Unable to initialize computer and it can't be used at this time. SIP 401 SIP 503

Technote (troubleshooting)


Problem

When users first log in to an IBM Sametime client, the following message appears in a pop-up dialog:

"Unable to initialize computer and it can't be used at this time......", or

"Your Sametime Computer Audio/Video is temporarily unavailable"

The message might repeat periodically through the day.


Symptom

Sametime 8.5.0 and 8.5.1 clients see a pop-up dialog with the following error:


    "Unable to initialize computer and it can't be used at this time... "

The full error in the logs is as follows:
    Unable to initialize Computer, and it can't be used at this time. com.ibm.collaboration.realtime.telephony.softphone.SIPPhoneException: Processed unsuccessful response: null for: REGISTER sip:proxreg.ibm.com:5081;transport=tls SIP/2.0
    Call-ID: 0.50.34353AEC0ACA4EAE@n.n.n.n.n
    CSeq: 1 REGISTER
    From: <sips:user%40us.ibm.com@proxreg.ibm.com:5081>;tag=73.47949067666337
    To: <sips:user%40us.ibm.com@proxreg.ibm.com:5081>
    Via: SIP/2.0/TLSn.n.n.n.n:5061;branch=z9hG4bK7799960260866760035
    Max-Forwards: 70
    Contact: <sip:n.n.n.n.n:5061;transport=tls>
    Expires: 300
    User-Agent: Sametime-Softphone-8.5.1.20101005-1712
    Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, INFO, MESSAGE, UPDATE
    Content-Length: 0

Sametime 8.5.2 and later clients see the following error:
    "Your Sametime Computer Audio/Video is temporarily unavailable. You will be unable to make audio/video calls. Log out and log back in to resume use of audio/video."
[$54334BB99C603DCF.jpg]

Cause

This error indicates a problem with audio/video (A/V) or setup of the Media Manager server. This error message occurs when the Sametime client is unable to register a user with the SIP Proxy and Registrar on the Media Manager, for example, due to authentication or network connectivity issues.

Diagnosing the problem

First, review the "Resolving the problem" section below. If the typical solutions described there do not lead to a solution for your environment, you can collect client and server diagnostic data using the following steps:


1. Enable client traces by following the instructions for your client type:


To summarize those instructions, you will stop the client, clear the existing logs, and enable tracing on the client by adding the following lines in the rcpinstall.properties file:
    com.ibm.collaboration.realtime.telephony.core.level=FINE
    com.ibm.collaboration.realtime.telephony.tcspi.level=FINEST
    com.ibm.collaboration.realtime.telephony.softphone.level=FINER
    com.ibm.collaboration.realtime.internal.telephony.level=FINE
    com.ibm.collaboration.realtime.policy.level=FINEST
    com.lotus.sametime.policy.level=FINEST

2. Enable server-side logging for the Media Manager server
    a. Log into WebSphere administrative console that is hosting the SIP Proxy and Registrar server.

    b. Navigate to Troubleshooting > Logs and trace > STMediaServer > Diagnostic Trace. Under ' Maximum Number of Historical Files' enter 10.

    c. Click OK and then Save.

    d. Go to to Troubleshooting > Logs and trace > STMediaServer > Diagnostic Trace > Change Log Detail Levels and enter the following trace settings:

    *=info: com.ibm.ws.security.*=all: com.ibm.websphere.wim.*=all: com.ibm.wsspi.wim.*=all: com.ibm.ws.wim.*=all: com.ibm.ws.sip.*=all: com.ibm.wsspi.sip.*=all: com.ibm.ws.udp.*=all: com.ibm.ws.webcontainer.*=all: com.ibm.sip.*=all

    e. Click OK then Save to the Master Configuration.

    f. Go to to Troubleshooting > Logs and trace > STMediaServer > JVM Logs.

    g. Under System.out set 'Maximum Size' to 20 and 'Maximum Number of Historical Files...' to 10,

    h. Under System.err set 'Maximum Size' to 20 and 'Maximum Number of Historical Files...' to 10.

    i. Click OK then Save.

    j. Stop all the WebSphere Application Server processes. Move or delete everything from the following directories, where <PN-profile> is the profile of the primary node:
      <was-install>\profiles\<PN-profile>\logs\STMediaServer
      <was-install>\profiles\<PN-profile>\logs\ffdc

    k. Restart the Media Manager server.

