============================================================================= Run Date: SEP 30, 2026 Designation: MAG*3*371 Package : MAG - IMAGING Priority: Mandatory Version : 3 SEQ #280 Status: Released Compliance Date: NOV 02, 2026 ============================================================================= Associated patches: (v)MAG*3*118 <<= must be installed BEFORE `MAG*3*371' Subject: UPGRADE HDIG JAVA TO AWS CORRETTO, APPLY SMB W/KERBEROS, OTHER FIXES Category: - Routine - Other Description: ============ Patch MAG*3.0*371 upgrades several core components, including updated versions of LOG4J and Apache Tomcat, and replaces Oracle Java with AWS Corretto. In addition to these platform updates, the patch also resolves multiple defects. Defects: -------- 1. VISTAIS-7422 / INC27162470: Async issues on HDIG Location Reporting Incident: Rocky Mountain Regional VA Medical Center (CO) 2. VISTAIS-5830: HDIG must support DUZ values greater than 2,147,483,647 Remedy ticket(s): 1005092 3. VISTAIS-6471: HDIG is unable to process DICOM files greater than 2 GB 4. VISTAIS-6618 / INC38757003: Both HTTP and HTTPS stats pages are available after the MAG*3.0*354 upgrade Location Reporting Incident: G.V. (Sonny) Montgomery VA Medical Center (MS) Adaptive Maintenance: --------------------- 1. VISTAIS-7274: Update LOG4J from 2.17 to 2.25.3 2. VISTAIS-5938: Java Upgrade: Transition from Oracle Java to Amazon Corretto 3. VISTAIS-5939: Implement SMBv3 Support 4. VISTAIS-6725: Upgrade the system to enable support for Kerberos authentication 5. VISTAIS-7187: Upgrade Apache Tomcat version to 9.0.115 6. VISTAIS-7268: Update the HDIG Java Logs Viewer password 7. VISTAIS-6617: VistA Imaging Hybrid DICOM Image Gateway Installation Guide Updates 8. VISTAIS-7394: Update the SSL certificate for HTTPS EHRM Impact Statement: ---------------------- This patch should have no EHRM impact, and can be installed at all sites, including EHRM converted sites. Patch Components: ---------------- Files & Fields Associated: File Name (Number) Field Name (Number) New/Modified/Deleted ------------------ ------------------- -------------------- Forms Associated: Form Name File Number New/Modified/Deleted --------- ----------- -------------------- N/A Mail Groups Associated: Mail Group Name New/Modified/Deleted --------------- -------------------- N/A Options Associated: Option Name Type New/Modified/Deleted ----------- ---- -------------------- N/A Protocols Associated: Protocol Name New/Modified/Deleted ------------- -------------------- N/A Security Keys Associated: Security Key Name ----------------- N/A Templates Associated: Template Name Type File Name (Number) New/Modified/Deleted ------------- ---- ------------------ -------------------- N/A Remote Procedures Associated: Remote Procedure Name New/Modified/Deleted --------------------- -------------------- N/A Parameter Definitions Associated: Parameter Name New/Modified/Deleted -------------- -------------------- N/A Additional Information: ----------------------- N/A Blood Bank Team Coordination: N/A New Service Requests (NSRs): N/A Patient Safety Issues (PSIs): N/A Defect Tracking System Ticket(s) & Overview: -------------------------------------------- 1. VISTAIS-7422 / INC27162470: Async Issues on HDIG Location Reporting Incident: Rocky Mountain Regional VA Medical Center (CO) Problem: -------- The following Error in Async Storage Request List comes back even after requeuing. artifactToken: XxxX#xxx####XX#Xx!#XxX####XXxXX ARTIFACT File entry: ###### STORAGE TRANSACTION MESSAGE: [null] lastError: Writing artifact ###### There is a MUMPS code bug that is assigning an IEN when that IEN already exist and is in use. Resolution: ----------- Added a lock at ADDQM+28^MAGVAQ01 to prevent the previous enqueue message from being overwritten. Then release the lock at ADDQM+32^MAGVAQ01 once it is successfully added to the file. The code will try for 60 seconds to obtain the lock and if it cannot, it will return the following to the HDIG: 1^ QUEUE MESSAGE file is locked 2. VISTAIS-5830: HDIG must support DUZ values greater than 2,147,483,647 Remedy ticket(s): 1005092 Problem: -------- When we initially receive the Access/Verify RPC Response, we check the DUZ against the