloud Manager with OpenStack (ICMO), while future IBM Cloud Orchestrator releases will no longer bundle ICMO, as it has been announced that ICMO is at the end of market (see reference document below).
IBM Information Server Informix Wire Protocol driver error "Transaction not available" from ODBC Connector Stage - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When using the ODBC Connector Stage to access data in an Informix database, receive the following error:

Message: ODBC_Connector_0: ODBC function "SQLPrepare" reported: SQLSTATE = HY000: Native Error Code = -95: Msg = [IBM(DataDirect OEM)][ODBC Informix Wire Protocol driver][Informix]Unexpected Network Error.
ODBC function "SQLPrepare" reported: SQLSTATE = HY000: Native Error Code = -256: Msg = [IBM(DataDirect OEM)][ODBC Informix Wire Protocol driver][Informix]Transaction not available. (CC_OdbcDBStatement::dbsPrepare, file CC_OdbcDBStatement.cpp, line 347)


RESOLVING THE PROBLEM
To resolve the above error, set the Transaction handling>Isolation Level from none to Auto-Commit.

Question: Column Analysis on Informix database using odbc connector fails with error SQLSTATE = HY000: Native Error Code = -256 Column Analysis on Informix database using odbc connector fails with error SQLSTATE = HY000: Native Error Code = -256

Answer: To resolve the above error, set the Transaction handling>Isolation Level from none to Auto-Commit.
IBM Exceptions starting WAS 8.5 as non root user on Solaris - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You notice the exceptions below at start up. 

SYMPTOM
Exception: command /usr/sbin/zonecfg failed with 1
and 
FFDC Exception:java.lang.Exception SourceId:com.ibm.ws.xd.vv.nodedetect.NetworkInterfaceUtil.getMacAddresses ProbeId:2
java.lang.Exception: dlopen() returned error; rc=128


CAUSE
When WebSphere Application Server is run as a non-root user it will not be able to run native commands. This limited access causes the exceptions.

RESOLVING THE PROBLEM
To resolve the problem, run WebSphere Application Server under a root user. If the environment is not virtualized, that is if Solaris zones are not being used then the errors can be ignored as these will only occur at start up and will not affect a non-virtualized environment

Question: zonecfg error while starting nodeagent and dmgr 

I saw zonecfg error while starting nodeagent and dmgr in solaris server

My env is Oracle Solaris 11.2 SPARC, and WAS is 8558, jave 1.7. [1/22/16 21:31:18:379 AEDT] 00000001 SystemOut O java.lang.Exception: command /usr/sbin/zonecfg failed with 1 at com.ibm.ws.xd.agent.hypervisor.SolarisHypervisor.executeCommand(SolarisHypervisor.java:357) at com.ibm.ws.xd.agent.hypervisor.SolarisHypervisor.access$100 (SolarisHypervisor.java:30) at com.ibm.ws.xd.agent.hypervisor.SolarisHypervisor$Zone.processZoneCfg(SolarisHypervisor.java:570) at com.ibm.ws.xd.agent.hypervisor.SolarisHypervisor$Zone.(SolarisHypervisor.java:461) at com.ibm.ws.xd.agent.hypervisor.SolarisHypervisor ..... Is that normal behavior and what's the exactly meaning of the error?

Answer: When WebSphere Application Server is run as a non-root user it will not be able to run native commands. This limited access causes the exceptions.
IBM SPSS Student Version and Graduate Pack Resources - United States SPSS Support Acquisition Statistics Stats Grad Pack Student TECHNOTE (FAQ)

QUESTION
 Where do I get support for IBM SPSS Student Version or Graduate Pack software? 

ANSWER
Step 1: 
For installation & licensing issues on Student version and Graduate pack, contact your vendor. 

 * Hearne [http://www.hearne.software/Software/SPSS-Grad-Packs-for-Students-by-IBM/FAQ] 
 * On the Hub [http://onthehub.com/] 
 * StudentDiscounts.com [http://studentdiscounts.com/contact-us.aspx] 
 * JourneyEd [https://www.journeyed.com/contact] 
 * thinkEDU [https://thinkedu.desk.com/] 
 * Studica [http://www.studica.com/technical-support]





Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Amos Windows Not Applicable Grad Pack, Shrinkwrap, Campus Business Analytics SPSS Modeler Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Windows Not Applicable Business Analytics SPSS Statistics Platform Independent Not Applicable Campus Edition, Grad Pack, Student Version

Question: How do I transfer my SPSS 24 license key to a new computer? I need to transfer my SPSS 24 license key to a new computer. I was able to download IBM® SPSS® Statistics Standard GradPack 24 for Windows (12-Mo Rental) onto the new computer, but every time I put in the activation code, I am met with this error message: 

Authorization failed.: You are not allowed to generate any more new licenses.
End Of Transaction. 
No additional authorizations are permitted on this code. 
What should I do?



This dW Answers question is about an IBM document with the Title: 
SPSS Student Version and Graduate Pack Resources

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.
IBM Seed value used during the instance creation is lost : Recovery procedure - United States seed lost; idsgendirksf; Encryption Seed Value; key stash file TECHNOTE (TROUBLESHOOTING)

THIS DOCUMENT APPLIES ONLY TO THE FOLLOWING LANGUAGE VERSION(S):
 English 

PROBLEM(ABSTRACT)
 Generating key stash file if the seed value which was used at the time of instance creation has been lost then there is no way to recover this seed value. 

RESOLVING THE PROBLEM
 

There is NO way to recover the seed value used during the instance creation if it has been lost. The only workaround is to create a new instance with a new encryption seed value and then use the db2ldif and ldif2db utilities to export and import data respectively. These utilities can be supplied with the new encryption seed and the salt value of the new instance. Thus the data would be preserved(alongwith the passwords) on this new instance.