3. Take screen captures (pictures) of the following Configuration screens and settings:
    a. SSO settings from Meeting server by going to its WebSphere administrative console and selecting Security > Global Security > WEP and SIP Security > Single Sign-on (SSO)

    b. SSO settings from SIP Proxy and Registrar server by going to its WebSphere admin console and selecting Security > Global Security > WEP and SIP Security > Single Sign-on (SSO)

    c. Federated Repositories settings from SIP Proxy and Registrar by going to its WebSphere admin console and selecting Security > Global Security from the menu and then select Configure next to Federated Repositories

    d. On the Domino server, go to the Domino Directory (names.nsf) for the Sametime Community server. Capture the settings under 'Web SSO Configuration for LtpaToken', found under Configuration>Web> *- Web Configurations > Web SSO Configurations for LtpaToken

4. To collect the diagnostic files, run collector.bat file on the SIP Proxy and Registrar server using the following steps:
    a. Launch a command line and go to
    <WAS_install_root>\WebSphere\AppServer\profiles\<PN_ProfileName>\bin

    b. Run the following batch file
    setupCmdLine.bat

    c. Copy collector.bat from this directory, and paste it to a temporary location such as C:\

    d, Run the following command from C:\
    collector.bat -servername STMediaServer

    This command generates a *.jar file in the current directory, For easier identification, rename the file to <hostname>.jar.

5. Collect the version information for the WebSphere Application server by running the versionInfo command from the was_install_root/bin directory and piping the output to a text file, as follows:
    Linux
    ./versionInfo.sh -maintenancePackages > version.txt

    Windows
    versionInfo.bat -maintenancePackages > version.txt

    The command creates a text file that lists all the WebSphere Application Server updates that have been installed on the system.

6. Submit this diagnostic information to IBM Support using the instructions in Exchanging information with IBM Support:
  • Client logs from Step 1
  • Entire SIP Proxy and Registrar logs directory (<was-install>\profiles\<PN-profile>\logs) from Step 2
  • Screen captures from Step 3
  • collector.bat output named <hostname>.jar from Step 4
  • version.txt file from Step 5
  • Details about the error situation
    • Does the error occur with only one user ID or with other IDs as well?
    • Does the problem affect all users or only specific versions and client type (stand-alone Sametime Connect or embedded in Notes)?


Resolving the problem

To completely resolve the problem, the Sametime administrator must resolve the underlying Audio/Video problem causing the client error message. While that troubleshooting is underway, it is possible to suppress this warning in the client by adding the following parameter to the Sametime client's plugin_customization.ini file:


com.ibm.collaboration.realtime.telephony.softphone/suppress.failed.sip.registration=true

For methods to implement, refer to "How to suppress SIP registration failures in the Sametime 8.5x client" (1456002).



Troubleshooting path

The 'Unable to initialize Computer...' is a generic error caused by various reasons. This error message occurs when the Sametime client is unable to register a user with the SIP Proxy and Registrar on the Media Manager server. This registration is very important in order to use A/V, and the registration is sent periodically to the SIP Proxy and Registrar server. The SIP messages are routed using the default transport protocol, which is TLS in 8.5.1, because it offers secure communication between the client and the Media Manager.

Review the common issues and solutions below.
  • Single sign-on (SSO) and "Remember password"
  • SIP errors
    • SIP 401 authentication errors
    • SIP 503 network connections errors
  • Using TLS



Single sign-on (SSO) and "Remember password"

Sametime version differences for SSO
  • 8.5.1.1 or later: Single-sign on (SSO) authentication between the Media Manager server and a Sametime client is supported for Sametime 8.5.1 fix pack 1 (8.5.1.1) or later. Continue with the information below to check the SSO configuration.
  • 8.5.1.0 or earlier: For versions prior to 8.5.1.1, the "Remember password" checkbox must be selected in the Sametime client's Community server settings when you log in to the Media Manager server. The client will then be using a password, and not SSO, to log in. If the problem continues in Sametime 8.5.1.0 or earlier when "Remember password" is selected in the client, then collect diagnostic data.
  • Sametime 8.5.2 has WebSphere Application Server 7.0.0.15 as its base version, and WAS 7.0.0.15 and later include a fix for "PM20402: LTPA token is not being read from SIP messages." If the WebSphere Application Server version used by your Sametime environment is earlier than 7.0.0.15, verify that PM20402 is included in the version.txt information (refer to Step 5 in "Diagnosing the Problem" above to generate version.txt). ​

Configuring SSO between Sametime servers

For Sametime Media Manager 8.5.1.1 or later and Sametime clients 8.5.1.1 or later, you can configure SSO between the Media Manager server and the Sametime Community server so that users can log in to the server whether or not the "Remember Password" checkbox is selected. Review the following steps:

1. Configure single sign-on between servers 2. Confirm that the SSO settings in the Meeting server and SIP Proxy and Registrar are the same.
    Note: Skip this step if the SIP Proxy and Registrar and Meeting server are federated into the same Sametime System Console (SSC) or installed on the same cell, or you have configured SSO between SIP Proxy and Registrar and Community servers using the instructions in Step 1.

    a. Log in to the WebSphere administrative console.
    b. Click Security > Global Security > WEP and SIP Security > Single Sign-on (SSO).
    c. Verify that it has the same domain name.
    d. If the Interoperability Mode is selected on the Meeting server, then it must be selected on the SIP Proxy and Registrar as well.

3. Import the LTPA keys in SIP Proxy and Registrar.
    Note: Skip this step if the SIP Proxy and Registrar and Meeting server are federated into the same SSC or are installed on the same cell.

