Patch-147686: Patch for OneFS 7.1.0.5 - 7.1.0.6. This patch addresses multiple
SMB issues that affect the SMB and authentication services.

IMPORTANT: 
This patch includes a fix that resolves an issue that affects environments with
one or more Microsoft Active Directory authentication servers running Microsoft
Windows 2003 Server and later, to which either MS security update 3002657 or MS
security update 3002657-v2 has been applied or will be applied. 

Note: This patch can also be installed on clusters in environments to which
the MS security updates have not been applied.

--------------------------------------------------------------------------------

This patch can be installed on clusters running the following OneFS versions: 
7.1.0.5 - 7.1.0.6
         
This patch deprecates the following patches:
patch-135922
patch-140283
patch-145049
patch-145919

If any deprecated patches are installed on the cluster, you must remove them
before installing this patch.

********************************************************************************

RESOLVED ISSUES

* Bug ID 128081
  Because OneFS sent an incorrect response to a NetBIOS session request, the
  request to connect was closed and the NetBIOS client could not connect to the
  cluster. When the session request was closed, lines similar to the following
  appeared in the packet capture:
  
  10.4.0.35     10.4.0.100      NBS     138 Session request
  10.4.0.100    10.4.0.35	TCP	66  netbios-ssn > 51660 [FIN, ACK]
  10.4.0.35     10.4.0.100	TCP	66  51660 > netbios-ssn [FIN, ACK]
  10.4.0.100    10.4.0.35	TCP	66  netbios-ssn > 51660 [ACK]
  
* Bug ID 125231
  OneFS permitted the use of forward slashes in path names and, in OneFS,
  forward slashes within an SMB request were silently converted to backslashes.
  This behavior did not comply with the SMB protocol, which specifies that such
  a request should fail and return the following error:
  OBJECT_NAME_INVALID
  
  NOTE:
  OneFS 7.1.0.6 and later versions of OneFS comply with the
  SMB protocol. If an SMB request that contains a forward slash
  is received, an OBJECT_NAME_INVALID error is returned.

* Bug ID 130122 
  Under rare circumstances, if a subprocess of the lwio process opened a new
  file handle on an existing lease at the same time that another sub process
  was breaking the lease, the lwio process unexpectedly restarted. If the lwio
  process restarted, SMB clients that were connected to the affected node were
  disconnected.
  
* Bug ID 130595
  In some cases, while the lwio process was shutting down (because it was
  manually or automatically restarted), the lwio SRV component waited
  indefinitely for a file object to be freed and did not shut down. If this
  occurred, after 5 minutes, the SRV service was stopped by the lwsm process
  and then automatically restarted. SMB clients were unable to connect to the
  affected node until the SRV service restarted.

* Bug ID 130972  
  If an Active Directory machine account password was changed by a node in a
  cluster, but the new password had not yet been replicated to all domain
  controllers in the Active Directory domain, errors similar to the following
  appeared in the /var/log/lsassd.log files stored on other nodes in the
  cluster, where <machine account> is the name of the machine and its domain:

  Recurring: Error on machine account <machine account>: The password is
  incorrect for the given username
  
  This issue would usually resolve itself when the password replication in the
  Active Directory domain had completed.

* Bug ID 131685
  Because OneFS relied on a function that could handle file descriptors with
  a maximum value of 1024, the lsass process unexpectedly restarted if it
  attempted to process file descriptors assigned a value higher than 1024. As
  a result, SMB users could not be authenticated for the few seconds it took
  for the lsass process to restart.

* Bug ID 131945
  In environments where Kerberos authentication was used to authenticate
  SMB clients to the cluster, a memory leak in the lwio process caused the
  amount of memory allocated to the process to steadily increase until the
  amount exceeded the maximum amount of allocated memory allowed, 4 GB.
  If the amount of memory allocated to the process exceeded the maximum
  amount allowed, the lwio process restarted and SMB clients connected to
  the affected node were disconnected.
  
