IZ28883: When using logMonXReverseFilter in exclude mode, LogMonX is matching lines that match both (or neither) expressions.

IBM Tivoli 4.0.0-TIV-SSM-FP0010
IBM Tivoli 4.0.0-TIV-SSM-FP0011
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 12 README 4.0.0-TIV-SSM-FP0012
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 13 README 4.0.0-TIV-SSM-FP0013
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 14 README 4.0.0-TIV-SSM-FP0014
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.14-TIV-SSM-IF0001
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 2 README 4.0.0.14-TIV-SSM-IF0002
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 3 README 4.0.0.14-TIV-SSM-IF0003
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 4 README 4.0.0.14-TIV-SSM-IF0004
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 5 README 4.0.0.14-TIV-SSM-IF0005
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 6 README 4.0.0.14-TIV-SSM-IF0006
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 7 README 4.0.0.14-TIV-SSM-IF0007
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 8 README 4.0.0.14-TIV-SSM-IF0008
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.15-TIV-SSM-IF0001

APAR status

• Closed as program error.

Error description

• The logmonXControlRow was created with the following settings:
  
  logmonXControlLogFile = C:\logfile.txt
  logmonXControlInterval = 4
  logmonXControlFilter = ABC
  logmonXControlReverseFilter: XYZ
  logmonXControlMode: exclude
  logmonXControlWindowSize: 10
  
  Now the logmonXStatsMatches is occurring for any line that has
  both the filter expression (ABC in this case) & Reversefilter
  Expression (XYZ in this case).
  
  For Ex: the Following lines were found to create a match:
  echo "XYZ this is a Test Log line ABC" >> C:\logfile.txt
  echo "ABC This is a Test Log line XYZ" >> C:\logfile.txt
  
  But the Log file match should only happen when a string not
  matching logmonXControlFilter expression matches
  logmonXControlReverseFilter.
  

Local fix

Problem summary

• The issue was that regardless of mode, ReverseFilter was being
  tested as if mode was always "include".
  

Problem conclusion

• The fix was to only test ReverseFilter when the inverted result
  of Filter is true, in exclude mode.
  
  The fix for this APAR is contained in the following maintenance
  packages:
     | fix pack | 4.0.0-TIV-SSM-FP0006
     | LA interim fix | 4.0.0-TIV-SSM-LA0005
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  NETCOOL SYS SVC

• Fixed component ID

  5724P4300

Applicable component levels

• R400 PSY

     UP