Here are the steps to follow:

1. Set up a new instance says "newinst".

$> idsicrt -I newinst -e thisismyencryptionseed -l (/home/newinst) -n

$> idscfgdb -I newinst -w ldap -a newinst -t newinst -l (/home/newinst) -n

$> idscfgsuf -s "o=ibm,c=us" -I newinst -n

$> idsdnpw -u cn=root -p root -I newinst -n

2. Note the encryption seed - "thisismyencryptionseed". Let us call this new_encryptionseed

3. Once this new instance is setup note down the salt value generated by the new server instance by searching for "cn=crypto,cn=localhost".

$> ldapsearch -D <administrator DN> -w <administrator password> -b "cn=crypto,cn=localhost" -s base objectclass=* ibm-slapdCryptoSalt

Let us call this value: new_saltvalue

4. Lets assume that the instance name with the forgotten encryption seed is "oldinst"

5. Use the db2ldif utility on the instance with the forgotten encryptionseed, oldinst with the following options -

$> db2ldif -o outputfile -I oldinst -k new_encryptionseed -t new_saltvalue

6. Once this step is successfully completed the entire data from "oldinst" would be dumped in outputfile.

7. Use the utilities like ldif2db to re-load all the data into the new server instance.







HISTORICAL NUMBER

Question: What happens if I lost my seed and salt value? In ISDS, what happens if I lost my seed and salt value?



This dW Answers question is about an IBM document with the Title:
Open Mic Webcast: Configuring SDS 8.0.1 Virtual Appliance with a remote DB2 database - Tuesday, 17 Jan 2017 [presentation slides are attached; includes link to replay]

Answer: There is NO way to recover the seed value used during the instance creation if it has been lost. The only workaround is to create a new instance with a new encryption seed value and then use the db2ldif and ldif2db utilities to export and import data respectively. These utilities can be supplied with the new encryption seed and the salt value of the new instance. Thus the data would be preserved(alongwith the passwords) on this new instance.
IBM Content Navigator known issue: In a SPNEGO/Kerberos Single sign-on environment, IBM Content Navigator the Log Out option is enabled - United States  PRODUCT DOCUMENTATION

ABSTRACT
 In a SPNEGO/Kerberos single sign-on (SSO) environment, your IBM Content Navigator session shows the Log Out option as enabled when you select the drop-down menu on the user name. However, the option should be disabled. 

CONTENT
IBM Content Navigator disables the Log Out option under SSO environments. However, under some SSO environments or desktop load scenarios, such as SPNEGO/Kerberos on a WebLogic Application Server, IBM Content Navigator enables the Log Out option.




If the Log Out option is enabled but does not work correctly in your SSO environment, you can remove the Log Out option by customizing the banner user session context menu that is used by your desktop configuration. 

To remove the Log Out option: 

 1.  In the administration tool, select Menus. 
 2.  Enter "User" in the Name contains filter field. 
 3.  Select the Default banner user session context menu and click Copy. 
 4.  Enter a name for the new menu such as "Banner user session context menu - no Log Out option". 
 5.  Remove the Log Out from the Selected list. 
 6.  Save the new menu. 
 7.  Open the Desktops configuration, then open your desktop configuration. 
 8.  Select the Menus tab and scroll to the Feature Context Menus section. 
 9.  Select the new menu that you created for the Banner user session context menu menu type. 
 10. Save your desktop. 


The change to the menus takes effect when the modified desktop is reloaded. 




Cross reference information Segment Product Component Platform Version Edition Enterprise Content Management Case Manager AIX, Linux, Linux on System z, Windows 5.2.1.0

Question: Does Logout button get disabled in ICM for SSO with Tivoli Access Manager ? Does Logout button get disabled in ICM for SSO with Tivoli Access Manager ? 

Answer: IBM Content Navigator disables the Log Out option under SSO environments. However, under some SSO environments or desktop load scenarios, such as SPNEGO/Kerberos on a WebLogic Application Server, IBM Content Navigator enables the Log Out option.




If the Log Out option is enabled but does not work correctly in your SSO environment, you can remove the Log Out option by customizing the banner user session context menu that is used by your desktop configuration.
IBM Missing Icon pulldown options in DASH main menu after 3.1.2.1 Install - United States DASHL2; Console Settings; missing.; icons; WAS 8.5.5.9; DASH 3.1.2.1; Cumulative patch 5; CP5 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 After fresh install of WAS 8.5.5.9 with JazzSM 1.1.2.1/DASH 3.1.2.1, the "Console Settings" is missing entries and other expected icons are missing from the DASH main page. 

SYMPTOM
After successful installation of JazzSM 1.1.2.1/DASH 3.1.2.1 with WebSphere 8.5.5.9, some of the icons in the main DASH window are missing on the left.


CAUSE
It was recently discovered that some .jar files were not included in WebSphere 8.5.5.9, that were available in previous WebSphere releases, and are required for several functions in DASH.

ENVIRONMENT
JazzSM 1.1.2.1 / DASH 3.1.2.1 WAS 8.5.5.9

DIAGNOSING THE PROBLEM
After you login to DASH and select "Console Settings", the displayed window, which should have several lines, is blank:


[/support/docview.wss?uid=swg21981870&amp;aid=1]

Also, in this case there wasn't any icons in the upper left portion of the main DASH window.


