PM14103: IDSSCANEXCLUSION LIST NOT TOTALLY PROCESSED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• An IDSRule policy is defined with an IDSScanExclusion list to
  inhibit generating IDS events for certain servers.  If this list
  has more than 21 entries it does not get completely copied into
  the TCPIP stack (sce_idsScanExclEntry array), causing all
  addresses to be excluded (mask and address are both 0's).
  

Local fix

• Limit the IDSScanExclusion to 21 entries or less (specify the
  most active scanners).
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of the IBM Communications Server   *
  *                 for z/OS Version 1 Release(s) 10, 11, and    *
  *                 12 IP                                        *
  ****************************************************************
  * PROBLEM DESCRIPTION: IDSScanExclusion list entries are       *
  *                      limited to 21 or less.                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In the IDSRule policy an IDSScanExclusion list is limited to
  21 entries. If more than 21 entries are in the policy then
  the exclusion list information can not be completely copied
  into the TCPIP stack (sce_idsScanExclEntry array), causing all
  addresses to be excluded (mask and address are both 0's).
  +-------------------------------------------------------------+
  + Please check our Communications Server for OS/390 homepages +
  + for common networking tips and fixes.  The URL for these    +
  + homepages can be found in Informational APAR II11334.       +
  +-------------------------------------------------------------+
  

Problem conclusion

• Code in the stack has been modified to move all the entries
  in the IDSScanExclusion list.
  
  * Cross Reference between External and Internal Names
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UK57661 UK57662 UK57663

Modules/Macros

•    EZBIPPCT
  

Fix information

• Fixed component name

  TCP/IP V3 MVS

• Fixed component ID

  5655HAL00

Applicable component levels

• R1A0 PSY UK57661

     UP10/07/15 P F007

• R1B0 PSY UK57662

     UP10/07/15 P F007

• R1C0 PSY UK57663

     UP10/07/15 P F007

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.