IV31299: A SPECIFIC WINDOWS EVENTLOG MESSAGE IS NOT RECOGNIZED BY TECWINADAPTER

3.9.0.8-TIV-TEC-IF0137 IBM Tivoli Enterprise Console Version 3.9 Interim Fix
3.9.0.8-TIV-TEC-IF0138 IBM Tivoli Enterprise Console Version 3.9 Interim Fix

APAR status

• Closed as program error.

Error description

• A specific event is not recognized by Windows log file adapter.
  When processing the Windows eventlog, if TecWinAdapter is
  returned an error code by Windows API that indicates
  ERROR_EVT_MESSAGE_NOT_FOUND, the adapter ignored the message.
   Though the Windows API returns error, adapter could read some
  iformation as the event message string.
  <recretaion steps>
  1. Put eventlog in question below as System.evtx on an
  Windows2008 environment.
  ===============================================================
  ?Label??????:?Error
  ?Date and Time??:?2012/10/04 10:30:23
  ?Source ?????:?HP Fibre Channel
  ?EventID?????:?6
  ?Task Category  ?:?(11)
  ?Description  ??:?"A fibre channel HBA port has changed to &#65463; &#65492;?
                          a state of link down. <snipped>
  ================================================================
  2. Set NumEventsToCatchUp=-1
  3. Reset the value
  \\HKLM\SOFTWARE\Wow6432Node\Tivoli\TECWINAdapter\EventLog\System
  \LastRecordWinEvt to 0
  4. start the TecWinAdapter service.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of the Event Log adapter on Windows
  ****************************************************************
  * PROBLEM DESCRIPTION: When an Event Log message cannot be
  formatted using the Windows APIs, an error message is written to
  the TEC adapter log and the Event Log message is ignored. With
  the fix, an attempt will be made to put the raw data from the
  Event Log message into the TEC Event.
  ****************************************************************
  * RECOMMENDATION: Apply the maintenance package listed in the
  Problem Conclusion.
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following maintenance
  package:
    | Interim Fix | 3.9.0.8-TIV-TEC-IF0137
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TIVOLI ENT.CONS

• Fixed component ID

  5698TEC00

Applicable component levels

• R390 PSY

     UP