RESOLVING THE PROBLEM
The missing jar files are included in DASH 3.1.2.1 Cumulative Patch 5, which you can download from this site: 


http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli∏uct=ibm/Tivoli/Jazz+for+Service+Management&release=1.1&platform=All&function=all [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Jazz+for+Service+Management&release=1.1&platform=All&function=all] 

[/support/docview.wss?uid=swg21981870&aid=2] [/support/docview.wss?uid=swg21981870&aid=2]
If you have any questions as to whether DASH 3.1.2.1 Cumulative Patch 5 has been installed, please run this command:

<JazzSM_HOME>/ui/bin/consolecli Version if patch 5 has been installed, it will have output showing the patch number shown in the red square in the screen shot:

[/support/docview.wss?uid=swg21981870&aid=3] [/support/docview.wss?uid=swg21981870&aid=3]

If installing on a UNIX server, you will see several of these messages, they indicate that the jar files are not currently on the server, but the Patch install will finish successfully.
cp: 
/opt/IBM/JazzSM/ui/../profile/installedApps/JazzSMNode01Cell//isc.ear/TI 
PChangePasswd.war/js/ibm/tivoli/tip/changepasswd/nls/iw/messages.js: No 
such file or directory 
.
.
Patch 201603301212 successfully installed.

Question: How can I fix blank pull down  "Console Settings" menu after successful install of JazzSM 1.2.1.1 and WebSphere 8.5.5.9? WebSphere version 8.5.5.9 didn't include jar files that were available in previous releases of WebSphere that are required by DASH for various tasks.

Answer: The missing jar files are included in DASH 3.1.2.1 Cumulative Patch 5, which you can download from this site: 


http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli∏uct=ibm/Tivoli/Jazz+for+Service+Management&release=1.1&platform=All&function=all [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Jazz+for+Service+Management&release=1.1&platform=All&function=all]
IBM Leap Second bug in older Linux kernels may affect IBM MQ and WebSphere MQ - United States  FLASH (ALERT)

ABSTRACT
 Leap seconds are a periodic one-second adjustment of Coordinated Universal Time (UTC) required to keep a system's time of day close to the mean solar time.

A leap second is scheduled for 31 December 2016 at 23h 59m 60s UTC.

In the past, the addition of leap seconds caused some systems running older Linux kernels to fail. IBM MQ and WebSphere MQ queue managers running on these systems generated repeated FDC files showing Probe Id XY348010 or XC272003 from xcsCreateThread, with error code xecP_E_NO_RESOURCE. Other FDCs are also possible. 

CONTENT
On 31 December 2016, the Network Time Protocol (NTP) daemon will schedule a leap second [http://en.wikipedia.org/wiki/Leap_second] to occur at midnight, making the final minute of the day 61 seconds long. Prior leap second insertions, including the 30 June 2016 leap second, caused some Linux systems to exhibit unexplained high CPU usage.


IBM MQ and WebSphere MQ use the Native POSIX Thread Library (NPTL) which relies on futuxes ("fast userspace mutexes") for synchronization between threads. Futexes can exhibit high CPU spins after leap seconds on Linux kernel versions 2.6.22 through 3.5-rc7, inclusive, although some Linux distributions shipped patches for kernels in this range:


 * 
 * Leap Second to be added on December 31st 2016
 * 
 * 
 * 
 * General information on Leap Second 2016
 * 
 * Fixes and workarounds to avoid issues caused by Leap Second 2015
 * 
 * 
 * 
 * Addition of leap second causes spuriously high CPU usage and futex lockups



Contact your Linux vendor to check the status of other distributions, or check the Linux kernel version using "uname -r" and confirm that your system is older than 2.6.22 or running 3.5 or later. 

If you encounter this problem, the following workaround may resolve the high CPU usage. As root, run: 
 * date -s "$(LC_ALL=C date)"

 

PRODUCT ALIAS/SYNONYM
 IBM MQ WMQ WebSphere MQ MQSeries

Question: On 30th June, could the Leap Second cause Linux to freeze and impact my MQ? On 30th June, could the Leap Second cause Linux to freeze and impact my MQ? 

Answer: In the past, the addition of leap seconds caused some systems running older Linux kernels to fail. IBM MQ and WebSphere MQ queue managers running on these systems generated repeated FDC files showing Probe Id XY348010 or XC272003 from xcsCreateThread, with error code xecP_E_NO_RESOURCE. Other FDCs are also possible.
IBM Is there a limit to the number of items that can be listed within an "in" list as part of a where clause? - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Is there a limit to the number of items that can be listed within an "in" list as part of a where clause? 

CAUSE
Every time the query optimizer finds a "(NOT) IN" statement in the query, a decision must be made:
Option A: Evaluate the condition sequentially for every member of the IN-list, or 
Option B: create a temporal virtual table from this list and use JOIN logic for evaluation. 

If the amount of members in the IN-list is smaller than the value of INLIST_THRESHOLD, then option A is used. 
If the amount of members in the IN-list is equal or bigger than the value of INLIST_THRESHOLD, then option B is used.


ENVIRONMENT
Any IBM PureData System for Analytics with any NPS Release



RESOLVING THE PROBLEM
The short answer is no limit.


By default we create a virtual table for any "in list" with more than 5 values.

The only limitation with large "in list" statements would be the memory needed to compile the query. If the query is too complex, you can potentially run out of memory, but that will not affect other sessions since this happens inside the postgres process assigned to that session. The parameter that is responsible for this behaviour is inlist_threshold and it is safe to increase this value to 100, but not more.

show inlist_threshold;

set inlist_threshold=<value>;

 

PRODUCT ALIAS/SYNONYM
 pda netezza

Question: Is there a limit to the number of items that can be listed within an "in" list as part of a where clause? Is there a limit to the number of items that can be listed within an "in" list as part of a where clause? 

