T10000 - Drives Fail to Get Encryption Keys, FSC3215

Asset ID:	1-72-1316902.1
Update Date:	2011-05-03
Keywords:

Solution Type Problem Resolution Sure

Solution 1316902.1 : T10000 - Drives Fail to Get Encryption Keys, FSC3215

Applies to:

Sun StorageTek T10000 Tape Drive - Version: Not Applicable and later   [Release: N/A and later ]
Sun StorageTek Crypto Key Management System - Version: Not Applicable and later    [Release: N/A and later]
Oracle Key Manager - Version: 2.0.0 and later    [Release: 2.0 and later]
Information in this document applies to any platform.

Symptoms

Drives fail to get encryption keys
FSC3215
KMS Audit log reported frequent KWK (Key Wrap Key) requests.
Drive was loosing it's key wrap public key.

Cause

ECPT trace
TX_WAIT 8 325b4366 LogToFile :
-4:AUDIT_CLIENT_GET_KWK_WRAPPING_KEY_SOAP_ERROR,Address=172.18.18.98
,Msg
= Soap
TX_WAIT 9 325b4367 LogToFile : 1001:error code
TX_WAIT 10 325b4368 ecpt_wait_read : Call KMSAgent returned returnVal =
207
DS_MAIN 11 325b536b hs_ecpt_build_detailed_status : KMS-err = 207 FSC = 3215
TX_WAIT 12 336331a4 ecpt_wait : msg=MEDIA_CMDS_DISABLED
KMS Audit log reported frequent KWK (Key Wrap Key) requests.
Get Agent KWK Public Key Success Success 000286000000 2011-04-12
14:07:13.440346+00 486-BK 172.18.18.175 No recommended action
A56495B434B168E500000000004821E9 A56495B434B168E5 BKKMSM1
Communication and Authentication Short Term Retention Certificate Verification
Success Success 000082000000 2011-04-12 14:07:13.408484+00 486-BK 172.18.18.175
Certificate Serial Number = 25339A5A51D650AA0000000000000016 No recommended

Solution

After reboot on drives this fixed the issue.
Recommendation upgrade drive firmware to 1.45.703 and KMS upgrade to 2.3.1.

NOTE:
Drive should only request a new KWK (Public Key Wrap Key) after drive has been rebooted or the KMA it connected to was rebooted since the last time drive requested keys from that KMA.

Attachments

This solution has no attachment