Voice Operating Systems Hot Issues from Cisco TAC

CSA rules are blocking SYN packet to be sent out, Fixed CSCtr40268

Symptom: AXL responses on CUCM are very slow compared to previous version Delayed TCP SYN ACK will also cause SSH and web sessions to the CUCM to be delayed by 3 seconds.
Conditions: CSA is blocking the SYN ACK packet to be sent out from CUCM to the AXL provisioning system causing it to resend it again and introducing a delay of seconds. Problem also occurs when Network Redundancy is enabled. Problem is UCM 7.1.x specific. UCM 8.x should not see the same. Also seen on CUCM running Network Fault Tolerance.
Workaround: 1) Disabling CSA on the publisher 2) Upgrade to a 7.1.5 ES which contain this fix 3) Disabling Network Fault Tolerance NOTE: Disabling CSA or Disabling Network Fault Tolerance is an option, you do not need to do both.

show version inactive give blank version on sub, Fixed CSCtq83570

Symptom: show version inactive displays blank value, switch version fails on sub
Conditions: Pub and Sub (7825-i3 & 7816-i3) were successfully upgraded from 7.1.3.10000-11 to 8.6.1.10000-43. Both are switched back to 7.1.3 succesfuly. After the pub is switched back to 8.6.1, the sub shows a blank inactive version and fails to switch back to 8.6.1.
Workaround: Using the Recovery CD both versions are displayed and the sub can be switched to 8.6.1

COP file is using wrong source file Causing HW recognition issues, Fixed CSCts62097

Symptom: When upgrading from 7.1.3 to 8.6.1 using the refresh upgrade file: "ciscocm.refresh_upgrade_v1.0.cop.sgn" on an MCS server that has a newer HW such as 7845I3 or 7845H4 this causes "show hardware" command returns all fields with UNKNOWN also And when running admin:show environment fans We get: Executed command unsuccessfully Detecting Server Hardware - this can take several minutes ./shared_implementation.sh: line 645: _runtime: command not found ./shared_implementation.sh: line 645: _runtime: command not found ./shared_implementation.sh: line 384: _runtime: command not found dirname: too few arguments Try `dirname --help' for more information. ./shared_implementation.sh: line 88: _runtime: command not found dirname: too few arguments Try `dirname --help' for more information. ../../server_implementation/IBM/x3650M2/7845I3/shared/bin/api_implementation.sh: line 55: _runtime: command not found
Conditions: 7845I3 or 7845H4
Workaround: do a fresh 8.6.1 install to avoid using ""ciscocm.refresh_upgrade_v1.0.cop.sgn"

Upload of Customized Logon Banner fails, Open CSCtg91018

Symptom: Error message when trying to upload customized logon message file to UCM and/or Unity Connection Administration interfaces. Symptom: This issue may occur in Unity Connection and Unified Communications Manager 8.5.
Workaround: None
Further problem information: Steps to recreate: - in OS Admin page (cmplatform), go to Software Upgrades | Customized Logon Message - click the browse button, then find the .txt file that contains the customized text - click the Upload file button and observe these error messages: "The file /usr/local/platform/conf/cli//loginWarning.txt could not be uploaded. Failure in uploading the login warning message."

Services deactivated after Refresh Upgrade to 8.6.2, Fixed CSCtw94724

Symptom: Select "do not switch version after upgrade", switch version later and all services are deactivated
Conditions: Performing a refresh upgrade to CUCM 8.6.2
Workaround: Manually activate services

3 Second delay in TCP SYN ACK response packet from a CUCM MCS-7835-H2, CSCtx49111

Symptom: Cisco IP Phone 9951 sends a TCP SYN request to Call Manager for a HTTP get for Corporate Directory. The Call Manager SYN ACK response is observed in packet capture from the Call manager, however the SYN ACK never gets sent to the phone. The 9951 phone sends another SYN request after 3 seconds and the Call Manager responds to this SYN ACK for the second time and the Phone receives this SYN ACK. 3 Second slow response seen on all phone types, as well as SSH and web sessions to the CUCM.
Conditions: With Network Fault Tolerance enabled. CUCM command " set network failover enable" CUCM TCP SYN ACK will have 3 second delay in response to the phone TCP SYN request. Phone types 89XX and 99XX series phones. 3 Second slow response also observed via HTTP to CUCM administration page and SSH to the server. Server Hardware: MCS-7835-H2 NIC Driver observed: Broadcom NetXtreme II Gigabit Ethernet Driver bnx2 v1.6.9 (December 8, 2007) bond0: Broadcom NetXtreme II BCM5708 1000Base-T (B2) PCI-X 64-bit 133MHz
Workaround: Disable Network Fault Tolerance. CUCM Command "set network failover disable"

