Date: 03 July 2012
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6
triggered by use of db2ReadLog API in applications
3 July 2012
AusCERT Security Bulletin Summary
Product: IBM DB2
Operating System: AIX
Impact/Access: Access Confidential Data -- Existing Account
- --------------------------BEGIN INCLUDED TEXT--------------------
DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6 triggered by use of
db2ReadLog API in applications (common in replication solutions )
DB2 for Linux, UNIX and Windows
Advanced Enterprise Server, Enterprise Server, Workgroup Server
When using DB2 Version 9.7 Fix Pack 6, Memory is consumed quickly in the DB2
private memory when an application uses the db2readlog API to extract log
records (common in replication solutions). This leads to a severe memory leak.
On DB2 Version 9.7 Fix Pack 6, private memory usage grows quickly on the DB2
server ( db2sysc or db2syscs.exe process ) when applications are initiating log
read requests through the db2ReadLog API.
There may be a wide variety of symptoms such as;
out of instance memory,
system paging, hangs or failover.
An example of an application using the db2readlog api is IBM Infosphere
Replication Server (Data propagator). There maybe other IBM or 3rd party
'Log reader' type applications which also uses this API.
This problem was first introduced in DB2 Version 9.7 Fix Pack 6 (126.96.36.199)
To identify if you are hitting the issue:
Verify the DB2 Fixpack level by running the db2level command to ensure you
are on DB2 9.7 Fix Pack 6
Ensure that you are running an application that uses the db2readlog API to
extract the LOG records. Application snapshot returns the application name.
Example of applications using the db2readlog API are bg_realtime_server,
Example of Application name as seen in the application snapshot ouput:
Application name = ASNCAP.exe
If you notice the system memory usage grows quickly, perform the following
diagnosis to confirm you have encountered this issue:
Gather application snapshots and verify if "Other Memory" is high (i.e. >
10MB) and is continuing to grow,
Example entry as follows:
Memory Pool Type = Other Memory
Current size (bytes) = 719257600
High water mark (bytes) = 720764928
Configured size (bytes) = 8539602944
APAR IC84967 has been opened to address this issue.
There is no Local Fix to the issue.
A new DB2 Version 9.7 Fix Pack 6 image that addresses this issue is currently
being built, tested and will be uploaded on IBM Fix Central by Tuesday July
The new image will still be called 188.8.131.52. Customers that have already
downloaded DB2 Version 9.7 Fix Pack 6 will be able to upgrade to this new
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines
Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM
trademarks is available on the Web at "Copyright and trademark information" at
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to firstname.lastname@example.org
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----