* Bug ID 132069
  Adds a setting to the OneFS registry that enables you to configure the
  maximum amount of memory that can be allocated to the lsass process.
  Without this setting, the maximum amount of memory that can be allocated
  to the lsass process is set to a default of 512 MB. If the system approaches
  that limit, LDAP connections are closed, and the following lines appear in
  the lsassd.log file:
  
  Error code 40286 occurred during attempt 0 of a ldap search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap search. Retrying.
  Error code 40286 occurred during attempt 2 of a ldap search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap search. Retrying.
  Error code 40286 occurred during attempt 1 of a ldap search. Retrying.
  
  Work with EMC Isilon Support to determine whether you need to configure
  the amount of memory allocated to the lsass process. The memory limit must
  be at least 512 MB, and no more than 1024 MB. If the memory limit is set
  outside that range, the system will restore the default value of 512 MB.

* Bug ID 132366
  NetBIOS requests sent over SMB 2 were not properly handled. As a
  result, the lwio process failed and lines similar to the following
  appeared in the /var/log/messages file:

  /lib/libc.so.7:thr_kill 0xc
  /usr/likewise/lib/liblwbase_nothr.so.0:__LwRtlAssertFailed 0x5a
  /usr/lib/libisi_ntoken.so.1 0x23d673:0x808490673
  /usr/lib/libisi_ntoken.so.1 0x243b4e:0x808496b4e
  /usr/lib/libisi_ntoken.so.1 0x2453c5:0x8084983c5
  /usr/lib/libisi_ntoken.so.1 0x2e450f:0x80853750f
  /usr/likewise/lib/liblwbase.so.0:EventThread 0x333
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine 0xec
  /lib/libthr.so.3:_pthread_getprio 0x15d

* Bug ID 132412
  If OneFS received a request from an SMB client whose Kerberos service
  ticket could not be decrypted, OneFS returned a STATUS_LOGON_FAILURE
  response to the SMB client that sent the request. If this response was sent,
  the affected SMB client might have experienced issues accessing files or
  applications that were stored on the cluster.
  
  NOTE:
  In OneFS 7.1.0.6 and later, if OneFS receives a request from an SMB client
  whose Kerberos service ticket cannot be decrypted, a STATUS_MORE_PROCESSING
  _REQUIRED response is returned. This response prompts the affected SMB client
  to search for a secondary cluster. If the search for a secondary cluster fails,
  the affected SMB client could still experience issues accessing files or
  applications on the cluster.

* Bug ID 132421
  If a directory change notification was cancelled while other file operations
  were in progress - for example, while new client connections were being
  established or while new file handles were being created - internal file
  descriptors might have been handled incorrectly by the lwio process. If this
  occurred, client connections to the cluster might have been unexpectedly
  disconnected and errors might have been returned to a client that attempted
  to access an open file handle.

* Bug ID 132559
  Updates the SMB1 maximum buffer size so that it can be configured to meet
  the requirements of Kazeon applications. To configure the SMB1 maximum
  buffer size:
  
  1. Open an SSH connection on any node in the cluster and log on
  using the root account.
  
  2. Run the following command from the command line where
  <max_buffer> is the desired maximum buffer size:
  isi_gconfig registry.Services.lwio.Parameters.Drivers.srv.
  MaxBufferSizeSMB1=<max_buffer>
  
  NOTE:
  For optimal interoperability with Kazeon, the maximum buffer size
  should be set to 16644.

* Bug ID 132614
  If you ran the isi auth ads modify command with the --reset-schannel option
  to reset the secure channel to the primary domain, the following error
  appeared where <provider-name> was the name of the specified Active
  Directory authentication provider: 

  Failed to reset schannel for <provider-name>': LW_ERROR_NOT_HANDLED

* Bug 133735
  In the OneFS web administration interface, if you created a user mapping
  rule that contained incorrect syntax that included quote marks, the
  updated Access Zone could not be saved and the following error appeared:
  
  Your access zone edit was not saved
  Error #1: Rules parsing failed at ' ': syntax error, unexpected QUOTED,
  expecting BINARY_OP or UNARY_OP
  
  In addition, future attempts to create mapping rules sometimes also failed.