CM 8.6.2 Upgrade Failing Due to NTP Reachability, Fixed CSCtt18005

Symptom: During upgrade to CM version 8.6.2, we observe the following error with respect to NTP reachability: 09/27/2011 19:37:01 ntp_one_shot.sh|NTP servers list: 10.127.0.1 10.227.0.1 10.127.0.54| 09/27/2011 19:37:01 ntp_one_shot.sh|ntpdate query response: 27 Sep 19:37:01 ntpdate[26740]: no servers can be used, exiting (rc=1).| 09/27/2011 19:37:01 ntp_one_shot.sh|File:/usr/local/bin/base_scripts/ntp_one_shot.sh:286, Function: ntpdateError(), NTP server 10.127.0.1 did not reply as expected. 'ntpdate -q' failed (ntpdate rc=1).| 09/27/2011 19:37:01 ntp_one_shot.sh|File:/usr/local/bin/base_scripts/ntp_one_shot.sh:574, Function: setTime(), None of the external NTP servers (10.127.0.1 10.227.0.1 10.127.0.54) responded.| 09/27/2011 19:37:01 InstallWizard|runScriptPassive: 512 = system("/usr/local/bin/base_scripts/ntp_one_shot.sh")|
Conditions: Perform upgrade to CM 8.6.2.10000-30 while NTP references are defined and unreachable.
Workaround: Remove configured NTP references before performing 8.6.2 upgrade attempt.

OS Admin Cert Web Page displays serial numbers in decimal instead of hex, Open CSCtr75672

Symptom: OS Administration Certificate Management web page displays certificate serial numbers in decimal instead of the commonly accepted hex.
Conditions: CUCM 8.6
Workaround: Convert the decimal to hex using calc.

CUCM 8.5.1 (SU3) 7835/45-I2 IBM Raid driver reverts back during L2, Fixed CSCtx25915

Symptom: File system goes read only after L2 upgrade to CUCM 8.5.1(SU3) from 8.5.1(SU1/2) with the cop file installed as the IBM raid driver resets back to 1.1.5-2455. IBM Raid driver rpm for aacraid version 1.1.5-24702 is installed but not loaded. when ssh into server we see the following message: java.io.FileNotFoundException: /var/log/active/platform/log/cli.bin (Read-only file system) at java.io.RandomAccessFile.open(Native Method) at java.io.RandomAccessFile.(RandomAccessFile.java:212)
Conditions: Occurs only on 7835/45-I2 class of servers and only after they've been L2 upgrade to CUCM 8.5.1(SU3) release from 8.5.1(SU1/2) with the COP file installed. This does not apply if there is fresh install.
Workaround: A workaround to the bug can be applied by TAC using root account. However, Rebuild of the server is a permanent solution to read-only problem. Use of the file system repair on the recovery disc does not guarantee a fully functioning system. Even if the server is recovered into an operable state, full functionality of all features and services cannot be guaranteed. Cisco strongly recommends a server rebuild if the file system has become corrupted to ensure full functionality.

All-LANG: CUCM: not able to install Phone Only locales with CUCM 8.5, Fixed CSCtl54197

Symptom: not able to install Phone Only locale with CUCM 8.5
Conditions: CUCM 8.5 PO LI 9.1.1 for fw 9.1.1
Workaround: None

L2 upgrade 8.6.1.10000-26->8.6.1.10000-43 fails when locales installed, Open CSCtq97369

Symptom: L2 upgrade 8.6.1.10000-26->8.6.1.10000-43 fails when locales installed
Conditions:
Workaround: Uninstall the locale, and restart the upgrade.

Cucm 8.5.1 install fails with a timer expiry, Fixed CSCtr94061

Symptom: Install 8.5.1 on Mcs 7828-i5 see error during install Problem Details: Installation Error loading from DVD: The installation has encountered a unrecoverable internal error. For further assistance report the following information to your support provider. "/usr/local/cm/script/ccmhelp_post.sh install PostInstall 8.5.1.11900-21 8.5.1.11900-21 /usr/local/cm/ /usr/local/cm/ /common/log/install/capture.txt " terminated. Exceeded max time (240)
Conditions: Installing cucm 8.5.1 on mcs7828-i5
Workaround: Install 8.6.1 instead

Components such as "show network" on OS locked wrong when restore, Fixed CSCtk17682

Symptom: Components in the OS Administration Webpage, such as "show network" shows the following error message: "The system is currently locked by another process. Please try again later."
Conditions: Issue occurs after running a DRS restore or backup
Workaround: None

CUCM 8.6. Tomcat CSR does not get alternate hostname information from se, Fixed CSCts83446

Symptom: CUCM 8.6. Tomcat CSR does not get alternate hostname information from set web-security command When creating an alternate hostname for CUCM 8.6 using the set web-security command, the CSR does not contain the alternate hostname.
Conditions: Only occurs when using CUCM 8.6 versions. Works fine on 8,5 and earlier
Workaround: None