number 0 (zero). The DUZ in the response is a String. The HDIG converts the String to an integer to compare against 0. The problem is an integer has a maximum value of 2,147,483,647. The DUZ is 10,000,021,979. Since the DUZ is larger than maximum value of integer, the code throws an exception and terminates the login process. Resolution: ----------- The application was validating the DUZ by converting it to an integer. When the DUZ exceeded the maximum allowable integer value, the conversion failed and the application generates an error. Updating the logic to use BigInteger allows the application to properly handle large DUZ values, resolving the issue. 3. VISTAIS-6471: HDIG is unable to process DICOM files greater than 2 GB Problem: -------- HDIG is unable to process DICOM files greater than 2 GB due to an integer overflow. The HDIG code reads the file length into a 32bit integer. When the DICOM file exceeds 2,147,483,647 bytes (2 GB), the integer value overflows and becomes negative. Resolution: ----------- Use a long data type to determine the file size instead of an integer. When the file size exceeds 2 GB (Integer.MAX_VALUE), apply streaming and temporary-file handling to prevent integer overflow and ensure reliable processing. 4. VISTAIS-6618 / INC38757003: Both HTTP and HTTPS stats pages are available after the MAG*3.0*354 upgrade Location Reporting Incident: G.V. (Sonny) Montgomery VA Medical Center (MS) Problem: -------- MAG*3.0*354 Updated the SSL certificate used for HTTPS, ensuring encryption of HDIG Stats page. The unencrypted HTTP version of the Stats page remained available. Resolution: ----------- Coding changes were implemented so that any request for the HTTP URL is automatically redirected to the HTTPS URL. Adaptive Maintenance: -------------------------------------------- 1. VISTAIS-7274: Update LOG4J from 2.17 to 2.25.3 Problem: -------- TRM Compliance for LOG4J. Resolution: ----------- Coding changes were made to upgrade LOG4J to 2.25.3. 2. VISTAIS-5938: Java Upgrade: Transition from Oracle Java to Amazon Corretto Problem: -------- TRM Compliance. Oracle Java was previously used for both build and runtime processes. The environment needs to be upgraded to Amazon Corretto 8.482.08.1 for both building and running the application. Resolution: ----------- Code changes were implemented to upgrade the environment and enable the use of Amazon Corretto 8.482.08.1 for both the build and runtime processes. 3. VISTAIS-5939: Implement SMBv3 Support Problem: -------- SMBv3 support is required for the system. Resolution: ----------- Code changes were implemented to add SMBv3 support to the HDIG. 4. VISTAIS-6725: Upgrade the system to enable support for Kerberos authentication Problem: -------- Kerberos authentication is required for HDIG. Resolution: ----------- Code changes were implemented to upgrade the system to support Kerberos authentication. 5. VISTAIS-7187: Upgrade Apache Tomcat to 9.0.115 Problem: -------- For TRM compliance, an upgrade of Apache Tomcat to 9.0.115 was required. Resolution: ----------- Coding changes were implemented to upgrade Apache Tomcat to 9.0.115. 6. VISTAIS-7268: Update the HDIG Java Logs Viewer password Problem: -------- The password for the HDIG Java Logs Viewer is required to be changed and protected using encryption. Resolution: ----------- Coding changes were implemented to update the HDIG Java Logs Viewer password, and the new password is now stored in encrypted form. 7. VISTAIS-6617: VistA Imaging Hybrid DICOM Image Gateway Installation Guide Updates Problem: -------- The Installation Guide needs to be updated to reflect appropriate hardware requirements. Resolution: ----------- The Installation Guide has been updated. 