Brocade Fabric OS Encryption Administrator's Guide v6.3.0 (53-1001341-02, July 2009)

Encryption Administrator’s Guide 177
53-1001341-02
General encryption troubleshooting using the CLI
6
General encryption troubleshooting using the CLI
Table 11 lists the commands you can use to check the health of your encryption setup. Table 12
provides additional information for failures you might encounter while configuring switches using
the CLI.
TABLE 11 General troubleshooting tips using the CLI
Command Activity
supportsave Check whole system configuration.
Run RAS logs.
Run RAS traces.
Run Security Processor (SP) logs (mainly kpd.log).
errdumpall
• errdumpall | grep KAC
• errdumpall | grep CVLM
• errdumpall | grep CVLC
• errdumpall | grep SPM
• errdumpall | grep CNM
Run error logs:
• Key Adapter Module error logs.
• Crypto Virtual device module error logs.
• Crypto LUN module error logs.
• SP Manager error logs.
• Cluster Node Manager error logs.
NOTE: errdumpall requires root user access.
configshow Check whole system persistent configuration database dump.
Check for SPM-, CVLM-, and CNM-related persistent database entries.
cfgshow Check for redirection zones starting with “red_xxx” in defined database for
virtual and physical devices.
nsshow Check for crypto virtual target and crypto virtual initiator entries for VT/VI
switch:SecurityAdmin> cryptocfg --show
-groupcfg
Check key vault connection status.
Check encryption group/cluster status.
Note: CONVERGED status means the cluster is formed successfully.
switch:SecurityAdmin> cryptocfg --show
-groupmember -all
1 Check encryption group/cluster member status.
Note: DISCOVERED state means the member is currently part of a cluster.
2 Check encryption engine/SP and KEK status.
Note: SP state ONLINE means encryption engine is enabled for
encryption with valid KEK (Link Key or Master Key).
TABLE 12 General errors related to using the CLI
Problem Resolution
When the connectivity to an LKM key vault is lost, a RAS log
message is not generated.
Issue any of the cryptocfg commands that attempt a key vault communication
(such as the cryptocfg --show -groupcfg command).
After you create an encryption group using RKM, a newly
created container's LUN state changes between “Write
metadata is pending” and “Write metadata is in progress”
with continuous [RKD-1001] messages displayed on the
console.
Power cycle the DCX chassis and then issue the cryptocfg --enableEE [slot
number] command to bring the container’s LUN state to Encryption Enabled.If
the eth0 IP address on the Brocade Encryption Switch or on the FS8-18 port
blade has been modified, a reboot is required.
LUN state for some LUNS remains in "initialize" state on the
passive path.
This is expected behavior. The LUNs exposed through Passive paths of the
target array will be in either Initialize or LUN Discovery Complete state so long
as the paths remain n passive condition. When the passive path becomes
active, the LUN changes to Encryption Enabled. Use the --show -LUN
command with the -stat option to check the LUN state.