RTMT logrotate: ALERT exited abnormally with [1] on mgetty logs, Fixed CSCso55764

Symptom: Syslog shows the following error from logrotate: ALERT exited abnormally with [1]
Conditions: When logrotate tries to rotate logs of mgetty.
Workaround: N/A
Further Problem Description:

Unexplained reboot during Fresh Install on 7835/45-I3 causing failure, Terminated CSCts38983

Symptom: Fresh install fails after an unexplained reboot during post boot install phase.
Conditions: If a 7835/45-I3 server is installed with a CUCM 8.6.2 or later build that enabled OS Watchdog, then if same server is re-installed with an older build that does not support OS Watchdog, this will cause install to fail with a reboot during post boot install phase.
Workaround: If user wants to reuse a server that had CUCM 8.6.2 or later installed, to fresh install a build older than 8.6.2 (that did not have OS Watchdog timer support), then they first need to disable the IMM OS Watchdog timer setting. This is same as doing bare metal on server before re-purposing. Steps to disable IMM watchdog timer are: 1. login into IMM web 2. goto settings from left hand column 3. change OS Watchdog timer to 0 mins 4. save settings 5. start fresh install

RTMT throws VMWareTools.log permission error when downloading logs, Fixed CSCto80824

Symptom: When a customer tries to collect install logs from RTMT, upgradeVMwareTools.log file cannot be downloaded due to permissions issues - the file is owned by root. As a result, the customer is presented with a screenshot saying "Operation failed due to permission issue". However, all other relevant log files with the right permissions are downloaded correctly.
Conditions: N/A
Workaround: The workaround is to click "Close" when presented with the option to do so. Doing so allows the customer to download that log file with the right permissions. To prevent further occurrences one must go in and remove the file via a remote support account.

Subject Alternate Hostname does not work for CUCM 8.6, Fixed CSCtw93269

Symptom: CUCM 8.6. Unable to access the webpages via the alternate hostname that you set in the set web-security command. The CSR will contain the alternate hostname and when you get the CSR signed, the cert will contain the alternate hostname but it still does not work. You will still receive the security warnings when accessing the CCM webpages via the alternate hostname.
Conditions: Only occurs when using CUCM 8.6 versions. Works fine on 8,5 and earlier
Workaround: None

Refresh Upgrade Enhancements for 8.5(1), Open CSCto45041

Symptom: Code enhancements to allow upgrades to CUCM 8.6(1)
Conditions: Only applicable when upgrading to 8.6(1) or higher versions of CUCM
Workaround: N/A

CUCMBE Cluster Manager Communications and Iptables Broken with CUPS, Fixed CSCto74166

Symptom: Cisco Unified Presence Network Time Protocol (NTP) not syncing with the communications manager. Other symptoms could include exchange calendaring not occurring at the correct time in unified presence. . On Communications Manager Business Edition in the output of "utils firewall ipv4 list" you will also not see the Cisco Unified Presence server as allowing connections. Therefore, connections from Cisco Unified Presence that does not occur on the standard SIP Port (5060) can also be blocked
Conditions: Communications Manager Business Edition 8.5.1 with Cisco Unified Presence
Workaround: Contact Cisco TAC and provide remote access. If remote access is not available then no workaround is possible. Upgrade to a version that includes the fix for this issue.

Lack of /spare partition prevents Upgrade to CUCM 8.6, Fixed CSCtt38350

Symptom: Upgrade to CUCM 8.6 fails after the Refresh Upgrade starts
Conditions: If a MCS server has been initially fresh installed with 5.X where the /spare partition was not created, this server could have been upgraded over the years to CUCM 7.X all the way up to 8.5(X) where the /spare partition was not a requirement to upgrade to the next version. This /spare partition was created to improve CTI Manager performance by offloading its tracing to this new partition. See CUCM 7.0(1) OS Admin Guide http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/cucos/7_0_1/cucos/os_701_cm.html for more details. The Refresh Upgrade failure will occur after the server being upgraded reboots to proceed the Refresh Upgrade. The server's console will display en error message waiting for a response that indicates; "Requested Partition Does not Exist" "Unable to locate partition cciss/c0d0p6 to use for /spare. Press 'OK' to reboot your system"
Workaround: There is no quick workaround for this issue. The only way to successfully complete the upgrade is to rebuilt this server using a CUCM 6.0(1)+ version so the /spare partition is created followed by DRS Restore and then Refresh Upgrade to CUCM 8.6 Version.

