|
Problem IT11108
|
Status: Closed |
RESTORE DB WITH ENCROPTS "SHOW MASTER KEY DETAILS" ON NON-ENCRYPTED IMAGE CAUSES UNEXPECTED RESTORE TO COMPLETE |
| product: |
DB2 FOR LUW / DB2FORLUW / A50 - DB2 |
| Problem description: |
The DB2 Native Encryption feature allows user to dump out the
master key information of an encrypted backup image by running
RESTORE DATABASE command with ENCROPTS 'SHOW MASTER KEY
DETAILS'. This doesn't restore any data but simply dumps out the
encryption information.
When this option is mistakenly provided for a non-encrypted
backup image, the option is ignored and a complete restore is
performed.
Example error scenario:
1. Take a non-encrypted backup image
> db2 backup db sample
2. Attempt to get master key information using RESTORE DB
command with ENCROPTS
> db2 "restore db sample encropts 'show master key details'"
SQL2539W The specified name of the backup image to restore is
the same as the
name of the target database. Restoring to an existing database
that is the
same as the backup image database will cause the current
database to be
overwritten by the backup version.
Do you want to continue ? (y/n) y
DB20000I The RESTORE DATABASE command completed successfully.
3. The database is restored unexpectedly. This can be confirmed
with the following db2diag.log messages:
2015-08-28-14.26.08.218391-240 E970305E1387 LEVEL: Info
PID : 19261 TID : 46913076324672 PROC :
db2sysc
INSTANCE: tester NODE : 000 DB : SAMPLE
APPHDL : 0-15 APPID: *LOCAL.tester.150828182605
AUTHID : TESTER HOSTNAME: host1
EDUID : 243 EDUNAME: db2agent (SAMPLE)
FUNCTION: DB2 UDB, database utilities, sqluxLogDataStats,
probe:395
MESSAGE : Performance statistics
DATA #1 : String, 884 bytes
Parallelism = 2
Number of buffers = 2
Buffer size = 16781312 (4097 4kB pages)
BM# Total I/O MsgQ WaitQ Buffers kBytes
--- -------- -------- -------- -------- --------
--------
000 2.76 1.43 0.05 1.11 5
81940
001 2.63 1.30 0.04 1.29 5
65580
--- -------- -------- -------- -------- --------
--------
TOT 5.40 2.73 0.10 2.40 10
147520
MC# Total I/O MsgQ WaitQ Buffers kBytes
--- -------- -------- -------- -------- --------
--------
000 2.63 0.12 1.42 1.08 11
147524
--- -------- -------- -------- -------- --------
--------
TOT 2.63 0.12 1.42 1.08 11
147524
2015-08-28-14.26.08.218720-240 E971693E461 LEVEL: Info
PID : 19261 TID : 46913076324672 PROC :
db2sysc
INSTANCE: tester NODE : 000 DB : SAMPLE
APPHDL : 0-15 APPID: *LOCAL.tester.150828182605
AUTHID : TESTER HOSTNAME: host1
EDUID : 243 EDUNAME: db2agent (SAMPLE)
FUNCTION: DB2 UDB, database utilities, sqludrsa, probe:889
MESSAGE : Restore Complete.
4. There may be data loss in the database if the it is not
recoverable. For recoverable databases, the database or the
associated tablespaces will be put to rollforward-pending state. |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* Users of DB2 Native Encryption for backup image encryption. *
****************************************************************
* PROBLEM DESCRIPTION: *
* See Error Description *
****************************************************************
* RECOMMENDATION: *
* Upgrade to product DB2 UDB Version 10.5 fix pack 7. *
* Recover lost data using other DB2 recovery solutions *
* (RECOVER DB or ROLLFORWARD DB command). *
**************************************************************** |
| Local Fix: |
Use db2ckbkp tool with -H option to display the media header
information and verify the back image is encrypted before using
the 'SHOW MASTER KEY DETAILS' ENCROPTS.
If the database is recoverable, use the ROLLFORWARD DB command
to recover the loss data.
There's no fix for the non-recoverable databases unless there's
a newer backup image to restore the lost data. |
| Solution |
Problem was first fixed in DB2 UDB Version 10.5 fix pack 7. With
this change, users can no longer specify ENCROPTS/COMPROPTS for
images that don't use the compression/encryption framework. |
| Workaround |
Use db2ckbkp tool with -H option to display the media header
information and verify the back image is encrypted before using
the 'SHOW MASTER KEY DETAILS' ENCROPTS. |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 08.09.2015
20.01.2016
20.01.2016 |
| Problem solved at the following versions (IBM BugInfos) |
|
| Problem solved according to the fixlist(s) of the following version(s) |
| 10.5.0.7
|
 |
