-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0637
           DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6
            triggered by use of db2ReadLog API in applications
                                3 July 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           IBM DB2
Publisher:         IBM
Operating System:  AIX
Impact/Access:     Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade

Original Bulletin: 
   http://www-01.ibm.com/support/docview.wss?uid=swg21600160

- --------------------------BEGIN INCLUDED TEXT--------------------

DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6 triggered by use of 
db2ReadLog API in applications (common in replication solutions )
Flash (Alert)

Document information
DB2 for Linux, UNIX and Windows

Software version:
9.7

Operating system(s):
AIX

Software edition:
Advanced Enterprise Server, Enterprise Server, Workgroup Server

Reference #:
1600160

Modified date:
2012-06-29

Abstract

When using DB2 Version 9.7 Fix Pack 6, Memory is consumed quickly in the DB2 
private memory when an application uses the db2readlog API to extract log 
records (common in replication solutions). This leads to a severe memory leak.

Content

On DB2 Version 9.7 Fix Pack 6, private memory usage grows quickly on the DB2 
server ( db2sysc or db2syscs.exe process ) when applications are initiating log 
read requests through the db2ReadLog API.

There may be a wide variety of symptoms such as;

    out of instance memory,
    STMM detuning,
    system paging, hangs or failover. 


An example of an application using the db2readlog api is IBM Infosphere 
Replication Server (Data propagator). There maybe other IBM or 3rd party 
'Log reader' type applications which also uses this API.

This problem was first introduced in DB2 Version 9.7 Fix Pack 6 (9.7.0.6)

To identify if you are hitting the issue:

    Verify the DB2 Fixpack level by running the db2level command to ensure you 
are on DB2 9.7 Fix Pack 6

    Ensure that you are running an application that uses the db2readlog API to 
    extract the LOG records. Application snapshot returns the application name. 
Example of applications using the db2readlog API are bg_realtime_server, 
asncap.

    Example of Application name as seen in the application snapshot ouput:
    Application name = ASNCAP.exe
    If you notice the system memory usage grows quickly, perform the following 
    diagnosis to confirm you have encountered this issue:

    Gather application snapshots and verify if "Other Memory" is high (i.e. > 
    10MB) and is continuing to grow,

    Example entry as follows:
    Memory Pool Type = Other Memory

    Current size (bytes) = 719257600
    High water mark (bytes) = 720764928
    Configured size (bytes) = 8539602944


APAR IC84967 has been opened to address this issue.

There is no Local Fix to the issue.

A new DB2 Version 9.7 Fix Pack 6 image that addresses this issue is currently 
being built, tested and will be uploaded on IBM Fix Central by Tuesday July 
3rd.

The new image will still be called 9.7.0.6. Customers that have already 
downloaded DB2 Version 9.7 Fix Pack 6 will be able to upgrade to this new 
level.

Related information

APAR IC84967

Copyright and trademark information

IBM, the IBM logo and ibm.com are trademarks of International Business Machines 
Corp., registered in many jurisdictions worldwide. Other product and service 
names might be trademarks of IBM or other companies. A current list of IBM 
trademarks is available on the Web at "Copyright and trademark information" at 
www.ibm.com/legal/copytrade.shtml.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT/JUe+4yVqjM2NGpAQL2Pw/+MurEMkuSES6y0Tz7LZ89zutNAsGgyxS9
lbBoHH1skWLHwDWHu5eIWRL7uPXscdhlAi/C6KYvdb13zHtzqMzqyAx8IXbu3QnJ
4XP9pcIcAIMFkoYZF+3o3BMNYEx31D9Mg7Kn8aRUJ1Ug1Qn4sZSPZNqUF20k1Bjr
nRFaqrq4xEA1TymRaqll+6iibQoUeBjSz0UGL5xDA437mbG8WfkHooN0HFnTwgKe
0F192osOlMKUfBPOEKvAdIaJCIHrPC0ki6aAKwMn1nfOFPMKkL0Im7rUzLr4G4qn
0/oTvq1PQPTfEJ4Gvon73nd8wPonWwrmYMMeiFFb2yO6hbVGnFij+CHherCseSUU
pf4qMH5T15SPwDyadvltSRornGwx3cevDTl5mbW9fwQj3eExbTfvv8fQnYvEn0Wr
j78BKKxqh0LLB6xPDm7dgvuUv3qulOWODAmoxb3kgHtYcu9simeyZ/KkuzlOuTDv
JPFbtl4oCdZxTaG2Au0XrY+fmCVrKcPXtM+eB7OhRgPfTH6O4FCkgZ8US0abLWkw
9tkcFi+DMrji2vK1IsOL0Uykot84Ckj1dGwrY+Tv1erw/QD+Pg5ChIHTrVSvNyZt
EpVYOg6iPescC2pY9qTO0lq8eVsnohnq42sutcotV96jZb5yyGH72Evnu58qkywk
rOKyO/1DIOI=
=5GcA
-----END PGP SIGNATURE-----