PATROL Agent: Problems starting the PATROL Agent, PatrolCLI and Patrol Console after AIX upgrade to 7.2 TL5 SP1

Manage Support IDs

Use checkboxes to 'Remove support IDs/Users' or 'Allow to create Cases'
Support IDs for BMC Customer Support Site Guest User
Profiles Which Include    Back to All Support IDs
 

Knowledge Article

PATROL Agent: Problems starting the PATROL Agent, PatrolCLI and Patrol Console after AIX upgrade to 7.2 TL5 SP1
PATROL Agent: Problems starting the PATROL Agent, PatrolCLI and Patrol Console after AIX upgrade to 7.2 TL5 SP1

Error :
PatrolAgent-E-EINTERNAL: Please change the configuration variable '/AgentSetup/defaultAccount'
with [x|w]pconfig or the developer console
NO work will be done until a valid account is specified
in the configuration variable '/AgentSetup/defaultAccount' (/local-build/Patrol/11.0.00/src/agent/startdbmsrv.c 3675)
PATROL Agent
PATROL Agent
PATROL Agent
These are the Problems seen with the Patrol Agent and Consoles after an AIX upgrade to 7.2 TL5 SP1

1. Error Message while starting the PATROL Agent:

NO work will be done until a valid account is specified 
in the configuration variable '/AgentSetup/defaultAccount' (/local-build/Patrol/11.0.00/src/agent/startdbmsrv.c 3675) 
[LOG]Waiting a maximum of 180 seconds for the PatrolAgent processes to start. 
gent/id_actions.c 796) 
PatrolAgent-E-EINTERNAL: Please change the configuration variable '/AgentSetup/defaultAccount' 
with [x|w]pconfig or the developer console 
NO work will be done until a valid account is specified 
in the configuration variable '/AgentSetup/defaultAccount' (/local-build/Patrol/11.0.00/src/agent/startdbmsrv.c 3675) 
[LOG]Waiting a maximum of 180 seconds for the PatrolAgent processes to start. 

2. In the Patrol Central Console (System Output Window) the following error is seen:

"Connection failed because the authentication credentials were rejected by the managed system.
Please configure impersonation database to fix the problem."

3. Starting the PatrolAgent in a putty ssh session results in this error: "setgroups: Not owner"

4. The PatrolCLI utility fails with this error:
$ PatrolCli 'user patrol i27k9s17PpCq' 'connect xxxx 12030 TCP' 'getvar /FILESYSTEM/opt/FSCapacity/value'
Can't connect to xxxx (TCP/12030) as patrol : <error>
Invalid Password
IBM's update: There was a change for Unix10 compliance made to setreuid, where after switching the effective UID away from root, the program is is not allowed to switch back to root. This is happening from both the trace and the truss.
IBM has released an official Patch. It is now available at: https://www.secure.ecurep.ibm.com/download/?id=WLLcUHtUQz1Yy1sUfG2LZuF31ac4DgirDQO6F3bDgzE

It contains:
IJ31049 - setreuid fix
IJ28828 - a potential security issue exists (gencore)
IJ28226 - a potential security issue exists (P9)

Remove any existing bos.mp64 ifix (dbg4906059, IJ28226s1a or IJ28828m1a):
emgr -r -L <label_from_above>

Then install the new ifix:
emgr -e  IJ31049m1a.210308.epkg.Z

Only a single reboot in the end is required. For any issues with this fix, please contact IBM support.
PATROL Agent
PATROL Agent
PATROL Agent
PATROL Agent
PATROL Agent
PATROL Agent
Attachment(s):