copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
Search this site

On this site

 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login


ESB-2012.0637 - [AIX] IBM DB2: Access confidential data - Existing account

Date: 03 July 2012

Click here for printable version
Click here for PGP verifiable version
Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

           DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6
            triggered by use of db2ReadLog API in applications
                                3 July 2012


        AusCERT Security Bulletin Summary

Product:           IBM DB2
Publisher:         IBM
Operating System:  AIX
Impact/Access:     Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade

Original Bulletin:

- --------------------------BEGIN INCLUDED TEXT--------------------

DB2 Private Memory leak in DB2 Version 9.7 Fix pack 6 triggered by use of 
db2ReadLog API in applications (common in replication solutions )
Flash (Alert)

Document information
DB2 for Linux, UNIX and Windows

Software version:

Operating system(s):

Software edition:
Advanced Enterprise Server, Enterprise Server, Workgroup Server

Reference #:

Modified date:


When using DB2 Version 9.7 Fix Pack 6, Memory is consumed quickly in the DB2 
private memory when an application uses the db2readlog API to extract log 
records (common in replication solutions). This leads to a severe memory leak.


On DB2 Version 9.7 Fix Pack 6, private memory usage grows quickly on the DB2 
server ( db2sysc or db2syscs.exe process ) when applications are initiating log 
read requests through the db2ReadLog API.

There may be a wide variety of symptoms such as;

    out of instance memory,
    STMM detuning,
    system paging, hangs or failover. 

An example of an application using the db2readlog api is IBM Infosphere 
Replication Server (Data propagator). There maybe other IBM or 3rd party 
'Log reader' type applications which also uses this API.

This problem was first introduced in DB2 Version 9.7 Fix Pack 6 (

To identify if you are hitting the issue:

    Verify the DB2 Fixpack level by running the db2level command to ensure you 
are on DB2 9.7 Fix Pack 6

    Ensure that you are running an application that uses the db2readlog API to 
    extract the LOG records. Application snapshot returns the application name. 
Example of applications using the db2readlog API are bg_realtime_server, 

    Example of Application name as seen in the application snapshot ouput:
    Application name = ASNCAP.exe
    If you notice the system memory usage grows quickly, perform the following 
    diagnosis to confirm you have encountered this issue:

    Gather application snapshots and verify if "Other Memory" is high (i.e. > 
    10MB) and is continuing to grow,

    Example entry as follows:
    Memory Pool Type = Other Memory

    Current size (bytes) = 719257600
    High water mark (bytes) = 720764928
    Configured size (bytes) = 8539602944

APAR IC84967 has been opened to address this issue.

There is no Local Fix to the issue.

A new DB2 Version 9.7 Fix Pack 6 image that addresses this issue is currently 
being built, tested and will be uploaded on IBM Fix Central by Tuesday July 

The new image will still be called Customers that have already 
downloaded DB2 Version 9.7 Fix Pack 6 will be able to upgrade to this new 

Related information

APAR IC84967

Copyright and trademark information

IBM, the IBM logo and are trademarks of International Business Machines 
Corp., registered in many jurisdictions worldwide. Other product and service 
names might be trademarks of IBM or other companies. A current list of IBM 
trademarks is available on the Web at "Copyright and trademark information" at

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email:
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.