8. VISTAIS-7394: Update the SSL Certificate for HTTPS Problem: -------- Update HDIG SSL Certificate - The SSL certificate expired and needs to be updated. Resolution: ----------- Updated the SSL certificate for HTTPS so that HTTPS encryption works. Test Sites: ----------- Rocky Mountain Regional VA Medical Center (Denver, CO) G.V. (Sonny) Montgomery VA Medical Center (Jackson, MS) Test Sites - SNOW Change Order #: --------------------------------- Rocky Mountain Regional VA Medical Center (Denver, CO) - CHG0774799 G.V. (Sonny) Montgomery VA Medical Center (Jackson, MS) - CHG0774646 Software and Documentation Retrieval Instructions: -------------------------------------------------- The software for this patch is being released using a host file. Software Files: All files can be obtained by accessing the URL: https://download.vista.domain.ext/index.html/SOFTWARE File Title File Name Format -------------------------------------------------------------------------- Kernel Installation and MAG3_0P371.KID ASCII Distribution System (KIDS) Build for MAG*3.0*371 Hybrid DICOM Gateway MAG3_0P371_HDIG_SETUP.MSI Binary Installation File Documentation describing the new functionality is included in this release. Documentation can be found on the VA Software Documentation Library at: VA Software Document Library. Documentation can also be obtained at https://download.vista.domain.ext/index.html/SOFTWARE Documentation Title File Name -------------------------------------------------------------------------- Patch Description for MAG*3.0*371 MAG3_0P371_PATCH_DESCRIPTION.PDF Deployment, Installation, Back-Out, MAG3_0P371_DIBRG.PDF and Rollback Guide Hybrid DICOM Image Gateway MAG_HDIG_INSTALLATION_GUIDE.PDF (HDIG) Installation Guide Patch Installation: ------------------- Pre/Post Installation Overview: MAG*3.0*371 must be installed on the VistA System and on 64-bit HDIG servers. This patch must be installed by the compliance date. All sites running VistA Imaging 3.0 must install the KIDS portion of this patch. This patch can be loaded while the VistA Imaging System is active, and users are on the system. Installing the MAG*3.0*371 KIDS takes 2-5 minutes. NOTES: 1. To avoid losing configuration changes, sites with a modified HDIG Listen file will need to save a copy of the file before installing this patch. After the installation is complete, restore the Listen file and restart the Tomcat service. The location of Listed file is here: C:\DCF_RunTime_x64\cfg\apps\defaults. 2. To avoid losing configuration changes in the PeriodicCommandsConfiguration.config file, sites with a modified PeriodicCommandsConfiguration.config file will need to save a copy of the file before installing this patch. The location of the PeriodicCommandsConfiguration.config file is here: C:\VixConfig\DicomServerConfiguration.config 3. There is a known issue if there are multiple Java versions on the system for HDIG and hence not recommended. Supported Versions: When MAG*3.0*371 is released, the list of supported versions of HDIG will change: Versions Supported: 3.0.371 3.0.392 3.0.383 Versions No Longer Supported: 3.0.354 3.0.357(HDIG) 3.0.345/3.0.364 Pre-Installation Instructions: This patch may be installed with users on the system although it is recommended that it be installed during non-peak hours to minimize potential disruption to users. This patch should take less than 5 minutes to install. KIDS Installation Instructions: 1. Use the Load a Distribution option contained on the Kernel Installation and Distribution System Menu to load the Host file. When prompted to "Enter a Host File:" enter /srv/vista/patches/SOFTWARE/MAG3_0P371.KID 2. From the Kernel Installation and Distribution System Menu, select the Installation Menu. From this menu, A. Select the Verify Checksums in Transport Global option to confirm the integrity of the routines that are in the transport global. When prompted for the INSTALL NAME enter the patch or build name (MAG*3.0*371). NOTE: Using will not bring up a Multi-Package build even if it was loaded immediately before this step. It will only bring up the last patch in the build. B. Select the Backup a Transport Global option to create a backup message. You must use this option and specify what to backup; the entire Build or just Routines. The backup message can be used to restore the routines and components of the build to the pre-patch condition. i. At the Installation option menu, select Backup a Transport Global ii. At the Select INSTALL NAME prompt, enter your build (MAG*3.0*371). iii. When prompted for the following, enter "R" for Routines or "B" for Build. Select one of the following: B Build R Routines Enter response: Build iv. When prompted "Do you wish to secure this message? NO//", press