* Bug ID 133749
  Intermittently, incoming SMB sessions were successfully authenticated and
  received the correct username but were mapped to the wrong SID. As a result,
  audit logs associated the incorrect SID with the affected user and the
  affected user was denied access to their files. In order to correct the 
  problem, the lsass process had to be restarted on all nodes in the cluster.

* Bug ID 135559
  Because OneFS did not respond correctly to a specific Local Security
  Authority (LSA) request made by Mac OS 10 clients running Mac OS 10.6
  through 10.10, the ACLs and POSIX owner applied to an affected share could
  not be viewed from Mac OS 10 clients running those versions.

* Bug ID 135789
  If an SMB client disconnected from a node unexpectedly (for example, if the
  client machine was shut down improperly), a race condition could have been
  encountered. This was more likely to occur in environments where many SMB
  clients were simultaneously sending and receiving requests to and from
  the cluster. If this condition occurred, the lwio process restarted, SMB
  clients connected to the affected node were disconnected, and the following
  lines appeared in the /var/log/messages file: 

  /lib/libc.so.7:thr_kill 0xc
  /usr/likewise/lib/liblwiocommon.so.0:LwIoAssertionFailed 0xa4
  /usr/likewise/lib/libiomgr.so.0:IopIrpCompleteInternal 0x5c7
  /usr/likewise/lib/libiomgr.so.0:IopIrpDispatch 0x1c8
  /usr/likewise/lib/libiomgr.so.0:IopCompleteZctReadWriteFile
   0x222
  /usr/likewise/lib/libiomgr.so.0:IoCompleteZctReadFile 0x2f
  /usr/likewise/lib/lwio-driver/srv.so:SrvCompleteZctRead_SMB_V2
   0x52
  /usr/likewise/lib/lwio-driver/srv.so:SrvProcessRead_SMB_V2
   0x456
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecute_SMB_V2
   0xa61
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecute2
   0xab
  /usr/likewise/lib/lwio-driver/srv.so:SrvProtocolExecuteWorkItemCallback2
   0x28
  /usr/likewise/lib/liblwbase.so.0:WorkThread 0x256
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine 0xee
  /lib/libthr.so.3:_pthread_getprio 0x15d 

* Bug ID 135878
  An issue sometimes occurred that prevented OneFS from retrieving SPN 
  keys from the cluster's machine password configuration file, pstore.gc.
  If this issue occurred, authentication requests failed with an "Access
  Denied" error, and continued to fail until the lwio process restarted.   

* Bug ID 136228
  If specific users who were members of multiple Active Directory (AD)
  security and distribution groups attempted to log in to the cluster,
  and those users' primary AD groups were not contained within the list of
  user groups, a signed/unsigned integer mismatch error could occur that
  sometimes caused the lsass process to restart. If the lsass process restarted
  as a result of this issue, users could not log in to the cluster, and the
  following lines appeared in the /var/log/messages file:

  /usr/likewise/lib/lsa-provider/ad_open.so:ADLdap_GetObjectGroupMembership
   0x20b2
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_PacMembershipFilterWithLdap
   0x7d5
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_CacheGroupMembershipFromPac
   0x10c8
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_OnlineCheckUserPassword
   0xf77
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_OnlineAuthenticateUserPam
   0x3c7
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_AuthenticateUserPam
   0x30c
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvAuthenticateUserPam
   0x57e
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvIpcAuthenticateUserPam
   0x3

* Bug ID 136780
  If the lwio process was handling an SMB 2 Create request while a related
  SMB session or connection was being closed, a race condition could have
  occurred. If this condition occurred, some SMB process threads stopped
  responding and new SMB client connections to the affected node could not
  be established until the lwio process on the node was restarted.