Answer: The short answer is no limit.


By default we create a virtual table for any "in list" with more than 5 values.

The only limitation with large "in list" statements would be the memory needed to compile the query. If the query is too complex, you can potentially run out of memory, but that will not affect other sessions since this happens inside the postgres process assigned to that session. The parameter that is responsible for this behaviour is inlist_threshold and it is safe to increase this value to 100, but not more.
IBM How Connect TDWC 9.3 to TWS Engine lower level release - United States dwc 93; connect; SSL ; TLS TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 DWC 9.3 users cannot connect to TWS Engine lower level releases (8.5.1 until 9.2) 

SYMPTOM
Unable to connect to TWS 8.5.1 ,8.6 or 9.1/9.2 from DWC 9.3. 

Check the WAS SystemOut.log for error :

SSL0080E: javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: Server chose SSLv3, 
but that protocol version is not enabled or not supported by the client. javax.net.ssl.SSLHandshakeException: Server chose SSLv3, but that protocol version is not enabled or not supported by the client.


CAUSE
DWC 9.3 is packaged with WAS 8.5.5.4 and due to known vulnerabilities has SSLV3 disabled. However TWS 9.2 and earlier versions use SSLv3 by default and so the DWC 9.3 cannot connect


RESOLVING THE PROBLEM
You can solve this problem by configuring your TWS engines to use TLS instead of SSL :


Backup and edit : 

TWA_HOME/WAS/TWSProfile/config/cells/TWSNodeCell/security.xml 

Find sslProtocol and change "SSL_TLS" to "TLS" 

Find ssl.protocol and change value="SSL" to value="TLS" 

Backup and edit : 

TWA_HOME/WAS/TWSProfile/properties/ssl.client.props 

Find com.ibm.ssl.protocol=SSL and change to com.ibm.ssl.protocol=TLS 

Backup and edit : 

TWA_HOME/WAS/TWSProfile/temp/ssl.client.props 

Find com.ibm.ssl.protocol=SSL and change to com.ibm.ssl.protocol=TLS 

Stop and restart WAS. 

*Be aware that your Engines are now using TLS and so you must also reconfigure any DWC 9.2 or 9.1 installations that need to connect to those engines. You would change them to use TLS in the same way as above but also by the same changes in these copies of security.xml and ssl.client.props : 

TWA_HOME/JazzSM/profile/config/cells/JazzSMNode01Cell/security.xml 

TWA_HOME/JazzSM/profile/properties/ssl.client.props 

TWA_HOME/JazzSM/profile/temp/ssl.client.props 

Please consider that since you configure with TLS the WAS of TWS Engine also the Dynamic Agent can be impacted. 

See technote 1689332.

Question: TWS / DWC and WebSphere 8.5.5.4+ WebSphere for TWS & DWC were upgraded to 8.5.5.4 on most servers in a particular environment. However, any TWS servers that still had 8.5.5.2, could no longer be seen by the new DWC / WAS 8.5.5.4 servers. Those lower WAS version engines could not be added to the DWC.

Errors seen are:

     AWSUI0833E The operation could not be completed. There has been a communication failure. 
     The internal message is: AWSJCO005E WebSphere Application Server has given the following error: Error getting WsnNameService properties. 

Answer: You can solve this problem by configuring your TWS engines to use TLS instead of SSL :
IBM Upgrading default JDBC drivers to Oracle 12c requires the definition of an additional JVM property in IBM Business Monitor - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 In IBM Business Monitor V8.5.5, the Monitor server fails if the default JDBC driver included in the product is upgraded to an Oracle 12c JDBC driver. 

RESOLVING THE PROBLEM
To use Oracle 12c with IBM Business Monitor V8.5.5, a new JVM property must be defined. Add the following JVM property to the Monitor server JVM:

oracle.jdbc.autoCommitSpecCompliant=false

Question: Why do we observe the transaction rollback errors J2CA0024E and DSRA0080E with Oracle 12c and how can we fix it? 

We are using BPM Advanced v8.5.6 in connection with the Oracle JDBC Driver 12.1.0.1.0. We observe many database transaction rollback exceptions:

     J2CA0024E: Method rollback, within transaction branch ID <null> of resource pool jdbc/BPEDB, caught com.ibm.ws.exception.WsException: DSRA0080E: An exception was received by the Data Store Adapter. See original exception message: Could not rollback with auto-commit set on. with SQL State : 99999 SQL Code : 17274

Due to the technote "Advanced database support for IBM BPM Standard, IBM BPM Advanced, and IBM Business Monitor on distributed platforms" this is a supported configuration.

Why do we observe these errors and how can we fix it?

Answer: To use Oracle 12c with IBM Business Monitor V8.5.5, a new JVM property must be defined. Add the following JVM property to the Monitor server JVM:

oracle.jdbc.autoCommitSpecCompliant=false
IBM SSLKeyException: RSA premaster secret error  Caused by InvalidKeyException - United States JDBC JCC SSL SSLKeyException .InvalidKeyException TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 My java application using the Data Server Driver for JDBC (JCC) is failing to establish SSL connection with following error:

SSLKeyException: RSA premaster secret error. Caused by: java.security.InvalidKeyException: Illegal key size or default parameters. 

SYMPTOM
javax.net.ssl.SSLKeyException: RSA premaster secret error. Caused by: java.security.InvalidKeyException: Illegal key size or default parameters 


CAUSE
The default restricted policy file has a 2048 key size limit. If the RSA key size exceeds this limit then this error is expected.

