OA60046: CKQCEF SENDS IPV6 ADDRESSES TO ARCSIGHT USING SRC AND DST LABELS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• CKQCEF sends IPv6 addresses to Arcsight using src and dst
  labels, which it cannot process.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Audit exploiting the        *
  *                 software to prepare data for ArcSight SIEM.  *
  ****************************************************************
  * PROBLEM DESCRIPTION: The zSecure Audit ArcSight SIEM         *
  *                      interface might generate CEF files that *
  *                      contain IPv6 address values for 'src'   *
  *                      and 'dst' keys so that these values     *
  *                      cannot be processed by the ArcSight     *
  *                      receiver.                               *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  When IPv6 addresses are present in the SMF record, the zSecure
  Audit ArcSight SIEM interface writes such addresses to a CEF
  file using 'src'/'dst' keys, so that the corresponding CEF
  records cannot be processed by the ArcSight event receiver.
  

Problem conclusion

• zSecure Admin/Audit has been modified so that the IPv6 addresses
  are written to a CEF file using c6a2 and c6a3 keys so that the
  ArcSight event receiver processes the corresponding CEF records
  correctly.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ04092

Modules/Macros

• CKQCEFG
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R240 PSY UJ04092

     UP20/11/02 P F010

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.