IBM Tivoli Composite Application Manager for SOA 7.2 Interim Fix 9 README Tivoli Composite Application Manager for SOA 7.2.0.1 7.2.0.1-TIV-ITCAMSOA-IF0009 Readme

IMPORTANT NOTE: To download this update, you must first login to IBM Fix Central. Once logged in, you may select from the individual download packages. When selecting fixes, ensure your download options are set to "Include requisites: Yes".
http://www.ibm.com/support/fixcentral/

Below is a list of components, platforms, and file names that apply to this Readme file.

This upgrade for ITCAM for SOA supersedes 7.2.0.1 IF1, 7.2.0.1 IF2, 7.2.0.1 IF3, 7.2.0.1 IF4, 7.2.0.1 IF5, 7.2.0.1 IF7 and 7.2.0.1 IF8 and may be applied to the following base versions.

• 7.2.0.1
• 7.2.0

For up-to-date ITCAM for SOA v7.2.0.1 software prerequisites, please visit:
Software and Hardware Prerequisites

For additional download packages or ITM support information, visit the ITM support portal at:
http://www.ibm.com/support/entry/portal/Overview/Software/Tivoli/Tivoli_Monitoring_V6

Non APAR Defect 91545 - Unable to add Windows bundles to the Depot

Self Describing Agent (SDA) limitations

Prior to installation

The update installer should perform the following steps for you automatically. You can, if necessary, perform them manually.

1. Stop ITM agents and infrastructure (including TEMS and TEPS).
2. Ensure the DataPower Data Collector has stopped.

1. Stop ITM agents and infrastructure (including TEMS and TEPS):
The ITM agents and infrastructure only need to be stopped when either the application support packages are being installed or SOA is being installed on the ITM machine. If SOA is being installed on a machine that does not contain any ITM infrastructure, the ITM infrastructure does not need to be stopped.

Use the Manage Tivoli Enterprise Monitoring Services (MTEMS) dialog or the command line tools (`<ITM_HOME>\bin\tacmd` or `<ITM_HOME>/bin/itmcmd`) to stop any running ITM agents or infrastructure (including TEMS and TEPS).

On Windows systems, you can start the MTEMS application from your Start menu or by running `<ITM_HOME>\InstallITM\kinconfg.exe`. Alternatively, if you have installed ITM, use the command `<ITM_HOME>\bin\tacmd stopAgent <type>`.

On UNIX systems, you can run MTEMS using the `<ITM_HOME>/bin/itmcmd manage` command. Alternatively, use the commands `<ITM_HOME>/bin/itmcmd agent stop <type>` and `<ITM_HOME>/bin/itmcmd server stop <TEMS name>`.

2. Ensure the DataPower Data Collector has stopped:
When the KD4Agent is stopped, it automatically signals for the DataPower Data Collector to be shutdown. If this does not occur or has been disabled by configuration changes, you may need to perform this step manually.

On Windows systems navigate to the `<ITM_HOME>\TMAITM6\KD4\bin` directory and run the `stopDC.bat` script to stop the DataPower Data Collector.

On Unix systems navigate to the `<ITM_HOME>/platform/d4/KD4/bin` directory and run the `./stopDC.sh` script to stop the DataPower Data Collector.

Installing

This maintenance package is applied directly to the Tivoli Enterprise Management Agent (TEMA). In addition, apply application support from this fix pack to the following ITM components:

• - Tivoli Enterprise Management Servers (TEMS), including any remote or failover TEMS configurations
• - Tivoli Enterprise Portal Server (TEPS)
• - Tivoli Enterprise Portal (TEP), including any locally installed desktop TEP clients

On Windows systems, extract the files from the archive and double-click WINDOWS\setup.exe. Follow the prompts to install the update.

On UNIX systems, extract the installer from the archive using the tar -xvf <filename.tar> command. Then, execute the installer using the ./install.sh command. Follow the prompts to install the update.

