Need some clarification on Article 36105

[LaneFrazier]

I have a 8.1 SP1 P3 to 8.3 upgrade pending. My environment is a combination of Intel A130 hardware and some VMware replica's.

In doing my "homework" for upgrade ran across article # 36105

"An upgrade to RSA Authentication Manager 8.3 Intel hardware failed and services failed to start" which would appear to have been a bad gotcha for someone....to the tune of having to do a factory reset....not the sorta of thing I wanted to be reading about as I'm getting ready to go through same process.  I also noticed that RSA Customer Support just recently updated the article Jan 18  last Friday

Evidently there is a hot fix that addressed the issue of a failure moving from 8.2 SP1 to 8.3 

To my knowledge I have never applied any hotfixes to my hardware systems so I was kind of expecting to not find the mentioned files

I ran the commands to check my system 

I had the /etc/init.d/snmpsa

not sure how or why I would unless this issue applied to a different model Intel based hardware

So I'm just verifying that I should be OK to go to do upgrades.

Thanks for taking the time to answer my question.

[JayGuillette]

Hey Lane,

Two options here, easy 1 first. Since this problem was tracked in Jira bug AM-31801, I checked, and the fix to prevent any problem is to patch to AM 8.2 SP1 Patch 6 first, before updating to AM 8.3, (primary 1st, then replicas one at a time).

But since this problem did not affect every hardware model, the KB has some steps to check if your hardware will have the problem. That was the last update to the article Jan 18  last Friday, a syntax clarification to the KB by Menna in our Cairo office clarify the best dmidecode command to ID the potential problem, which is a missing snmpsa executable -

See Cause in the KB. 

Basically if the vendor returned from dmidecode command is Intel AND the file called /etc/init.d/snamsa is NOT found, you need to patch to P6

To me it seems worth the extra step to put patch 6 on AM 8.2 SP1 before the update to AM 8.3, but if you are adventurous, you can check if you really need the patch.

[LaneFrazier]

Pardon my ignorance.

#1 I dont see a KB referenced in the article

#2 I see absolutely no reference to putting on 8.2 sp1 P6 before going to 8.3

All I see in the article is the way to check for the hot fix which I seem to have on but I don't know why I would since I have not patched since Aug 2015

Thus my question for clarification. I'm trying hard to not have any adventures with RSA Auth Mgr.

All I know is somehow this /etc/init.d/snmpsa file appears on my Intel A130 based system when I ran the command listed in the article

So now I'm more confused / concerned than ever now on what to do about it because having to do a factory reset in the middle of an "upgrade" is not my idea of a good time. Let's just say I don't like surprises

Thanks again

[JayGuillette]

The Hot fix mentioned in the article is included in Patch 6 for AM 8.2 SP1.  Sorry for the confusion about that.

Running the dmidecode to determine if you are an Intel, and searching for the file called /etc/init.d/snamsa are the two things you need to check to determine if you really need the hot fix/patch 6 before updating to AM 8.3.  But to be on the safe side, you could just apply patch 6.  That's what I meant to explain.

[LaneFrazier]

Hey Jay

I apologize in advance for kinda asking things over and over, I gotta get this right

I'm running 8.1 SP1 P3 and the end game for us is get to 8.3 SP1 patch 4 maybe patch 6

whenever I look out on RSA web sites...the upgrade process that is always mentioned and has to be followed for my situation is

8.1 SP1==>8.2==8.2 SP1==>8.3==>8.3 SP1==>8.3 SP1 P4 for example

so now I'm basically hearing if you have Intel Hardware the real path better be

8.1 SP1==>8.2==>8.2 SP1==>8.2 SP1 P6==>8.3==>8.3 SP1===>8.3 SP1 P4

So the questions I have is

Q1. So I checked my current 8.1 sp1 p3 system and I have /etc/init.d/snmpsa

So after getting to 8.2 SP1 I have to recheck all my Intel A130 appliances again  to make sure I have /etc/init.d/snmpsa ?....and if not put 8.2.SP1 patch 6 on...otherwise I'm gonna get burned on the next upgrade in the path

Q2. I still don't see the KB in the article nor do I see any mentioning of the Patch 6

Thanks again for your time

[LaneFrazier]

Hey Jay

I'm reading the 8.2 SP1 Patch 6 readme...if I'm reading it right  AM-31801 is not even mentioned.  the highest patch in that group ends at AM-31596  

[JayGuillette]

I don't blame you - measure twice, cut once!

My recommended patch plan for you would be the same whether hardware or VM, whatever, I prefer getting latest patch (e.g. the 4th digit, 8.1.1.3 for AM 8.1 SP1 P3) before updating a service pack or minor version (e.g. the 2nd and third digits - 8 is always first digit!).  It's more steps, but I think chance for success are a little better this way.

8.1 SP1 P3 ==> 81. SP1 P15 ==> 8.2 ==> 8.2 SP1 ==> 8.2 SP1 P8 ==> 8.3 ==> 8.3 ===> 8.3 P6

Remember, at each patch/update do Primary first, then replicas one at a time, you cannot get ahead on the primary or Replica will not catch up, you'll have to factory reset HW or delete VMs then deploy them again up to whatever Primary is at.

You theoretically could pause at any above version and continue patching at a later date, say stop after all replicas are caught up to 8.2 then on another weekend finish.

Also, if you have WebTiers, you will want to redeploy them to the latest applicable Web Tier version when you finish (or pause) your updates to the Primary and Replicas.

[JayGuillette]

AM-31875 and AM-31801 are covered by AM-32518, which is the root problem and is included in Patch 6 as fixed.  Sorry about that, I can get bogged down in the minutia of Bug management, which does not always get reflected in our readmes.

[LaneFrazier]

Sorry for all the back and forth I really have to get this correct. I cannot afford a ess up on thiss upgrade project

the above mentioned AM-32518 is actually in 8.3 patch 6...I thought we were talking about the root problem being fixed in 8.2 sp1 patch 6

So to be safe I'm going to put on 8.2 sp1 p6 after the 8.2==8.2 sp1 upgrade 

What no one has been able to answer for is this

I have a /etc/init.dsnmpsa file on my 8.1 sp1 P3 system now and I did not hotfix it there, but its there when I ran the ls-l command

[JayGuillette]

Yes, KB article 36105 is caused by missing /etc/init.d/snmpsa on Intel and was documented in Jira AM-31801 and is fixed in 8.2 SP1 P6 or later, even though AM-31801 is not mentioned in the ReadMe

Since the latest 8.2 SP1 Patch is patch 8, I recommended that, 8.2 SP1 P8

I made a mistake after we started discussing Not seeing AM-31801 in the readme, and referenced some other fixes for another upgrade problem, my bad.
I verified through our internal Jira bug database that AM-31801 is indeed fixed in 8.2 SP1 P6 or later, even though it is not documented. That happens. I should have stopped talking after that. The plan is solid,
8.1 SP1 P3 ==> 81. SP1 P15 ==> 8.2 ==> 8.2 SP1 ==> 8.2 SP1 P8 ==> 8.3 ==> 8.3 ===> 8.3 P6

My references to internal KBs and internal Jiras served more to confuse than illuminate the situation, sorry about that. But the best plan for your site is
8.1 SP1 P3 ==> 81. SP1 P15 ==> 8.2 ==> 8.2 SP1 ==> 8.2 SP1 P8 ==> 8.3 ==> 8.3 ===> 8.3 P6

And at each patch/update do Primary first, then replicas one at a time, you cannot get ahead on the primary or Replica will not catch up, you'll have to factory reset HW or delete VMs then deploy them again up to whatever Primary is at.