    If you exported LTPA keys from the Meeting server and imported them to the Lotus Domino server, then you need to import them to the SIP Proxy and Registrar. Steps for importing the LTPA keys in the SIP Proxy and Registrar:

    a. Log in to the Integrated Solutions Console for the Sametime SIP Proxy and Registrar.
    b. Click Security > Global Security.
    c. Under Authentication, click LTPA.
    d. Under Cross Cell single sign-on, in the Password field, enter the same password used by the file, Confirm Password, and a file name from where to import the key.
    e. Click Import keys.
    f. Click the Save link that appears at the top of the page
    g. Restart the SIP Proxy and Registrar server.

    Likewise, if you exported the LTPA keys from the SIP Proxy and Registrar instead and only imported them to the Domino server, then you need to import them in the Meeting server, with steps similar to these in Step 3.

4. Restart all servers.

5. Test the connection to determine if this problem still occurs. If it does, collect diagnostic data.



SIP errors

If you collect diagnostic data for the client softphone and SIP Proxy Registrar server, you can review that data for an error code or null entry, normally located after 'Processed unsuccessful response' in the output. The sections below explain two common errors, 401 or 503, and possible causes.
  • SIP 401 error

A SIP 401 error indicates an authentication problem. An example of a 401 error from the client logs is as follows:
    <<< SIP MESSAGE IN:
    SIP/2.0 401 Unauthorized
    Call-ID: 0.0.22E0B17358D47956@n.n.n.n
    Content-Length: 0
    CSeq: 1 REGISTER
    From: <sips:user%40proxreg.ibm.com@.proxreg.ibm.com:5081>;tag=73.47949067666337
    To: <sips:user%40proxreg.ibm.com@.proxreg.ibm.com:5081>;tag=9020891044506072_local.1303821412290_10836_18198
    Via: SIP/2.0/TLS n.n.n.n:5061;branch=z9hG4bK7799960260866760035
    WWW-Authenticate: Basic realm="rtp.example.ibm.com"

Authentication can fail due to one or more of the following reasons:
  • If needed for the Sametime version, the setting "Remember password" is not selected in the client.
  • When using SSO, the proper LTPA keys were not imported in the SIP Proxy and Registrar.
  • The SIP Proxy and Registrar cannot authenticate the user with the LDAP directory. To verify, try searching for that user by email address in the WebSphere administrative console for the SIP Proxy and Registrar.
  • The LDAP repository does not exist or is not configured properly in the SIP Proxy and Registrar administrative console.
  • If SSL is used to access LDAP, then the proper certificates were not imported in the SIP Proxy and Registrar.
  • The LDAP attribute used as an external identifier has a null value for entity. Refer to "Unable to get audio/video functionality - CWWIM4548E error in SystemOut.log" (1441369).
  • The Conference Manager and Packet Switcher send SIP messages to the SIP Proxy and Registrar but are not trusted. To resolve, make sure they are added in the trusted IP list of the SIP Proxy and Registrar.

As a last resort when all other options have been tried, you can avoid or work around the 401 error by disabling SIP security (that is, change the SIP Registrar security role in the WebSphere administrative console for the SIP Proxy and Registrar).
  • SIP 503 error

A SIP 503 error or "response: null" value indicates a network connection issue. Connectivity can fail due to one or more of the following reasons:
  • Improper configuration of a load balancer being used with a Media Manager cluster. For example, Big IP F5 requires MAC forwarding and must be on same subnet as the WebSphere proxy.
  • Timeout problems. For example, the SIP Proxy and Registrar or the WebSphere proxy configured with SIP Proxy Registrar cluster takes longer to respond, namely, more than 30 seconds.
  • LDAP taking too long to respond to SIP Proxy Registrar requests. Try disabling SIP security to isolate whether the problem is as an LDAP issue.
  • Use of port 5060 by both the Conference Manager and Proxy and Registrar proxies. This duplicate port use causes mismatch when heartbeat messages are sent. Try changing the SIP port of the SIP Proxy Registrar WebSphere proxy to another value.
  • Firewall blocking ports between client and server (personal or network-based firewall).
  • Stavconfig.xml is not properly configured to direct the client to the SIP Proxy Registrar. Check all instances of Stavconfig.xml on Conference Managers, SIP Proxy Registrars, and Packet Switchers to ensure accuracy.



Using TLS

With TLS enabled, the SIP Proxy and Registrar uses SIP security, which requires user authentication. A temporary workround would be to disable TLS to determine if TLS transport is a factor or root cause. If you change the transport protocol from TLS to TCP, then you must also disable SIP security.

Other than as a temporary workaround, TLS should only be disabled for the reason described in "Using the Transport Layer Security (TLS) protocol with Sametime Audio/Video in a load balancing environment" (1458164).


Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

IBM Sametime
Media Manager

Software version:

8.5, 8.5.1, 8.5.1.1, 8.5.2, 8.5.2.1

Operating system(s):

Windows

Software edition:

Standard

Reference #:

1470263

Modified date:

2012-04-25

Translate my page

Machine Translation

Content navigation