none
Suddenly getting Can Not Allocate errors using HIS 2009 on XP, Win7 32-bit and Win7 64-bit RRS feed

  • Question

  • We have installed HIS 2009 with HotFix KB2297516 on XP and Windows 7 32-bit PCs and have been operating fine until just recently. We are now getting cmallc - CM_COMM_TIMEOUT errors when Allocating from XP and Win7 32-bit installations that used to work. (Note: HIS 2004 on XP will connect) See Event Messages:

    • Error returned from APPC that does not map to CPI-C error, 000004F0
    • APPC local conversation start failed:

    Primary_rc   = F004
       Secondary_rc = 010000F0
       TP_ID        = 0000000030599D00
       Dest TP name = E3E3D9D5
       LU alias     = TTIL104B
       PLU alias    = RTOTALDV
       Mode name    = 7BC9D5E3C5D94040
       FQ PLU name  = 

    • Failed to open pipe to service SNASRV02, rc = 53

    Any idea what is going on? We are desparate at this point.

    Friday, September 16, 2011 9:21 PM

Answers

  • If you configured the HIS Client to use alternate credentials, these would be stored under the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SnaBase\Parameters

    in the following registry parameters:

    UserName
    Password

    For the password parameter, the password is stored (if it is there) as a binary blob as the password is encrypted.

    If you are being authenticated with the logged on user credentials, it sound like the HIS Client is no configured to use alternate credentials.

    To configure a Host Integration Server 2009 client to use alternative credentials instead of user credentials that were used to log on, follow these steps:

    1.  Click Start, click All Programs, click Microsoft Host Integration Server 2009, and then click Configuration Tool.
    2.  Click Common Settings.
    3.  Click Advanced.
    4.  Click This Account under Use the credentials of.
    5.  Click the ellipsis button (…), and then type the user credentials that will be used to connect to Host Integration Server.
    6.  Click Close.
    7.  Click Apply Configuration, and then click Next to apply the changes.
    8.  Click Finish, and then exit the Host Integration Server Configuration Tool.

    In HIS 2009 and earlier, the specified password would not be encrypted and saved in the registry if the user account specified was from a non-trusted domain or workgroup. In these cases, you would be prompted for the password each time SnaBase started. THis was fixed in HIS 2009 Cumulative Update 1 (CU1) as described in the following article:

    2297516 FIX: You are prompted for a password every time that the SnaBase process starts when you try to connect to a server that is running Host Integration Server 2006 or Host Integration Server 2009 in a non-trusted Windows domain or workgroup
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;2297516

    HIS 2009 CU1 is available from the following article:

    2587090 Cumulative update package 1 for Host Integration Server 2009
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;2587090

    You might check to see if the HIS 2009 Client is still configured to use alternate credentials using the steps above.

    Thanks...

     


    Stephen Jackson - MSFT
    Tuesday, October 4, 2011 6:06 PM

All replies

  • The APPC error that you are seeing is:

    Primary Return Code = F004 (AP_COMM_SUBSYSTEM_NOT_LOADED)
    Secondary Return Code = 010000F0 (SNA Server specific error code)

    This error occurs when the HIS client does not find any active SNA Servers running in the HIS Server domain or subdomain. If there are HIS Servers running, then this can also indicate that the HIS client is unable to receive a "sponsor" connection to an HIS Server in the domain or is unable to connect to a SNA Server service.

    Since you mention the "failed to open pipe" message, it does seem to be that the problem is that the HIS Client is not able to connect to the secondary SNA Server service (SNASRV02) on your HIS 2009 Server. The other interesting thing is that you see the "rc = 53" which indicates "The network path was not found". 

    Without seeing traces, I suspect that the HIS Client is not able to establish a network connection to the HIS 2009 Server where the requested APPC LUs are defined or cannot connect to the SNASRV02 service over either TCP/IP sockets or Named Pipes.

    You can capture internal (all of the trace options on the Internal Trace tab) SnaBase and SNA Application traces using snatrace.exe on the HIS Client. YOu can open the traces using the Trace Viewer tool and then look for the sequence where the client (in the cliint1.atf trace) attempts to connect to the HIS Server. It would look something like the following when the connection works:

    Destination is REMOTE
    Using ltab 13B14C0, index 0 for connection
    Opening a connection to service 1 srvtyp =27
    Local 64, Remote 64
    Found common transport 0, type 64
    Trying transport 0, type 64
    Local address: 0.0.0.0:<TCP port>
    Trying to connect to: IP Address:1477
    connect() OK, handle = 568

    TCP Port will show the local dynamic TCP port number that was obtained for the HIS Client's source port. IP Address wil be the TCP/IP Address that was obtained for the HIS Server. 

    If the connection attempt fails, you will see a trace statement indicating a TCP/IP socket error such as 10060.

    The HIS Client will then try to connect to the Named Pipe that the SNASRV02 service is listening on as well. If that fails, you will get an error as well.

    Hope this helps.

