Troubleshooting › CA CSM Fails to Start with SAF Security Enabled

CA CSM Fails to Start with SAF Security Enabled

Symptom:

CA CSM fails with SAF security enabled. SafError with RC=13 or RC=15 is displayed in the job log. The log displays error messages similar to the following example:

FATAL (main) 2012-06-13 14:12:37,056 (SafManagerImpl.java:434):SafManager-initialize
DSI():Return code from DDSI_java_open is higher than zero.RC=13
FATAL (main) 2012-06-13 14:12:37,067 (SystemManager.java:491): com.ca.mf20.zos.services.saf.errors.SafError: null

Additional Diagnostic Data:
Error during DSI java open. RC=13
Path to 'dsi.conf': /u/users/msmr51/msmruntime/dsi/dsi.conf
BEGINNING OF 'dsi.conf’:
This is the DSI Server component configuration file
host localhost
port 22130
TLSKeyringFile /u/users/msmdev/dsi/cert/CA_SelfSigned_Server.kdb
TLSKeyringStash /u/users/msmdev/dsi/cert/CA_SelfSigned_Server.sth
TLSKeyLabel "Cert for SelfSigned Server"
TLSVerifyClient ON
END OF 'dsi.conf'

DSI parameters from table USERCONFIG in database:
Required parameters are marked with (*):
KEY:            DEFAULT_VALUE:  VALUE
*dsiPort:       22130:          22130
*dsiHost:       localhost:      localhost
*dsiConf:       N/A:            /u/users/msmr51/msmruntime/dsi/dsi.conf
>dsiKdb:        N/A:            Uninitialized
>dsiSth:        N/A:            Uninitialized
>dsiLabel:      N/A:            Uninitialized
>dsiVerPeer:    N/A:            false

Solution:

Take the following steps as necessary:

• Verify whether the localhost entry is defined in your DNS. Issue the following USS command:

  oping localhost
  

  If the command returns the error message (EZZ3111I Unknown host 'localhost'), the localhost entry is not defined. In this case, perform one of the following actions:

  • Ask your network administrator to define the localhost entry in your DNS.
  • In the USERCONFIG database table and in dsi.conf, set the dsiHost entry to 127.0.0.1.
• Verify whether the host and the port parameters in the dsi.conf file are the same as dsiHost and dsiPort parameters in the USERCONFIG database table. If the host/dsiHost and port/dsiPort parameters differ, update either the dsi.conf file or the database entries. The content of the dsi.conf file, the CA DSI Server parameters in the USERCONFIG database table, and the path to the dsi.conf file are displayed in the error message.
• Verify whether the CA DSI Server port (port/dsiPort) is free. Issue the following USS command:

  onetstat -P port_number
  

  For example:

  onetstat -P 22130
  

  If the command returns an empty table, the port is free.

• Verify whether the CA DSI Server port is reserved for CA CSM. Issue the following USS command:

  onetstat -o
  

  The command displays the list of reserved ports. If the CA DSI Server port is not listed, we recommend that you reserve the CA DSI Server port.