IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
#Power
#Operatingsystems
#Servers
 View Only
Back to discussions
Expand all | Collapse all

Recent Experience Upgrading to V7R5

  • 1.  Recent Experience Upgrading to V7R5

    Posted 06/03/26 04:50 PM

    I think one of the biggest strengths and assets within a community is when people share their experiences. So..with that in mind, I am going to share a recent experience I had upgrading one of our IBMi V7R4 LPARS to V7R5. The super short story here is that the first attempt simply FAILED. Not due to a lack of planning, or proper interpretation of following the Memo To Users or anything like that....NOPE..we weren't that lucky. The longer story is way more complicated and time consuming to share in a single post.....As luck would have it...we were the 2nd customer to discover a bug/flaw in the overall install process......The first customer issue only happened a "few days" prior to our failed attempt and that customer didn't provide a lot of info to IBM, so there wasn't a lot of info to go on for our case...But..the one common theme bewteen us was this..."We had too many profiles on the system"....YES..you read that correctly....While the OS itself allows for an insane amount of user profiles (aprox 800K profiles for 7.4 and 7.5), the limit is considerably smaller when attempting to do the actual upgrade to 7.4 or to 7.5 (prior releases as well). We had 380K profiles on this LPAR........So..when the install of the OS went to run , it failed with a msg id of CPZ2020 MCH5003. Not very well documented, in fact..it basically just says "Call IBM".  There was WILD speculation as to how many profiles are considered to be "TOO MANY" for this program to handle as part of the upgrade....the range we were given was anywhere from 50K to 350K.....apparently there is (or was) not a good way of making that determination...I won't even pretend to know or understand why..but...I can say it is not just a matter of the number of profiles but also the size of the profiles themelves.so I'm thinking a few other factors like private authorities, ownership of objects etc might be at play here..but regardless..that didn't really help given that nobody within IBM could definitively tell its 'x'  number of profiles....So....we spent a rather long week with IBM trying to come up with a solution..and I will say..they were 'great' about it..to be fair and honest, they were stepped up and put forth a lot of time and effort into resolving this..They even worked with me one on one to do an upgrade of another system to test out the new procedures and PTF they wanted me to try......which brings me to the "how did we move forward"...

    IBM gave me a PTF that unfortunately had to go on a 7.5 system. Due to the nature of where the problem was in their code/upgrade path..the FIX had to be part of the install code itself...which meant that I couldn't have it on my 7.4 system and it couldn't go on my 7.5 system after the fact..NOPE...I needed an already upgraded 7.5 system to put this PTF on and then I had to create my own install media from that system (SAVSYS) and use that media to do the upgrade on the system(s) we were or going to have an issue with. So..the upgrade was a bit more involved -and had to be done via a manual install etc. But ultimately, it worked......I tried like heck to get IBM to recut the SS1 media..that is the one thing I am very (and still am) disappointed in..I believe firmly that they should have this fix on available in a recut of SS1 we can download but for some reason it could not be done...Which means...ultimately, you may still run into this problem if you have a system with as many profiles as I have.  I was told that the PRUV tool (pre upgrade verification tool) was going to include this as one of the checks...as of May 11th, that still hasn't happened (May 11th is the latest I see avail for the tool). Well..I've taken up enough of your time here...happy to answer any questions but the moral of this story is if you have a large number of users on the system and have yet to upgrade to 7.5...you may want to have another smaller system with 7.5 on it along with PTF SJ09449 applied and have a SAVSYS to virtual media ready in the event you run into issues.....I would absolutely encourage anybody who is concerned about this situation to pester the heck out of IBM to put this fix on their SS1 media for us to download so we simply don't have to worry about it.....Part of their reasoning was (at the time), I was the 2nd customer who came across this so.....not a wide spread concern...!? One last thing..noteworth that upgrading to 7.6..this install code is not used when upgrading to 7.6 so...there's that to look forward too :-) 



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------


  • 2.  RE: Recent Experience Upgrading to V7R5

    Posted 06/03/26 05:56 PM
    Thank you, Rich, for sharing! That is definitely valuable information to be aware of.

    Roman





  • 3.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 03:36 AM
    Edited by Satid S 06/04/26 03:49 AM

    It is quite intriguing what kind of application and its deployment environment need to have more than a few thousand active user profiles?

    >>>>  There was WILD speculation as to how many profiles are considered to be "TOO MANY" for this program to handle as part of the upgrade.. <<<<

    >>>> ultimately, you may still run into this problem if you have a system with as many profiles as I have. <<<<

    In my opinion, it should be more prudent as part of the OS upgrade planning process (and also at least annually or semiannually after the upgrade) to identify how many user profiles are not active for more than 3 or 6 months and delete them while assigning their existing objects to a temp profile to be checked for deletion later. This can be done conveniently using IBM i Services as Carol Woodbury used to write an article about:  Managing Inactive IBM i User Profiles at  https://www.kisco.com/u/content/managing-inactive-ibm-i-user-profiles.html                   



    ------------------------------
    Satid S
    ------------------------------



  • 4.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 08:00 AM

    Satid - While your comment overall is true, profile cleanup should happen on a regular basis for many reasons, lest alone due to security concerns ....Please do not assume or think that this problem could be solved with by simply cleaning up unused profiles...that already happens in my shop on a very regular and automated basis. 



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 5.  RE: Recent Experience Upgrading to V7R5

    Posted 06/05/26 11:05 AM
    We clean up user profiles regularly as well. 
    I'd be most interested to see how you automated the process, if possible please.


