OA60150: CKQCEF USES DVCPID LABEL BUT SENDS NON-INTEGER VALUE (JOBID)

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• CKQCEF uses dvcpid label but sends non-integer value (jobid).
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Audit exploiting the        *
  *                 software to prepare data for ArcSight SIEM.  *
  ****************************************************************
  * PROBLEM DESCRIPTION: The zSecure Audit ArcSight SIEM         *
  *                      interface generates CEF files that      *
  *                      contain non-integer process ID values   *
  *                      for the 'dvcpid' key so that these      *
  *                      values cannot be processed by the       *
  *                      ArcSight receiver.                      *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  The job IDs generated by the zSecure Audit ArcSight SIEM
  interface are represented by non-integer values under the
  'dvcpid' keys in a CEF file so that the corresponding CEF
  records cannot be processed by the ArcSight event receiver.
  

Problem conclusion

• zSecure Admin/Audit has been modified so that the job IDs are
  written to a CEF file using the 'externalId' key so that the
  ArcSight event receiver processes the corresponding CEF records
  correctly.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ04167

Modules/Macros

• C2PS1101 C2PS1102 C2PS1103 C2PS1123 CKQCEFG
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R240 PSY UJ04167

     UP20/10/17 P F010

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.