RESOLVING THE PROBLEM
This issue can be resolved by upgrading to the unrestricted policy files, replacing the security policy files with the IBM unlimited cryptography files. Replace the local_policy.jar with the Unrestricted JCE policy File. [https://www14.software.ibm.com/webapp/iwm/web/reg/pick.do?source=jcesdk&lang=en_US]

Question: Why am I getting an SSL Key Exception (RSA premaster secret error) when trying to create a syndication pair? 

When trying to create the syndication pair for a virtual portal, I am getting the following exception:

"IWKWC0016E: The remote service can not be retrieved. Either the URL you entered is incorrect, the server you indicated does not contain IBM Web Content Manager or the web service has been incorrectly configured and could not be located. Check the log for more details https://1.23.456.789 <-- your ip address or hostname will be shown here

/wps/wcm/vpname/basicauth/SyndicationServlet?reqlocale=en_US& javax.net.ssl.SSLKeyException: RSA premaster secret error"

Answer: The default restricted policy file has a 2048 key size limit. If the RSA key size exceeds this limit then this error is expected.
IBM WebSphere Cast Iron Cloud integration fix packs are available - United States  NEWS

ABSTRACT
 Fix packs for WebSphere Cast Iron Cloud integration are now available for download. 

CONTENT
Following are links to more information about the latest fix packs available on Fix Central for these versions: 

 * 7.5.2.0 (App Connect Professional). See this forum Q&A [https://developer.ibm.com/answers/questions/303457/what-is-ibm-app-connect-professional/] for more information. And see App Connect Professional builds and iFix details. [http://www.ibm.com/support/docview.wss?uid=swg21998280] 
 * 7.5.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21972013] 
 * 7.5.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21963355] 
 * 7.0.0.2 [http://www.ibm.com/support/docview.wss?uid=swg21686987] 
 * 7.0.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21678176] 
 * 7.0.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21656428] 
 * 6.4.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21647655] 
 * 6.4.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21641628] 
 * 6.3.0.2 [http://www.ibm.com/support/docview.wss?uid=swg21650993] 
 * 6.3.0.1 [http://www.ibm.com/support/docview.wss?uid=swg21625115] 
 * 6.3.0.0 [http://www.ibm.com/support/docview.wss?uid=swg21619941]

Question: Where is latest information on fix packs for Cast Iron? Where can I find more information on the fix packs and downloads available for the various releases of Cast Iron? 

Answer: Following are links to more information about the latest fix packs available on Fix Central for these versions:
IBM Specifying an alternative to "/tmp" for Tivoli Integrated Portal installs - United States TIPL2; TIPL2INST; tmp; temp directory; folder; Tivoli Integrated Portal; installation; fix pack TECHNOTE (FAQ)

QUESTION
 Is there a way to configure the TIP installer to use an alternate directory if the installation user ID has insufficient access rights to "/tmp"? 

ANSWER
TIP L3 has examined the TIP installer and found that /tmp is hard coded in both the TIP and Websphere installers. There is no option available to override /tmp. To pursue a change to the TIP installer to accommodate an alternate tmp location, please submit an enhancement request via the RFE site here:

http://www.ibm.com/developerworks/rfe/?BRAND_ID=90 [http://www.ibm.com/developerworks/rfe/?BRAND_ID=90]

Question: Is there a way to force the Tivoli Integrated Portal (TIP) fix pack installer to use a different temp location? Is there a way to force the Tivoli Integrated Portal (TIP) fix pack installer to use a different temp location? 

Answer: There is no option available to override /tmp.
IBM Can we remove world-writable permissions - global write permission - United States World writeable TECHNOTE (FAQ)

QUESTION
 Setup a recurring process to remove world-writable from the files and directories: chmod o-w. We are not planning to delete any files. Would this impact functionality ? 

ANSWER
The question is whether or not it is safe to remove world-writable for these files and directories. Some of them are dynamic and will be re-created with world-writable after reboot. For these we would like to remove world-writable on a recurring basis. 

/export/opt/IBM/tivoli/tip/derby/TTSS Directory-Only /export/opt/IBM/tivoli/tip/derby/TTSS/log Directory-Only /export/opt/IBM/tivoli/tip/derby/TTSS/seg0 Directory-Only /opt/tivoli/cit/bin/etc Directory-Only /opt/tivoli/cit/bin/etc/wscanhw Directory-Only /opt/tivoli/cit/cache_data Directory-Only /tmp/javasharedresources Directory-Only /usr/ibm/common/acsi/logs Directory-Only /usr/ibm/tivoli/common/CIT/logs Directory-Only /var/.com.zerog.registry.xml File /var/ibm/common/acsi/resourceBundleLocation Directory-Only /usr/ibm/common/acsi/repos/persistSVCRepos Directory-Only /usr/ibm/common/acsi/repos/persistSVCRepos/* File /usr/ibm/tivoli Directory-Only /usr/ibm/tivoli/common Directory-Only /usr/ibm/tivoli/common/CIT Directory-Only 
Answer: 

DB2 is OK confirmed by DB2 support 
# Revoke world-writable from recurring DB2 log files 
/bin/chmod o-w 
/export/opt/IBM/home/tklmdb2/sqllib/db2dump/stmmlog/stmm.*.log 
/bin/chmod o-w 
/opt/IBM/home/tklmdb2/tklmdb2/NODE0000/TKLMDB/.SQLCRT.FLG 
/bin/chmod o-w 
/opt/IBM/home/tklmdb2/tklmdb2/NODE0000/TKLMDB/*/.SQLCRT.FLG 

Tested removing world-writable permissions on DB2 and it is OK. 

None of these files are TKLM specific. 

Some of these directories do not belong to TIP. 