and take the default response of "NO". v. When prompted with, "Send mail to: Last name, First Name", press to take default recipient. Add any additional recipients. vi. When prompted with "Select basket to send to: IN//", press and take the default IN mailbox or select a different mailbox. C. You may also elect to use the following options: i. Print Transport Global - This option will allow you to view the components of the KIDS build. ii. Compare Transport Global to Current System - This option will allow you to view all changes that will be made when this patch is installed. It compares all of the components of this patch, such as routines, DDs, templates, etc. D. Select the Install Package(s) option and choose the patch to install. i. If prompted 'Want KIDS to Rebuild Menu Trees Upon Completion of Install? NO//', answer NO. ii. When prompted 'Want KIDS to INHIBIT LOGONs during the install? NO//', answer NO. iii. When prompted 'Want to DISABLE Scheduled Options, Menu Options, and Protocols? NO//', answer NO. iv. When prompted 'Delay Install (Minutes): (0 - 60): 0//', answer 0. v. Enter the Device you want to print the Install messages. You can queue the install by enter a 'Q' at the device prompt. Enter a '^' to abort the install. DEVICE: HOME// Linux Telnet /SSh MAG*3.0*371 ------------------------------------------------------------------------- Install Started for MAG*3.0*371: May 10, 2026@13:06:23 Build Distribution Date: Apr 10, 2026 Installing Routines: May 10, 2026@13:06:23 Running Post-Install Routine: POS^MAGIP371 Post Install Mail Message: May 10, 2026@13:06:23 Updating Routine file... Updating KIDS files... MAG*3.0*371 Installed. May 10, 2026@13:06:23 ------------------------------------------------------------------------- +------------------------------------------------------------+ 100% | 25 50 75 | Complete +------------------------------------------------------------+ Install Completed Installing and Updating the HDIG: For installing or updating the HDIG, refer to the Hybrid DICOM Image Gateway (HDIG) Installation Guide. Post-Installation Instructions: Update the log4j2.xml configuration to support high-volume Q/R processing HDIG servers. Please follow the steps below to update the logging configuration for the HDIG application. 1. Navigate to C:\VixConfig and locate the log4j2.xml file. 2. Create a backup copy of the file. 3. Open log4j2.xml in a text editor. 4. Update the gov.va.med.imaging.vistaimagingdatasource logger configuration to the following: 5. Save the file. 6. Restart the Tomcat service. After installing MAG*3.0*371 on all HDIG Servers at an installation site, open VistA and navigate to the Hybrid DICOM Gateway Menu. Run the Find Async Storage Request Error Queue option. If any errors are listed, requeue the corresponding storage requests so they can be processed again. It is recommended to set up a Task Scheduler to restart the HDIG servers running Q/R every 24 hours to maintain performance and stability. Routine MAGIP371 is a post-installation routine that is automatically deleted after the KIDS installation. Back-Out/Roll Back Plan: ------------------------ Please refer to the Deployment, Implementation, Back-Out and Rollback Guide (MAG3_0P371_DIBRG.PDF) for instructions. Uninstalling the Application: ----------------------------- For uninstalling the HDIG, and instructions on reinstalling the patch (MAG*3.0*392), refer to the Hybrid DICOM Image Gateway (HDIG) Installation Guide. KIDS Uninstall: ---------------- If it is necessary to uninstall the MAG*3.0*371 VistA KIDS, the patch backup must be installed. The Kernel Installation & Distribution System menu option, Backup a Transport Global should have been used to create a patch backup of the build prior to installing the patch. (see Installation Steps section, step 2b). Administrators will need to check MailMan for the backup message sent by the Backup a Transport Global function executed prior to the patch install. The patch backup must first be loaded from the MailMan backup message, by performing the message action Xtract KIDS, followed by the PackMan function INSTALL/CHECK MESSAGE. The patch may then be installed using the Install Package(s) option in the KIDS Installation menu. 