It is also possible to deploy this fix pack remotely using ITM TEMS depot and tacmd AddBundles command. For more information, please refer to the ITCAM for SOA v7.2.0.1 Installation Guide, available here:
http://www-01.ibm.com/support/knowledgecenter/SS3JRN_7.2.1/com.ibm.itcamfapps_soa.doc_7201/soa_install_guide/configremotedeploy.html?lang=en-us

Installing application support for TEPS/TEMS
For each monitoring agent installed, you must install agent-specific application support on IBM Tivoli Monitoring components. You can choose to install application support on all components at one time, or you can install the application support on components separately. If installing components separately, the following order is recommended:

1. Tivoli Enterprise Monitoring Server
2. Tivoli Enterprise Portal Server
3. Tivoli Enterprise Portal Desktop Client
4. Tivoli Enterprise Portal Server Browser client (for Linux and UNIX Only)

Performing the necessary tasks after installation

A successful installation modifies the D4 version to 7.2.0.1. Ensure that the Version of ITCAM for SOA in the MTEMS is '07.20.01.09'.

On Windows the installation logs are written to the following directory:
<ITM_HOME>\InstallITM\

On Unix the installation logs are written to the following directory:
<ITM_HOME>/logs/

If upgrading from 7.2.0.1 IF0004 or earlier:
After installing the TEPS support, SDMS and TCORE upgrades will be available.
1. Run <TEPS_HOME>/Products/KD4/latest/bin/ConfigDMS.[sh|bat]
2. Step through the wizard to upgrade the SDMS, TCORE or both - depending on what your environment has installed.
3. After the upgrade completes, stop TEPS.
4. Go to the following directory: <TEPS_HOME>/Products/KD4/latest/tcore/j2ee
  From this dir, run: <EWAS_HOME>/bin/ws_ant.[sh|bat]
5. Start TEPS

If upgrading from 7.2.0.1 IF0006 or earlier:
After installing the D4 Agent, WebSphere Application Server DC Updates will be available.
1. Run <SOA_HOME>/KD4/bin/ConfigDC.[sh|bat]
2. Step through the wizard to upgrade the IBM WebSphere Application Server
3. Run the following command: <DC_HOME>/7.2.0.0.12/bin/migrate.[sh|bat] using these instructions: Migrating data collectors to ITCAM Data Collector for WebSphere
4. Restart WAS

where
<EWAS_HOME> is
<ITM_HOME>\CNPSJ on Windows
<ITM_HOME>/<platform>/iw on Unix

<SOA_HOME> is
<ITM_HOME>\TMAITM6 on Windows
<ITM_HOME>/<platform>/d4 on Unix

<DC_HOME> is
<ITM_HOME>\TMAITM6\wasdc on Windows
<ITM_HOME>/<platform>/yn/wasdc on Unix

<TEPS_HOME> is
<ITM_HOME>\CNPS on Windows or
<ITM_HOME>/<platform>/cq on Unix

<ITM_HOME> is by default:
C:\IBM\ITM on Windows or
/opt/IBM/ITM on Unix

Troubleshooting installation problems from the Support site

For more detailed information, refer to the Installation and Configuration Guide:
http://www-01.ibm.com/support/knowledgecenter/SS3JRN_7.2.1/com.ibm.itcamfapps_soa.doc_7201/soa_troubleshooting_guide/problemsinstall.html?lang=en

Uninstalling if necessary

This maintenance package cannot be rolled back. If necessary you can uninstall and reinstall the product and all appropriate patches.