    Respectfully,
    Michael Mayer
    IBM i on Power System Admin
    INFOR LN Jr ERP Admin
    ERMCO-ECI
    2225 Industrial Road
    Dyersburg, Tennessee 38024
    Cell, Office and Text Messages: 518.641.8906

    IBM 2024/2025 Advocate, Contributor, Influencer and IBM i Ready Badges.
     
     



    Original Message


  • 6.  RE: Recent Experience Upgrading to V7R5

    Posted 06/10/26 03:25 PM

    Hi Michael

    A lot of our profile administration is done due to our setup and implementation of a 'common user' amongst the many platforms /software solutions we have. So..as people come and go status events are logged into a table which then has some triggers on it. Those triggers then run to perform the appropriate action against the profile.  In a prior life, i would simply write a script that captures the last time a user profile has not been used / signed on and then remove them if that time exceeded a policy we had. SQL services can make that a little easier for you to find such profiles  - in case you were not aware. 



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 7.  RE: Recent Experience Upgrading to V7R5

    Posted 06/10/26 03:37 PM

    I really wasn't aware of the SQL Services to that level of detail. I have multiple SQL's to determine last time used, last time signed on, etc. Several iterations. I'd then check for any objects owned. I'd change objects owned to a profile only used for that purpose. That ownership profile cannot logon. Initial program *none, initial menu *signoff. Once done, I'd remove the profile. 



    ------------------------------
    Michael Mayer
    IBM i on Power System Admin
    Jr INFOR Admin
    ERMCO-ECI
    Dyersburg, Tennessee 38024
    518.641.8906
    2024 / 2025 IBM Badge Advocate, Contributor and Influencer.
    Blog: https://ibmireference.blogspot.com
    ------------------------------

    Original Message


  • 8.  RE: Recent Experience Upgrading to V7R5

    Posted 06/10/26 05:10 PM

    Hi Michael - check this out - this is a list of all the IBMi SQL Services you may find useful. In particular, scroll down to bottom and look under security..you might find something in there to make life a little easier for yourself

    IBM i Services (SQL)



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 9.  RE: Recent Experience Upgrading to V7R5

    Posted 06/10/26 05:28 PM

    Thanks. I usually review the IBM i SQL services. Obviously they're on my blog with just about anything IBM i you can think of. I just haven't really dug in as much as I should ANd I also usually check out the various services when ACS is updated under the examples.



    ------------------------------
    Michael Mayer
    IBM i on Power System Admin
    Jr INFOR Admin
    ERMCO-ECI
    Dyersburg, Tennessee 38024
    518.641.8906
    2024 / 2025 IBM Badge Advocate, Contributor and Influencer.
    Blog: https://ibmireference.blogspot.com
    ------------------------------

    Original Message


  • 10.  RE: Recent Experience Upgrading to V7R5

    Posted 06/10/26 05:32 PM
    I also have around 300 various SQL's I use regularly to admin our systems. They sit in a folder where I have IBM i ACS on our network.

    Respectfully,
    Michael Mayer
    IBM i on Power System Admin
    INFOR LN Jr ERP Admin
    ERMCO-ECI
    2225 Industrial Road
    Dyersburg, Tennessee 38024
    Cell, Office and Text Messages: 518.641.8906

    IBM 2024/2025 Advocate, Contributor, Influencer and IBM i Ready Badges.
     
     



    Original Message


  • 11.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 08:35 AM

    Thank you for sharing Rich! That is interesting that the OS has a limit on how many user profiles can exist! I will share a couple of things I have ran into when upgrading to V7R5 and hopefully it can be beneficial as well. The first and most important thing is the system ssl/tls cypher lists. I have ran into this issue numerous times where upgrading to V7R5 will remove cyphers from the QSSLCSL system value if the QSSLCSLCTL & QSSLPCL system values were set to *OPSYS at V7R4. This caused some applications and processes to not communicate with other systems and processes outside the partition. The second thing I have ran into is the change in IBM I licensing with PowerHA (5770-HAS). In V7R4 you had Express, Standard, and Enterprise editions of PowerHA but when you upgrade to V7R5 the product has been combined into one version called IBM PowerHA SystemMirror for i. This can cause issues if you have Standard or Express at V7R4....



    ------------------------------
    Anna Niederschulte
    IBM I Systems Engineer
    ------------------------------



  • 12.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 09:44 AM

    You are welcome Anna. Yes, we had the same issue with TLS when we upgraded to 7.4 from 7.2 and had to use that awful SST macro to "reactivate" which ciphers we need. For PowerHA,  we're already on the enterprise edition for that ..so nothing there for us to fret about but yes, definitely worth sharing your experience so others may benefit from it as well! Thanks!



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


  • 13.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 08:53 AM

    This article describes the structure of a User Profile, how it expands over time, and the limits on its overall size. It does not reference any limit on the number of User Profile objects that can exist during a migration.  https://www.ibm.com/support/pages/node/642893



    ------------------------------
    Tony Crabtree
    ------------------------------



  • 14.  RE: Recent Experience Upgrading to V7R5

    Posted 06/04/26 09:50 AM

    Thank you for sharing that Tony. This gave me a headache reading it though.....lol.....Not entirely sure it applies since we weren't (nor haven't) gotten a message that any of the profiles are "full" ...this 'limit' was definitely a bug of sorts in IBM's install code as it could not handle a "large" quantity of user profiles...hence the PTF to increase whatever limit they had in that program. 



    ------------------------------
    Rich Malloy
    Principal Systems Engineer - IBMi
    Cox Automotive
    Draper UT
    ------------------------------

    Original Message


Related Content