1. Navigate to the Mailman inbox containing the patch backup message. a. Select the MAG*3.0*371 backup message as shown below: * Backup of MAG*3.0*371 install on b. At the "Enter message action:" prompt, select the Xtract PackMan option. c. At the "Select PackMan function:" prompt, select the Install/Check Message option. d. Enter Yes at the prompt "OK to continue with Load?" 2. Navigate to the Kernel Installation and Distribution System Menu and select the Installation Menu. From this menu: a. Select the Install Package(s) option and choose the patch to install. i. If prompted 'Want KIDS to Rebuild Menu Trees Upon Completion of Install? NO//', answer NO. ii. When prompted 'Want KIDS to INHIBIT LOGONs during the install? NO//', answer NO. iii. When prompted 'Want to DISABLE Scheduled Options, Menu Options, and Protocols? NO//', answer NO. iv. When prompted 'Delay Install (Minutes): (0 - 60): 0//', answer 0. Example, Loading Patch Backup (Build) -------------------------------------------- IN Basket Search *=New/!=Priority.........Subject...............Lines.From.....Read/Rcvd 13093. [313643] 09/06/24 Backup of MAG*3.0*371 3099 Search finished. Enter message number or command: 13093 Subj: Backup of MAG*3.0*371 on May 06, 2026 [#313643] 05/06/26@12:43 3099 lines From: MANAGER,SYSTEMS In 'IN' basket. Page 1 ------------------------------------------------------------------------- $TXT Created by PROGRAMMER,MAG at DOSO.DOMAIN.EXT (KIDS) on Tuesday, 05/06/26 at 12:42 Warning: Installing this backup patch message will install older versions of routines and Build Components (options, protocols, templates, etc.). Please verify with the Development Team that it is safe to install. Enter message action (in IN basket): Ignore// Xtract KIDS Select PackMan function: 6 INSTALL/CHECK MESSAGE Line 8 Message #313643 Unloading KIDS Distribution MAG*3.0*371b OK to continue with Load? NO// YES Distribution OK! Want to Continue with Load? YES// Loading Distribution... MAG*3.0*371b Example, Installing Patch Backup (Build) ----------------------------------------------- Select OPTION NAME: XPD MAIN Kernel Installation & Distribution System Select Kernel Installation & Distribution System Option: Installation Select Installation Option: 6 Install Package(s) Select INSTALL NAME: MAG*3.0*371 5/15/26@10:52:35 => MAG*3.0*371 TEST v1 ;Created on May 08, 2026@16:59:10 This Distribution was loaded on May 15, 2026@10:52:35 with header of MAG*3.0*371 TEST v1 ;Created on May 08, 2026@16:59:10 It consisted of the following Install(s): MAG*3.0*371 Checking Install for Package MAG*3.0*371 Install Questions for MAG*3.0*371 Want KIDS to INHIBIT LOGONs during the install? NO// No Want to DISABLE Scheduled Options, Menu Options, and Protocols? NO// Enter the Device you want to print the Install messages. You can queue the install by enter a 'Q' at the device prompt. Enter a '^' to abort the install. DEVICE: HOME// HERE MAG*3.0*371 -------------------------------------------------------------------------- Installing Routines: May 15, 2026@10:54:16 Running Post-Install Routine: POS^MAGIP371 Post Install Mail Message: May 15, 2026@10:54:16 Updating Routine file... Updating KIDS files... MAG*3.0*371 Installed. May 15, 2026@10:54:16 ------------------------------------------------------------------------- +------------------------------------------------------------+ 100% | 25 50 75 | Complete +------------------------------------------------------------+ Install Completed Routine Information: ==================== The second line of each of these routines now looks like: ;;3.0;IMAGING;**[Patch List]**;Mar 19, 2002;Build 5 The checksums below are new checksums, and can be checked with CHECK1^XTSUMBLD. Routine Name: MAGIP371 Before: n/a After: B3262531 **371** Routine Name: MAGVAQ01 Before: B87039259 After: B87994365 **118,371** Routine list of preceding patches: 118 ============================================================================= User Information: Entered By : Date Entered : JUL 15, 2024 Completed By: Date Completed: SEP 30, 2026 Released By : Date Released : SEP 30, 2026 ============================================================================= Packman Mail Message: ===================== No routines included