* Bug ID 137653
  If an SMB 2 client sent a compound request to the cluster, OneFS did not send
  the correct response and, as a result, the client was disconnected from the
  cluster.

* Bug ID 137745
  Although an LDAP or NIS file provider was configured with a list of unfindable
  users through the --unfindable-users option of the isi auth create or isi
  auth modify command, a user's groups were still queried for through the LDAP
  or NIS provider.

* Bug ID 138066
  If users attempted to access a file under an audited SMB share and the
  attempt failed, the failed access attempts were not recorded in the audit
  log. As a result, these events could not be tracked.

* Bug ID 142289
  Distributed Computing Environment (DCE) Remote Procedure Calls (RPCs)
  that were sent to the cluster in big-endian byte order were not properly
  handled. As a result, clients with CPUs designed to format RPCs in
  big-endian byte order-including PowerPC-based clients-were unable to
  communicate with the cluster. For example, PowerPC-based clients running
  Mac OS 10.5 and earlier were unable to connect to SMB shares. If a packet
  capture was gathered to diagnose this issue, an nca_invalid_pres_context_id
  RPC reject status code appeared in the packet capture.

* Bug ID 142290
  If different nodes in a cluster were connected to different network subnets
  and if those subnets were assigned to different Active Directory sites, the
  site configuration information on the cluster was repeatedly updated.
  Because updates to the site configuration information require a refresh of
  the lsass service, this behavior caused authentication services to become
  slow or unresponsive.

* Bug ID 142291
  If a machine password was changed by a node while the lwreg process on another
  node was refreshing that node's lsass configuration, the lsass process on the
  second node could have cached both the old and new machine passwords. If this
  occurred, the lsass process unexpectedly restarted and clients connected to
  the affected node could not be authenticated. In addition, lines similar to
  the following appeared in the /var/log/messages file: 
  
  /lib/libc.so.7:thr_kill 0xc
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaPcachepEnsurePasswordInfoAndLock
   0x9b6
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaPcacheGetMachineAccountInfoA
   0x28
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_MachineCredentialsCacheInitialize
   0x38
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_Activate 0x9d5
  /usr/likewise/lib/lsa-provider/ad_open.so:LsaAdProviderStateCreate 0xb22
  /usr/likewise/lib/lsa-provider/ad_open.so:AD_RefreshConfigurationCallback
   0x792
  /usr/likewise/lib/liblsaserverapi.so.0:LsaSrvRefreshConfiguration 0x432
  /usr/likewise/lib/lw-svcm/lsass.so:LsaSvcmRefresh 0x209
  /usr/likewise/lib/liblwbase.so.0:RefreshWorkItem 0x24
  /usr/likewise/lib/liblwbase.so.0:WorkThread 0x256
  /usr/likewise/lib/liblwbase.so.0:LwRtlThreadRoutine 0xec
  /lib/libthr.so.3:_pthread_getprio 0x15d

* Bug ID 147220
  If Microsoft Security Bulletin MS15-027 was installed on a Microsoft Active
  Directory server that authenticated SMB clients that were accessing an Isilon
  cluster, and if the server used the NTLMSSP challenge-response protocol, the
  SMB clients could not be authenticated. As a result, SMB clients could not
  access data on the cluster.
  
  For more information, see the following article on the EMC Online Support
  site:
  https://support.emc.com/kb/199379.
	
********************************************************************************

CHANGED FILES

* /usr/likewise/lib/lw-svcm/netlogon.so
  (MD5 = 2233761fe62981e0a2ced6b8e7911e50)

* /usr/bin/isi_audit/isi_audit_util.py
  (MD5 = f24f2e4d5cfb5170b66990cca458fd68)

* /usr/lib/libisi_flt_audit.so.1
  (MD5 = 66b596afef22c4b014de527a89caca56)

* /usr/likewise/lib/lsa-provider/ldap.so
  (MD5 = b35bc6ae8c1f5119363494c0cd1a28f7)

