OA64563: CKR1483 12 SYSLOG MESSAGE SYSSTAT HAS MORE THAN 1 LINE

APAR status

• Closed as program error.

Error description

• CKR1483 12 Syslog message SYSSTAT has more than 1 line.
  
  This can be seen when CKQRADAR processes SMF record type 90
  subtype 9, for example:
  
  CKR1483 12 Syslog message SYSSTAT has more than 1 line, SYSSTAT
  at CKRCARLA(CKQLEEFL) line 838
  LEEF:1.0|IBM|z/OS|2.5|90-9|devTimeFormat=yyyy-MM-dd'T'HH:mm:ss.S
  SSZ.devTime=2023-03-21T09:53:53.820+0100.actrec=0.inactrec=4.sum
  =Operator command IPL SMF for subsys SYS write SMF types
  0:3,6:18,21:33,36:39,41:98,100:125,127:180,182:255
                        -|
  .actrec=1.inactrec=5
                        -|
  .actrec=2.inactrec=19
                        -|
  .actrec=3.inactrec=20
  
  etc.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Audit exploiting the        *
  *                 software to prepare data for QRadar SIEM.    *
  ****************************************************************
  * PROBLEM DESCRIPTION: zSecure Audit might issue a MSGCKR1483  *
  *                      while processing SMF data to prepare    *
  *                      input for the QRadar SIEM.              *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  When an SMF source being processed by zSecure Audit contains
  "System status" records (type 90) having sub-types 5, 9, 13, or
  15, the zSecure Audit generates incorrectly formatted data
  resulting in a MSGCKR1483 which begins with the text "Syslog
  message SYSSTAT has more than 1 line...".
  

Problem conclusion

• zSecure Audit has been modified, so that it does not issue a
  MSGCKR1483 while processing SMF data to prepare input for the
  QRadar SIEM for SMF records types 90, sub-types 5, 9, 13, and
  15.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ92815

Modules/Macros

• CKASINT  CKQCEFG  CKQLEEF  CKQLEEFL GKRSINT
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R250 PSY UJ92815

     UP23/05/24 P F305