CIT Files TKLM V2 doesn't have them: 
/opt/tivoli/cit/bin/etc Directory-Only 
/opt/tivoli/cit/bin/etc/wscanhw Directory-Only 
/opt/tivoli/cit/cache_data Directory-Only 
/usr/ibm/tivoli Directory-Only 
/usr/ibm/tivoli/common Directory-Only 
/usr/ibm/tivoli/common/CIT Directory-Only 
/usr/ibm/tivoli/common/CIT/logs Directory-Only 

Changed the permissions on those files. Everything looked OK: create a master keystore. create an LTO device. create a key, backup and restore, and apply a fixpack. 

Non-DE 
/tmp/javasharedresources Directory-Only 
/var/.com.zerog.registry.xml File Can be deleted 
DE related files 
/usr/ibm/common/acsi/logs Directory-Only 
/var/ibm/common/acsi/resourceBundleLocation Directory-Only 
/usr/ibm/common/acsi/repos/persistSVCRepos Directory-Only 
/usr/ibm/common/acsi/repos/persistSVCRepos/* File 
** Remove world writable permissions from DE directories. This will not impact functionality. 

It is OK to change the global write permission on above directories and files.

Question: Can I remove the write permissions for "other" in ../ibm/common/acsi? Can I remove "write" permission for "other" for all the sub-directories and files under the following directory,

    /usr/ibm/common/acsi  
    /var/ibm/common/acsi  

Will it cause any problem? 

Answer: Remove world writable permissions from DE directories. This will not impact functionality.
IBM MTTrapd [SNMP] probe drops traps from specific devices - United States nco_p_mttrapd; snmp; snmp traps; traps; dropped; drop; dropping; malformed; TCP TECHNOTE (FAQ)

QUESTION
 MMTrapd probe : Why are SNMP traps dropped from specific devices? 

CAUSE
SNMP packets can be dropped for a number of reasons, including overloading, malformed packets, malformed traps/informs and incorrectly configured/non-compliant MIBS.

ANSWER
Traps can be dropped during high loading, so ensure that the traps are being dropped from specific devices under normal load. 

Use snoop, tcpdump or Wireshark to capture the traps that are being dropped on the probe servers port, as defined in the property file. 

e.g.
Port : 162


Load the PCAP file into the Wireshark GUI and review the trap[s] visually. 


For traps to be processed they must have enterprise-oid and uptime, otherwise they will be dropped during probe processing by the NET-SNMP libraries.

Try setting Protocol to 'ALL' in case the trap is being sent as TCP|UDP.

For SNMPv3 trap and inform processing please refer to the available online FAQ's and supplementary documentation [see related information].

SNMPv3 traps require a unique creatruser entry for each device in the mttrapd.conf file, with the user definition including the devices unique engined-id. Whilst SNMPv3 INFORMs can be sent without an engine-id and a single createuser entry in the ConfPath's mttrapd.conf file.

If the trap appears to be RFC compliant, and MTTrapd probe is correctly configured, please send the PCAP file of the trap along with the probes debug log and property file to IBM Tivoli Netcool support for further analysis.

IMPORTANT: You should ensure that the latest MTTrapd probe and Netcool/OMNIbus fix pack is installed before contacting IBM Tivoli Netcool support, and that the problem persists with the latest product.

RELATED INFORMATION
#Capturing TCP data [http://www-01.ibm.com/support/docview.wss?uid=swg21569745]
Support's Guide to the SNMP [MTTrapd] probe [http://www-01.ibm.com/support/docview.wss?uid=swg21607690]
SNMPv3 trap reception [http://www-01.ibm.com/support/docview.wss?uid=swg21626348]

Question: OMNIBUS   nco_p_mttrapd : Malformed traps How can you determine why the MTTrapd [SNMP] probe drops traps? 

Answer: Traps can be dropped during high loading, so ensure that the traps are being dropped from specific devices under normal load. 

Use snoop, tcpdump or Wireshark to capture the traps that are being dropped on the probe servers port, as defined in the property file.
IBM SPSS Student Version and Graduate Pack Resources - United States SPSS Support Acquisition Statistics Stats Grad Pack Student TECHNOTE (FAQ)

QUESTION
 Where do I get support for IBM SPSS Student Version or Graduate Pack software? 

ANSWER
Step 1: 
For installation & licensing issues on Student version and Graduate pack, contact your vendor. 

 * Hearne [http://www.hearne.software/Software/SPSS-Grad-Packs-for-Students-by-IBM/FAQ] 
 * On the Hub [http://onthehub.com/] 
 * StudentDiscounts.com [http://studentdiscounts.com/contact-us.aspx] 
 * JourneyEd [https://www.journeyed.com/contact] 
 * thinkEDU [https://thinkedu.desk.com/] 
 * Studica [http://www.studica.com/technical-support]





Cross reference information Segment Product Component Platform Version Edition Business Analytics SPSS Amos Windows Not Applicable Grad Pack, Shrinkwrap, Campus Business Analytics SPSS Modeler Platform Independent Not Applicable Business Analytics SPSS Text Analytics for Surveys Windows Not Applicable Business Analytics SPSS Statistics Platform Independent Not Applicable Campus Edition, Grad Pack, Student Version

Question: How do I transfer my SPSS 24 license key to a new computer? I need to transfer my SPSS 24 license key to a new computer. I was able to download IBM® SPSS® Statistics Standard GradPack 24 for Windows (12-Mo Rental) onto the new computer, but every time I put in the activation code, I am met with this error message:

Authorization failed.: You are not allowed to generate any more new licenses.
End Of Transaction.
No additional authorizations are permitted on this code.
What should I do?

