IBM Support

OA62803: ENHANCEMENT TO CATER FOR REMOTE SYSLOG DEVICES THAT BREAK NEWLY ESTABLISHED TCP CONNECTIONS

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as new function.

Error description

  • Enhancement to cater for remote syslog devices that break newly
    established TCP connections.
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: Users of zSecure Admin, Audit, and Alert     *
    *                 exploiting report/alert destination to       *
    *                 remote SYSLOG devices that abort TCP         *
    *                 connections almost immediately after         *
    *                 establishing.                                *
    ****************************************************************
    * PROBLEM DESCRIPTION: zSecure Admin, Audit, and Alert fail to *
    *                      send generated reports to remote SYSLOG *
    *                      devices that abort TCP connections      *
    *                      almost immediately after establishing   *
    *                      resulting in flooding spool with        *
    *                      MSGCKR3041 and MSGCKR3040.              *
    ****************************************************************
    * RECOMMENDATION: Apply the PTF provided.                      *
    ****************************************************************
    When a remote SYSLOG device is aborting TCP connection almost
    immediately after establishing,  zSecure Admin, Audit, and Alert
    fail to recover such connection so that generated reports are
    lost and spool is filled with MSGCKR3041 which begins with the
    text "Waiting for connection to ..." and MSGCKR3040 which begins
    with the text "Connect on socket <num> succeeded to destination
    ...".
    

Problem conclusion

  • zSecure Admin, Audit, and Alert have been extended to handle
    remote SYSLOG devices that abort TCP connection almost
    immediately after establishing, so that generated reports are
    properly sent to such devices.
    

Temporary fix

Comments

APAR Information

  • APAR number

    OA62803

  • Reported component name

    ZSEC BASE,ADMIN

  • Reported component ID

    5655T0100

  • Reported release

    240

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2022-02-22

  • Closed date

    2022-03-31

  • Last modified date

    2022-04-01

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UJ07997 UJ08014

Modules/Macros

  • CKASMRD  CKRCIB   CKRDBGS  CKRLINIT CKRMAIN  CKROUNIT CKRPRTR
    GKRCIB   GKRDBGS  GKRLINIT GKRMAIN  GKROUNIT GKRPRTR  GKRSMRD
    

Fix information

  • Fixed component name

    ZSEC BASE,ADMIN

  • Fixed component ID

    5655T0100

Applicable component levels

  • R240 PSY UJ08014

       UP22/04/01 P F203

  • R250 PSY UJ07997

       UP22/04/01 P F203

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSPQTM","label":"IBM Security zSecure Admin"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"240"}]

Document Information

Modified date:
02 April 2022