IV19855: SOME CISCO GSS EVENTS WERE NOT PARSING CORRECTLY, AND REQUIRE A MODIFICATION IN THE PARSING RULES

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • The following Cisco GSS events are causing a creation of a Cisco
    IOS sensor and are categorized as such:
    
    Apr 13 15:20:02 10.21.5.2 NEST-TCS.NS1.com : Apr 13 15:10:49 :
    %KAL-6-KALAPCIRCUIT-TIMEOUT: [1918] Circuit keepalive
    [10.23.8.101] timeout [KAL_OFFLINE]
    Apr 13 15:18:27 10.21.5.2 NEST-TCS.NS1.com : Apr 13 15:10:44 :
    %KAL-4-KALAPCIRCUIT-DOWN: [1918] Retrying Circuit IP
    [10.23.8.101] (Retry Count [1])
    Apr 13 15:17:08 10.21.5.2 NEST-TCS.NS1.com : Apr 13 15:10:11 :
    %KAL-7-KALTCP-C: [1918] KAL_RSP_OK [10.23.8.101:80]
    numSuccessfulProbes:1
    Apr 13 15:16:27 10.21.5.2 NEST-TCS.NS1.com : Apr 13 15:10:11 :
    %KAL-7-KALTCP-C: [1918] TCP-Connect (seq# 292198339)=> Host
    10.23.8.101:80
    
    parsing rules need to be modified to resolve this.
    

Local fix

  • n/a
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: All TSOM users.
    ****************************************************************
    * PROBLEM DESCRIPTION:
    * Some of the Cisco GSS events were not parsed correctly due to
    * incomplete matching pattern.
    ****************************************************************
    * RECOMMENDATION: Install recent Device Rules Update
    *  Package 2012/06
    ****************************************************************
    

Problem conclusion

  • The fix for this APAR will be contained in the following
    maintenance packages:
    | fix pack | 4.1.1-TIV-TSOM-FP016.
    

Temporary fix

  • The fix will be the part of TSOM 4.1/4.1.1
    Device Rules Update Package:
    2012/06.
    

Comments

APAR Information

  • APAR number

    IV19855

  • Reported component name

    OPS MGR CENT MG

  • Reported component ID

    5724P8600

  • Reported release

    411

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2012-04-18

  • Closed date

    2012-07-02

  • Last modified date

    2012-07-02

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    OPS MGR CENT MG

  • Fixed component ID

    5724P8600

Applicable component levels

  • R411 PSY

       UP



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Tivoli Security Operations Manager
Central Management

Software version:

411

Reference #:

IV19855

Modified date:

2012-07-02

Translate my page

Machine Translation

Content navigation