Answer: For installation & licensing issues on Student version and Graduate pack, contact your vendor.
IBM Setting a big session time-out value in DASH causes session lock-out - United States DASHL2; session; time-out; timeout; cannot login; locked out ; 2147483647; security.xml TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Using a big value (2147483647) for the session timeout setting in DASH, to achieve the maximum time between timeouts, is causing users to be locked out completely. 

SYMPTOM
After entering the user ID and password in the login page, and then pressing the "continue" button,
the login page does not change, stuck at "processing" and then returns to the login page again." 

All users get essentially locked out completely from DASH sessions.


CAUSE
In order to maximize the time between session timeouts, the customer is setting the timeout parameter in the security.xml file to 2147483647.

This timeout parameter used in the security.xml file is a WAS setting, but DASH is using a javascript call (settimeout), which causes a condition that prevents a login, if the timeout value is really big. 


Note: 2147483647 is the maximum positive value for a 32-bit signed binary integer in computing.


RESOLVING THE PROBLEM
This condition that prevents logins can be averted by setting the custom property LTPAFIX in the consoleProperties.xml to "false". 


Please follow this steps: 

1. On DASH server, navigate to <JazzSM Home>/profile/config/cells/JazzSMNode01Cell/applications/isc.ear/deployments/isc/isclite.war/WEB-INF 

 
2. Take a backup of consoleProperties.xml 

 
3. Open consoleProperties.xml in edit-mode. 

 
4. Search for "LTPAFIX" and change the value from "true" to "false". 


Example: 

Before 
===== 
<consoleproperties:console-property id="LTPAFIX" value="true"/> 
</consoleproperties:ibm-portal-consoleproperties> 

After 
==== 
<consoleproperties:console-property id="LTPAFIX" value="false"/> 
</consoleproperties:ibm-portal-consoleproperties> 

5. Save the file. 

 
6. Restart DASH server.

Question: Why are the users unable to login to Web GUI 8.1 after I modify timeout to 2147483647 in security.xml file ? 

I followed the Web GUI 8.1 reference guide here to switching off the session timeout

http://www-01.ibm.com/support/knowledgecenter/SSSHTQ_8.1.0/com.ibm.netcool_OMNIbus.doc_8.1.0/webtop/wip/task/web_adm_settimeout.html

After I edited /config/cells/JazzSMNode01Cell/security.xml file, modified timeout setting to 2147483647, users are not able to login anymore.

Answer: 1. On DASH server, navigate to <JazzSM Home>/profile/config/cells/JazzSMNode01Cell/applications/isc.ear/deployments/isc/isclite.war/WEB-INF 

 
2. Take a backup of consoleProperties.xml 

 
3. Open consoleProperties.xml in edit-mode. 

 
4. Search for "LTPAFIX" and change the value from "true" to "false". 


Example: 

Before 
===== 
<consoleproperties:console-property id="LTPAFIX" value="true"/> 
</consoleproperties:ibm-portal-consoleproperties> 

After 
==== 
<consoleproperties:console-property id="LTPAFIX" value="false"/> 
</consoleproperties:ibm-portal-consoleproperties> 

5. Save the file. 

 
6. Restart DASH server.
IBM Datacap Taskmaster Capture ICR error code 12 - United States RecognizeFieldICR_C; Recostar; 12 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When performing field level ICR recognition using the action RecognizeFieldICR_C (), the batch aborts with error code 12. 

SYMPTOM
From log file:

Executing 'RecognizeFieldEx' from 'Datacap.Recognition.Recostar.ICRCWrapperClass'. Parameter : <FieldName>
Recognition return status: 12(Not defined (not used))


CAUSE
The c_cr variable for ICR_C recognition is not set for the engine.

RESOLVING THE PROBLEM
In Datacap Studio, set the c_cr variable to USA prior to the call to recognition as follow:

SaveAsCurrentObjVariable("c_cr", "USA")
RecognizeFieldICR_C

Question: RecognizePageFieldsICR_C aborts with Page Type change  I have an DeveloperWorks application that runs: Survey. In the application PageID Task there is a function that sets the Page Type to ReliefForm (based on a barcode)

Does anyone know why when I change the SetPageType to set another name, the RecognizePageFieldsICR_C in the Profiler Task aborts? If I put the name back the action runs fine. 

Answer: In Datacap Studio, set the c_cr variable to USA prior to the call to recognition as follow:

SaveAsCurrentObjVariable("c_cr", "USA")
RecognizeFieldICR_C
IBM Guardium STAP does not connect properly and does not show in the S-TAP Control - I see some specific errors in some log files. - United States  TECHNOTE (FAQ)

QUESTION
 What can cause an STAP to fail to connect properly - I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :-
"Server <ip_addr> wasn't heard from for nn sec during this attempt (nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log
"Unauthorized client connecting from <ip_addr> ,rejecting"


CAUSE
One reason for these errors could be that the S-TAP Approval Needed is checked in the S-TAP Certification screen on the Appliance like this :- 
[/support/docview.wss?uid=swg22009818&aid=1] [/support/docview.wss?uid=swg22009818&aid=1]





ANSWER
Uncheck the Approval box and the S-TAPs should start connecting . 


[/support/docview.wss?uid=swg22009818&aid=2] [/support/docview.wss?uid=swg22009818&aid=2]

Question: Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc 

Installed an STAP on a DB Server but it does not show up on my Appliance in S-TAP Control etc

I get the following messages in the logs:-

/tmp/guard_stap.stderr.txt on the DB Server :- "Server wasn't heard from for nn sec during this attempt nnn sec total), closing and re-opening"

and from the Guardium Appliance - via fileserver in the /log/opt-ibm-guardium-log/snif/snif.log "Unauthorized client connecting from ,rejecting".