For detailed Windows instructions, please refer to the ITCAM for SOA guide, here:
http://www-01.ibm.com/support/knowledgecenter/SS3JRN_7.2.1/com.ibm.itcamfapps_soa.doc_7201/soa_install_guide/uninstall.html?lang=en
For detailed Linux and UNIX instructions, please refer to the ITCAM for SOA guide, here:
http://www-01.ibm.com/support/knowledgecenter/SS3JRN_7.2.1/com.ibm.itcamfapps_soa.doc_7201/soa_install_guide/uninstallunix.html?lang=en

The Secure Hash Algorithm 1 (SHA1) checksum of the images are as follows:
SHA1(7.2.0.1-TIV-ITCAMSOA-AIX-IF0009.tar)= c4c28ec0ced9bbceeab36a6d5287d1374b01d58c
SHA1(7.2.0.1-TIV-ITCAMSOA-LinuxX64-IF0009.tar)= 2abb8c15b743f2b3ff2c2068437dc4968dcc688f
SHA1(7.2.0.1-TIV-ITCAMSOA-LinuxX86-IF0009.tar)= 96968b66ef8331500cd7c1b0b8f2a961e7e836a6
SHA1(7.2.0.1-TIV-ITCAMSOA-pLinux-IF0009.tar)= 04ee0824140475e1d8f1e2ba968566865bee254e
SHA1(7.2.0.1-TIV-ITCAMSOA-Solaris-IF0009.tar)= a8f5796fabc99a6891aac1975cff0a3ec9b019c8
SHA1(7.2.0.1-TIV-ITCAMSOA-Windows-IF0009.zip)= 32d0ee26030086d518d3a3a3120805f36fdf700f
SHA1(7.2.0.1-TIV-ITCAMSOA-zLinux-IF0009.tar)= 2ae3808dea8a0db5a60f0cd5d655da5e65db8f33

The ITM kd4agent logs show that the Build ID of this interim fix is: 201604060254

New Features

The following new features are included in ITCAM for SOA 7.2.0.1 Interim Fix 9:

• Flash (Alert) - SOA/KD4 Tivoli Enterprise Portal (TEP) client jar file certificates expire 17th April 2016

• Security Fixes - Security Bulletin: Multiple vulnerabilities in IBM Java Runtime (Jan 2016) - (CVE-2016-0466, CVE-2015-7575)

• Security Fixes - Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA (October 2015: CVE-2015-4872, CVE-2015-4911, CVE-2015-5006)
• Security Fixes - Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA (July 2015: CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)
• RFE 54937 - Longer Fault_String_U field in Fault_Log_610 - A longer fault string column has been added (1024 bytes, up from 256). To view the the new column, you must modify your queries and workspaces.
  1. Go to the Faults Summary workspace
  2. Right click the Fault Details table
  3. Click Properties (by default it will show the Faults Details_710 query)
  4. Click "Click here to assign a query"
  5. Left click the Faults Details_710 (or other faults query)
  6. Click the "Create Another Query" button
  7. Enter a name for the new query (e.g. Faults Details Long_710)
  8. Click Add Attributes...
  9. Click the Attribute Item name Fault String (Long) (Unicode)
  10. Click OK several times, until you return to the workspace
  11. Save the workspace, optionally making it the new default
• FIPS 140-2 Compliance - A change was made to force the DataPower Data Collector and DLA scripts to use FIPS 140-2 encryption providers (IBMJCEFIPS). To use this provider:
  1. Modify your Java Runtime Environment to include the IBMJCEFIPS provider
  - Find the java.security file in your JRE, usually this will be in C:\IBM\ITM\TMAITM6\KD4\ibmjava\jre\lib\security or /opt/IBM/ITM/<arch>/d4/KD4/ibmjava/jre/lib/security
  - Edit java.security
  - Find the "security.provider." list
  - Add "security.provider.1=com.ibm.crypto.fips.provider.IBMJCEFIPS"
  - Renumber the other "security.provider" lines to be in sequence
  2. Set the environment variable "useFIPS" before running the DC or DLA -- OR edit the start script to set the Java command line option "-DuseFIPS" . The value of the variable is not important.
  