CUCM upgrade hangs on UCS during inactive master RPM deletion, Fixed CSCtu33310

Symptom: Upgrade from 8.6.2.10000-30 to 8.6.2.20000-2 hangs with no errors; have to cancel the upgrade. Last activity in the installation log before its stuck: 10/17/2011 09:44:23 upgrade_manager.sh|Cleanup data from a prior upgrade attempt| 10/17/2011 09:44:23 upgrade_manager.sh|Removing any /grub/boot/grub/grub.conf.recovery| 10/17/2011 09:44:23 upgrade_manager.sh|Invalidate upgrade partition| 10/17/2011 09:44:23 upgrade_manager.sh|Removing any master RPM from /partB| ..... ( hang) ..... 10/18/2011 15:14:34 upgrade_manager.sh|Got SIGTERM, exiting| 10/18/2011 15:14:34 upgrade_manager.sh|Exit processing with result 1| 10/18/2011 15:14:34 upgrade_manager.sh|Cleanup RAM disk|
Conditions: Upgrade from 8.6.2.10000-30 to 8.6.2.20000-2 UCS-C200 ESXI 4.1
Workaround: Contact Cisco TAC

CUCM Admin password reset gives false negative after unsuccessful reset, Fixed CSCtd17258

Symptom: Receive error "Error: the password has NOT been reset." when providing an valid password to the admin password recovery tool
Conditions: Using the OS admin password recovery procedure where at some point previously on this system an invalid password has been previously entered during the password recovery procedure (either because the provided password was too short, was based on a dictionary word, or because the two passwords typed didn't match)
Workaround: Ignore the "Error: the password has NOT been reset." status message and press Ctrl-C to end the password recovery session. Even though that error was given, the new password just entered will work to successfully login to the OS admin.

DMA Uninstall does not report MSI failures correctly, Fixed CSCsv66362

Symptom: DMA uninstall completes, but when a user attempts to reinstall DMA they get a failure message indicating DMA is already installed.
Conditions: This happens anytime the DMA MSI package runs into an error. The error is not properly reported by the uninstall program. Typically, we see this error when users attempt to uninstall DMA over RDC (Remote Desktop Connection). Using terminal services is NOT supported by DMA, as documented in the User Guide. This causes an error during the uninstall.
Workaround: Run the following command: MsiExec.exe /X{7453B20A-8975-43B5-8749-FC4F6A3475C4} If this command still fails, you may need to download the MSI cleanup utility to cleanup DMA from the following link: http://download.microsoft.com/download/e/9/d/e9d80355-7ab4-45b8-80e8-983a48d5e1bd/msicuu2.exe
Further Problem Description:

CAPF Self-signed CUCM certificates don't include basic constraints ext., Open CSCtx42673

Symptom: The 'basic contraints' extension is not included on the Self-Signed CAPF certificates. That causes interoperability issues with other vendors when exporting the CAPF certificate. The RFCs 2459,3280 and later RFC 5280, specify that 'if the keyCertSign bit is asserted, the basic constraints extension MUST also be asserted.'
Conditions: Generate a new CAPF certificate under OS Administration GUI The generated certificate CAPF-xxxxxxxx.pem will not show Basic Constraints extension under X590v3 section " ... X509v3 extensions: X509v3 Key Usage: Digital Signature, Certificate Sign X509v3 Extended Key Usage: TLS Web Server Authentication, IPSec End System X509v3 Subject Key Identifier: ... "
Workaround: None

"utils import config" is failing, CSCtx55507

Symptom: getting an error when running " utils import config" admin:utils import config Cannot locate configuration file
Conditions: call manager is running on VMware
Workaround: set SELinux in permissive mode and try the command again. Disabling SELinux temporarily: echo 0 > /selinux/enforce To turn it back on you execute this command: echo 1 > /selinux/enforce

Absence of a single physical disk is preventing License Manager to start, Open CSCtd86222

Symptom: License Manager doesn't startup after rebooting a server.
Conditions: CUCM Server will prompt about a Hardware Configuration Failure if one of the drives from either logical drive arrays are missing. If the customer chooses to continue License Manager service will never startup. Lack of License Manager on the Publisher node prevents any administrative changes being performed like adding a new phone or deleting.
Workaround: Ensure all 4 drives are plugged in to the server even if they are failed/defunct drives.

IBM Servers logging unnecessary warning errors from cimserver, Open CSCti05776

Symptom: Harmless messages from cimserver are logged in to System Event Logs (messages)
Conditions: The following messages seen in the System Event Logs (messages) can be safely ignored Jul 24 03:08:22 lg-sub-1 daemon 4 cimserver[14290]: PGS10405: Failed to deliver an indication: PGS10800: CIMXMLINDICATIONHANDLER ERROR: CIM_ERR_FAILED: A GENERAL ERROR OCCURRED THAT IS NOT COVERED BY A MORE SPECIFIC ERROR CODE.: "Cannot load module (SMSConsumer:SMSConsumer): Unknown exception."
Workaround: None the messages are harmless and can be ignored.