How do I correct the problem?

Answer: Uncheck the Approval box and the S-TAPs should start connecting .
IBM Recognition gives Word too tall error with IBM Datacap Taskmaster Capture - United States recognition OCR OCR_A OCR_S TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When performing recognition on an image, recognition fails. The RRS log entry shows:

Word too tall, removed. 

CAUSE
This error can occur when the height of the word in pixels exceeds the configured limit. It can also occur when the recognition engine cannot identify the boundaries of the word.

RESOLVING THE PROBLEM
Do one of the following as appropriate for the situation. 

 * Verify that the newest recognition engine is being used. Currently this is done using the RecognizePageOCR_S action from the ocr_sr library. 
 * Increase the height limit for the action using SetMaxCharacterHeightTMM(x) where x represents the height in pixels. Default depends on the DPI, but for 300 DPI is 64. 
 * Reduce the height of the word in pixels. This may be done either by making the word smaller, or by reducing the number of pixels per inch for the tiff.

Question: OCR Results for Bold fonts 

Hi all,

I am having issue with extracting front that are bold, big front. May I know if Datacap have limitation on capturing metadata with big, bold front such as title of the document. I am using RecognizePageOCR_A for extraction of meta data and every other words were being extracted fine except those that are big. The attachment are the sample of front that could not be captured.

Answer: Do one of the following as appropriate for the situation. 

 * Verify that the newest recognition engine is being used. Currently this is done using the RecognizePageOCR_S action from the ocr_sr library. 
 * Increase the height limit for the action using SetMaxCharacterHeightTMM(x) where x represents the height in pixels. Default depends on the DPI, but for 300 DPI is 64. 
 * Reduce the height of the word in pixels. This may be done either by making the word smaller, or by reducing the number of pixels per inch for the tiff.
IBM Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform. - United States  TECHNOTE (FAQ)

QUESTION
 Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform. 

ANSWER
This is not a supported configuration.

Question: Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform? Can IBM Content Navigator be installed on Windows and be deployed to an Application Server that is running on a Unix Platform? 

Answer: This is not a supported configuration.
IBM Client IP address missing from the X-Forwarded-For header - United States  TECHNOTE (FAQ)

QUESTION
 Why is the Front End Load Balancer ( FELB ) not forwarding a client IP address to a backend? 

ANSWER
This is a known limitation in the current implementation of haproxy ( FELB ), especially with the layer 7 where SSL termination is handled.
Notice that forwarding a client IP address to a backend works when the FELB is setup to use non-SSL configuration.

Question: If we need to log client ip, if the FELB is enabled,  does it still need enable x-forwarder-for? If we need to log client ip, if the FELB is enabled,  does it still need enable x-forwarder-for?

Answer: This is a known limitation in the current implementation of haproxy ( FELB ), especially with the layer 7 where SSL termination is handled.
Notice that forwarding a client IP address to a backend works when the FELB is setup to use non-SSL configuration.
IBM Batch job fails with ABEND 102 REASON 00000000  
DUMP TITLE=CSQ1,ABN=102-00000000 ...  Mismatch code levels - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Your WebSphere MQ (WMQ) batch job abends with an abend 102 - 00000000
ABEND102 ABENDS102 S102 

CAUSE
One reason for Abend 102-00000000 - 

Mismatch in code levels between WMQ MSTR (Queue Manager) and the batch job

The S102 is occurring as the batch job is running with V701 libraries (for example, SCSQAUTH dataset which contains CSQBSRV, CSQBCON etc) against a V710 queue manager. In order to run against a V710 queue manager the V710 libraries need to be used by the batch job. 
In order to connect to a V710 queue manager the application needs to run with a V710 SCSQAUTH. The V710 SCSQAUTH will allow an application to connect to both a V710 or a V701 queue manager. 
This is documented in the Information Center (section 'z/OS: Planning for migration from WebSphere MQ version 7.0.1 to WebSphere MQ version 7. [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/index.jsp?topic=%2Fcom.ibm.mq.doc%2Fmi77108_.htm]1'; 


 * 


Per ' Application migration and interoperation [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/index.jsp?topic=%2Fcom.ibm.mq.doc%2Fmi23001_.htm]' topic, WebSphere MQ does not support connecting server applications loading libraries from the earlier level to connect to a later level of queue manager. On z/OS the STEPLIB must reference the target libraries for the queue manager. 

DIAGNOSING THE PROBLEM
In IPCS you can view level of CSQBSRV in the batch job address space. 

STORAGE ---------------------------------- 
Command ===> 
Address: 
294D8210 DD2DD220 DD0CB6C7 D70BDAF8 DAF8D77B | ..K....GP..8.8P# | 
294D8220 D748D748 A7F4000E C3E2D8C2 E2D9E540 | P.P.x4..CSQBSRV 
294D8230 F2F0F1F2 F1F1F2F7 E4D2F8F3 F7F7F440 | 20121127UK83774| . 
PTF UK83774is for Release ... 010 (V7.0.1) 


RESOLVING THE PROBLEM
Correct the STEPLIB for the batch job to point to the V7.1.0 libraries.



HISTORICAL NUMBER
 04659 79L 000
47552 077 724 

PRODUCT ALIAS/SYNONYM
 wmq mq

Question: I have an issues with V701 SCSQAUTH/SCSQANLE and MQ V8, my batch jobs receiving an ABEND (ABN=102-00000000). I have an issues with V701 SCSQAUTH/SCSQANLE and MQ V8, my batch jobs receiving an ABEND (ABN=102-00000000). 

Answer: Correct the STEPLIB for the batch job to point to the V7.1.0 libraries.