     

     

     


    Stephen Jackson - MSFT
    Monday, September 19, 2011 2:26 PM
  • Worked with my Network guys who were view the logs on the destination hsi gateway server. He was seeing that the client was not authenticating the same way as usual. Here is his comment:

    Recently the HIS 2009 End User Client has stopped authenticating correctly to our SNA Gateways.  We use a hard coded user name and password within the client.  While testing, we now see that the PC / HIS 2009 client is making some type of Kerberos Authentication request to the SNA Gateway.  We have not seen that type of traffic in the past.  The SNA Gateway event log is now showing that that the user is being granted Anonymous Access to the SNA Gateway.  So the HIS Client is loading and can download com.cfg data to see the resources, but we cannot connect to any of the resources.

    Could you comment on this? Should I create a Microsoft Support Ticket?

    Wednesday, September 21, 2011 2:07 PM
  • The HIS Client can use Kerberos for authentication, but it requires some configuration to do that. See the following blog post for details on this:

    http://blogs.msdn.com/b/sjackson/archive/2008/11/12/how-to-enable-kerberos-authentication-in-host-integration-server-2006.aspx

    If the SPNs (as described in the blog post) are not setup, the HIS client will use NTLM for authentication.

    The usual authentication process is:

    The SnaBase process if configured to run as a Windows service will use the service account that was specified during configuration for authentication. The SNA application will use the credentials of the logged in user that runs the application for authentication or the service account credentials if the application is a Windows service.

    In your case, it will use the configured user account since you have specified a specific account in the HIS Client configuration. Therefore, it should use this account for both the sponsor connection (SnaBase) and the application sessions.

    The quickest way to get to the bottom of this is likely to open a support case. It will likely require the use of tracing to see what is happening. The following are the traces that I would capture on the HIS Client using snatrace.exe:

    - Stop the SnaBase process and the application.
    - Run snatrace.exe
    - Double-click SnaBase from the list of Trace Items.
    - Click "Set All" on the Internal Trace tab
    - Click Internal Messages on the Message Trace tab.
    - Click OK
    - Double-click SNA Application from the list of Trace Items.
    - Click "Set All" on the Internal Trace tab
    - Click Internal Messages anf LU 6.2 Messages on the Message Trace tab.
    - Click OK.
    - Minimize the SNA Trace Utility window
    - Run your application and reproduce the problem.
    - Once the problem occurs, go back to the SNA Trace Utility and click "Clear All Traces" to stop the traces.

    We will want to see the resulting trace files and the applciation event log from the client.

    Thanks...


    Stephen Jackson - MSFT
    Wednesday, September 21, 2011 2:39 PM
  • Seems we did a Microsoft Update around 9/13 ot 9/14 that changed the behavior of HIS.

    Before 9/13, we configure HIS to use 'This Account' credentials to authenticate to the SNA Gateway. We configure a local user name and password setup on the SNA Gateway. However, now the SNA client shows connection to the Gateway but when the applications try to allocate a session (3270 client) the HIS tries to authenticate using the 'Logged on User' with my AD Domain user name and password.

    Doe this help any?

    Tuesday, October 4, 2011 4:02 PM
  • If you configured the HIS Client to use alternate credentials, these would be stored under the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SnaBase\Parameters

    in the following registry parameters:

    UserName
    Password

    For the password parameter, the password is stored (if it is there) as a binary blob as the password is encrypted.

    If you are being authenticated with the logged on user credentials, it sound like the HIS Client is no configured to use alternate credentials.

    To configure a Host Integration Server 2009 client to use alternative credentials instead of user credentials that were used to log on, follow these steps:

    1.  Click Start, click All Programs, click Microsoft Host Integration Server 2009, and then click Configuration Tool.
    2.  Click Common Settings.
    3.  Click Advanced.
    4.  Click This Account under Use the credentials of.
    5.  Click the ellipsis button (…), and then type the user credentials that will be used to connect to Host Integration Server.
    6.  Click Close.
    7.  Click Apply Configuration, and then click Next to apply the changes.
    8.  Click Finish, and then exit the Host Integration Server Configuration Tool.

    In HIS 2009 and earlier, the specified password would not be encrypted and saved in the registry if the user account specified was from a non-trusted domain or workgroup. In these cases, you would be prompted for the password each time SnaBase started. THis was fixed in HIS 2009 Cumulative Update 1 (CU1) as described in the following article:

    2297516 FIX: You are prompted for a password every time that the SnaBase process starts when you try to connect to a server that is running Host Integration Server 2006 or Host Integration Server 2009 in a non-trusted Windows domain or workgroup
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;2297516

    HIS 2009 CU1 is available from the following article:

    2587090 Cumulative update package 1 for Host Integration Server 2009
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;2587090

    You might check to see if the HIS 2009 Client is still configured to use alternate credentials using the steps above.

    Thanks...

     


    Stephen Jackson - MSFT
    Tuesday, October 4, 2011 6:06 PM