* /usr/likewise/lib/lsa-provider/nis.so
  (MD5 = b7efeea96bf1eaf9edd221b5ee863a2a)

* /usr/likewise/lib/lwio-driver/srv.so
  (MD5 = 30af2edfeb1d06f5a916507e366c7e16)

* /usr/likewise/lib/lsa-provider/ad_open.so
  (MD5 = 912ca8c76bd7e5a08e98f694f7d9e899)

* /usr/likewise/lib/libiomgr.so.0
  (MD5 = 68849d4dd59aa16ac2afaf5525c49889)

* /usr/likewise/lib/liblsarpc.so.0
  (MD5 = 5919ec31d60a41236b665d882d721b31)

* /usr/likewise/lib/lsa-rpc/lsa.so
  (MD5 = e935072879a0e31a7db44d4b993285c4)

* /usr/lib/kt_isi_pstore.so.1
  (MD5 = 1b0a7cabff205cdca52ae5031808b528)

* /usr/likewise/lib/liblsapstore.so.0
  (MD5 = a6dd33084d08f02a5cc7a083b6d6eb78)

* /usr/likewise/lib/liblsacommon.so.0
  (MD5 = 1e9c373be4863f331d33822ad9a7419b)

* /usr/likewise/lib/libdcerpc.so.1
  (MD5 = a48b80ec8f18824bd2a8eb967e17c3b9)

* /usr/likewise/lib/liblsaclient.so.0
  (MD5 = 22d6a974de889370b46d1519fa029c57)

* /var/crash/tools/check/isi_test_priv.co
  (MD5 = 08a051ef529031393789da03751be963)

* /usr/lib/libkrb5.so.3
  (MD5 = 0c578507e5a09d8fc8f0806850c0b046)

* /usr/likewise/lib/liblwmsg_nothr.so.0
  (MD5 = 92c401677dbf38448bab9532b8233a7c)

* /usr/likewise/lib/lwio-driver/onefs.so
  (MD5 = 76a766ef30aea633e7d1cb9e45ca2cfd)

* /usr/likewise/lib/liblwadvapi.so.0
  (MD5 = 13fc75ac82fe7ac1cb1a4e87c9b78d4e)

* /usr/likewise/lib/lw-svcm/lsass.so
  (MD5 = ba3e91b97405ccd2212ce0e8bf670adc)

* /usr/likewise/share/config/lsassd.reg
  (MD5 = 30e4ebac43402adc1e71bd62b225c02c)

* /usr/likewise/lib/libisilon_registry_gcfg.so.0
  (MD5 = 96862df4db7cd6b1171c5e7a69ea513b)

* /usr/lib/libgssapi_krb5.so.2
  (MD5 = eda7ba2c14f83a9aca1db742fa1ac4b8)

* /var/crash/tools/quicktest/papi/AuthUsermapperHttpPapi.py
  (MD5 = 5059abe43328da0c13ae3f456d640338)

* /usr/likewise/lib/liblsaserverapi.so.0
  (MD5 = 1a53a5d41514cfbe4b4b525700788059)
  
* /usr/likewise/lib/liblsass_id_mapper_default_parser.so.0
  (MD5 = 8300231ec8d8edda5fd08847d24dd06c)

* /usr/likewise/lib/libntlmserver.so.0
  (MD5 = 3deb53fe167f906fb35121f2335c0853)

********************************************************************************

INSTALLATION/REMOVAL IMPACTS

During installation or removal of this patch, the SMB and authentication
services are unavailable and SMB client connections to the cluster are
disconnected. After the patch is installed, SMB clients must reestablish a
connection to the cluster.

********************************************************************************

IMPORTANT!  
VERIFY CLUSTER-FREE SPACE
If there is insufficient free space and you attempt to install or remove a
patch, the process might not complete successfully. An incomplete patch
installation or patch removal can leave the cluster in an inaccessible state.