• RHEL 7 Support

• Security Fixes - Security Bulletin: Multiple vulnerabilities in IBM Java Runtime (April 2015)
• Security Fixes - Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Composite Application Manager for SOA (CVE-2015-4000)

• Security Fixes - Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Composite Application Manager for SOA (CVE-2015-0138, CVE-2014-6593, CVE-2015-0410)
• Security Fixes - Security Bulletin: Vulnerability in RC4 stream cipher affects Tivoli Composite Application Manager for SOA (CVE-2015-2808)

A) APAR Content:

IV79901 Data Power Data Collector Configuration may hang
IV81540 SCRIPT MAKE_DB2_DB.BAT HANGS ON SOME WINDOWS SERVERS
IV82717 SOA's TEP JARs are about to expire

From superseded fixes:

IV25260 SOA PART OF FIX TO WORK WITH MQ'S APAR FIX IV17182
IV30745 WSN(SOA WEBSERVICES NAVIGATOR) SHOWS VERY LONG RESPONSE TIME.
IV35767 KD4MAKEDB2DB.BAT/.SH EXPECTS WARNING
IV38410 SOA 7.1.1 DC UNINSTALLS THE (KTJ 7.3) .NETDC ASSEMBLY DLLS
IV54179 SOA CRASH.
IV59255 SOA DATA POWER DATA COLLECTOR (DP DC) MEMORY LEAK
IV59369 MEMORY MANAGEMENT ISSUE ON THE SOA AGENT (Services_Message_Metrics_610 historical data collection table (KD42MT) corruption)
IV60755 SOA DC 7.2 PACKAGING ISSUE ON ZLINUX (and PPC Linux)
IV67077 ITMRYEVENT AND ITMMEDIATIONFLOWPRIMITIVE OBJECTS CAUSE OOM
IV69659 UNABLE TO REMOTE DEPLOY D4 AGENT ON UNIX DUE TO INCORRECT VERSION INFORMATION IN DESCRIPTOR
IV70676 purgeArchive() crash on purgeArchive() -> strlen(pCurrDirEntry.getFilename())
IV71288 JAVA JANUARY 2015 UPDATE AND FREAK (Java6 APAR IV70681)
IV72076 ABEND - D4 agent need signal handling for Solaris
IV72286 RC4 'BAR MITZVAH' ATTACK FOR SSL/TLS (Java6 APAR IV71888)
IV73049 JAVA APRIL 2015 UPDATE (Java6 APAR's IV70681, IV71888, IV72245, IV72348 and IV72352)
IV73474 WSRR instancePrefix missing from getPolicyBsrURI query
IV73873 TCORE ships DB2 JDBC driver that leaks memory
IV74202 LogJam Vulnerability (Java6 APAR IV73934)
IV74648 LONG PARSING TIME FOR METRIC LOGS
IV75664 EXCEPTION - D4 SOA DC v7.2.0.1 excessive exception for WAS BPM systemOut.log
IV75852 Data Power Data Collector may stop communicating with Data Power Appliance
IV76003 ITCAM FOR SOA KD4AGENT CAN FAIL TO REPORT ALL DATAPOWER FAULTS TO THE FAULT LOG TABLE
IV76080 ITCAM for SOA DataPower DataCollector may not connect if DataPower is initially unavailable
IV76666 Data Power Data Collector may hang upon shutdown
IV77035 BPM topology with Import-Operation-to-Export links hides nodes and links
IV78803 Unable to view SOA topology workspaces with Oracle Java JRE
IV79160 KD4 Agent does not truncate UTF8 characters properly
IV79246 Java October 2015 Update
IV79248 Java July 2015 Update
IV79263 Data Power Data Collector may hang whilst updating configuration
IV80997 Java January 2016 Update (+ SLOTH) (Java6 APAR's IV80583 and IV80331)

B) Additional Non APAR Defects:

96507 Fix kd4agent valgrind memcheck errors

From superseded fixes:

74973 Datapower DC does not log that subscription failed into log files
78782 Updates to required keep FIPS 140-2 compliance
79863 Logging typo in method name postAndReadResponse()
87146 Installing 7.2.0.1-IF0005 does not update "live" SDMS/TCORE files (DB2 driver leak)

C) Enhancements

None

From superseded fixes:

Support for Oracle Java 7 u51
Support for WSRR 8.5