Before installing or removing a patch, verify that your cluster has enough
free space to perform the procedure. For more information about maintaining
sufficient free space on an Isilon cluster, see the Best Practices Guide for
Maintaining Enough Free Space on Isilon Clusters and Pools:
https://support.emc.com/docu48119.
   
********************************************************************************

REMOVE DEPRECATED PATCHES

If any deprecated patches are installed on the cluster, perform the following
procedure to remove them before installing this patch.

IMPORTANT!

Read the INSTALLATION/REMOVAL IMPACTS in the README for the deprecated patch
before performing this procedure.

1. Verify that your cluster has enough free space to remove this patch.

2. Open an SSH connection on any node in the cluster and log in using the root
   account.

   NOTE: If the patch is being removed from a compliance mode cluster, log in
   using the compadmin account.

3. To remove this patch, run the following command, where <ID> is the patch ID
   of the patch to be removed:
   
   isi pkg delete patch-<ID>

4. To verify that this patch was removed, run the following command:
     
   isi pkg info

5. Confirm that patch-<ID> does not appear in the list of installed packages.

********************************************************************************

INSTALLING THIS PATCH

IMPORTANT!
Read INSTALLATION/REMOVAL IMPACTS before performing this procedure.

NOTE
The lw processes must be restarted after the patch is installed. To confirm
that the lw processes have restarted automatically, compare the process IDs
(PID) of the processes before and after installing the patch. 
   
1. Verify that your cluster has enough free space to install this patch.

2. Open an SSH connection on any node in the cluster and log in using the
   root account.

   NOTE: If the patch is being installed on a compliance mode cluster, log in
   using the compadmin account.

3. Run the following command to list the running lw processes and make a
   note of the PID for each process:

   isi_for_array -s "ps -ax | grep lw | grep -v grep"

   Information similar to the following appears, where the value listed in the
   PID column is the PID of the related lw process.

   Node    PID               Time    Process name
   clus-1: 63688  ??  I      0:02.75 lw-container lwreg (lwreg)
   clus-1: 63689  ??  I      0:00.25 lw-container netlogon (netlogon)
   clus-1: 63691  ??  S      0:14.06 lw-container lsass (lsass)
   clus-1: 63703  ??  I      0:00.32 lw-container srvsvc (srvsvc)
   clus-1: 63742  ??  I      0:02.65 lw-container lwio (lwio)
   clus-2: 40114  ??  I      0:02.75 lw-container lwreg (lwreg)
   clus-2: 40115  ??  I      0:00.25 lw-container netlogon (netlogon)
   clus-2: 40120  ??  S      0:14.06 lw-container lsass (lsass)
   clus-2: 40121  ??  I      0:00.32 lw-container srvsvc (srvsvc)
   clus-2: 40122  ??  I      0:02.65 lw-container lwio (lwio)

4. To shut down the lw processes, disable the Likewise Service Manager (lwsm)
   service: 

   isi services -a lwsm disable

5. Wait 30 seconds, and then run the following command to confirm that the
   lw processes are not running on any nodes:  

   isi_for_array -s "ps -ax | grep lw | grep -v grep"   

   If all the lw processes have stopped running, the command above will not 
   return any information. If you see information similar to the following, one 
   or more lw processes are still running.

   Node    PID               Time    Process name
   clus-1: 63688  ??  I      0:02.75 lw-container lwreg (lwreg)
   clus-1: 63689  ??  I      0:00.25 lw-container netlogon (netlogon)
   clus-1: 63691  ??  S      0:14.06 lw-container lsass (lsass)
   clus-1: 63703  ??  I      0:00.32 lw-container srvsvc (srvsvc)

   It can take time for the processes to be stopped. Wait 30 seconds and run 
   the ps command again.

6. If, after five minutes, the lw processes are still running, run the
   following command to stop the remaining lw processes, where <node#> is
   the number of the node on which the processes are still running, and
   <PID> is the PID of the lw process that needs to be stopped.  
 
   isi_for_array -n <node#> kill <PID>

7. Run the following command again to confirm that the remaining lw
   processes have stopped:

   isi_for_array -s "ps -ax | grep lw | grep -v grep"   

   When all the lw processes have stopped running, proceed to the next step.
   Otherwise, repeat the previous step and this step until there are no more
   lw processes running. 

8. Copy the patch-147686.tgz file to the /ifs/data directory on the cluster.

9. Run the following command to change to the /ifs/data directory:
   
   cd /ifs/data

10. To extract the patch file, run the following command:

    tar -zxvf patch-147686.tgz

11. To install this patch, run the following command:

    isi pkg install patch-147686.tar

12. To verify that this patch is installed, run the following command:
  
    isi pkg info

13. Confirm that patch-1457686 appears in the list of installed packages.

14. Run the following command to enable the lw processes:  
   
    isi services -a lwsm enable
   
15. Run the following command to refresh the lwio process:
  
    isi_for_array /usr/likewise/bin/lwsm refresh lwio

16. Run the following command to display the PID values for the lw processes,
    and then compare the PID values displayed to the values noted in step 3
    of this procedure. The PID values should have changed between step 3
    and step 15 of this procedure.

    isi_for_array "ps -ax | grep lw | grep -v grep"

********************************************************************************

REMOVING THIS PATCH

If you need to remove this patch, complete the steps below.

IMPORTANT!
Read INSTALLATION/REMOVAL IMPACTS before performing this procedure.

1. Verify that your cluster has enough free space to remove this patch.

2. Open an SSH connection on any node in the cluster and log in using the root
   account.

   NOTE: If the patch is being removed from a compliance mode cluster, log in
   using the compadmin account.

3. Manually shut down the lw processes: 

   isi services -a lwsm disable

4. Run the following command to confirm that the lw processes are not running
   on any nodes:  

   isi_for_array -s "ps -ax | grep lw | grep -v grep"   

   If all the lw processes have stopped running, the command will not return any
   output. If you see output similar to the following, the lw processes haven't
   shut down yet. Wait 30 seconds and run the ps command again. 

   NOTE: The PID values are listed in the table below, under the PID header.

   Node    PID               Time    Process name
   clus-1: 63688  ??  I      0:02.75 lw-container lwreg (lwreg)
   clus-1: 63689  ??  I      0:00.25 lw-container netlogon (netlogon)
   clus-1: 63691  ??  S      0:14.06 lw-container lsass (lsass)
   clus-1: 63703  ??  I      0:00.32 lw-container srvsvc (srvsvc)
   clus-1: 63742  ??  I      0:02.65 lw-container lwio (lwio)
   clus-2: 40114  ??  I      0:02.75 lw-container lwreg (lwreg)
   clus-2: 40115  ??  I      0:00.25 lw-container netlogon (netlogon)
   clus-2: 40120  ??  S      0:14.06 lw-container lsass (lsass)
   clus-2: 40121  ??  I      0:00.32 lw-container srvsvc (srvsvc)
   clus-2: 40122  ??  I      0:02.65 lw-container lwio (lwio)

5. If, after five minutes, the lw processes are still running, run the
   following command to stop the remaining lw processes, where <node#>
   is the number of the node on which the processes are still running,
   and <PID> is the PID of the lw process that needs to be stopped.  
 
   isi_for_array -n <node#> kill <PID>

6. Run the following command again to confirm that the remaining lw
   processes have stopped:

   isi_for_array -s "ps -ax | grep lw | grep -v grep"   

   When all the lw processes have stopped running, proceed to the next step.
   Otherwise, repeat the previous step and this step until there are no
   more lw processes running. 

7. To remove this patch, run the following command:

   isi pkg delete patch-147686

8. To verify that this patch was removed, run the following command:

   isi pkg info

9. Confirm that patch-147686 does not appear in the list of installed packages.

10. Run the following command to enable the lw processes:  
   
    isi services -a lwsm enable
   
11. Run the following command to refresh the lwio process:
  
    isi_for_array /usr/likewise/bin/lwsm refresh lwio

********************************************************************************
