Tivoli Compliance Insight Manager (TCIM) z/OS Enabler u0915 abend

Technote (troubleshooting)


Problem(Abstract)

The collect is empty on the TCIM server, but the agent appears to be working correctly. An IEF450I C2EAUDIT STEP1 - ABEND=S000 U0915 REASON=00000000 TIME=hh.mm.ss JOB#=nnnnnn message is seen in the syslog.

Symptom

(Please note: this also applies to Tivoli Security Information and Event Manager, TSIEM.)

The z/OS Enabler gets a U0915 abend reported in the syslog. This occurs when a collect process is attempting to start based upon the schedule in the TCIM management console. The agent continues to run but the collect process fails. Additional errors may be seen in the syslog:

+C2E120I: 5050: C2EAUDIT: 50462976: Collect SMF error occurred in CKRCARLA - see
yyyy-mm-dd.hh:mm:ss.CKRCARLA.SYSPRINT
+C2E102I: 5050: C2EAUDIT: 84017408: End of zOS_collect_events.sh with rc=8; id=18.1.xxx
+C2E103I: 5050: C2EAUDIT: 16909748: Agent root is /path/etc/C2EAUDIT/actuator

The sysprint may be empty even though the messages point to the sysprint.
Other messages that relate to the zFS/HFS datasets used by the TCIM z/OS agent such as allocation of space or availability of storage devices may also be seen in the syslog prior to the U0915 abend, like those below:

IGD17273I ALLOCATION HAS FAILED FOR ALL VOLUMES SELECTED FOR DATA SET
488 ZFS.OMVS.ETC.C2EAUDIT
IGD17277I THERE ARE (8) CANDIDATE VOLUMES OF WHICH (7) ARE ENABLED O QUIESCED
IGD17290I THERE WERE 1 CANDIDATE STORAGE GROUPS OF WHICH THE FIRST 1 WERE
ELIGIBLE FOR VOLUME SELECTION. THE CANDIDATE STORAGE GROUPS WERE:dasdxx
IGD17279I 1 VOLUMES WERE REJECTED BECAUSE THE SMS VOLUME STATUS WAS
DISABLED
IGD17279I 2 VOLUMES WERE REJECTED BECAUSE THEY WERE ON THE EXCLUDE L
IEF196I IEC614I EXTEND FAILED - RC 000, DIAGNOSTIC INFORMATION IS
IEF196I (04034379) ,
IEF196I OMVS, ,ZFS.OMVS.ETC.C2EAUDIT
IEC614I EXTEND FAILED - RC 000, DIAGNOSTIC INFORMATION IS (04034379)
493 OMVS, ,ZFS.OMVS.ETC.C2EAUDIT


Cause

zFS/HFS most likely ran out of space or dasd is not available for the allocation of the short lived files. The zFS/HFS is made up of short lived and long lived files in the run and log directories. The long lived files are files that remain after and between the collect process. The short lived files are files that only exist during the collect process. The short lived files are where large amounts of the space is used.

Diagnosing the problem

Look for additional error messages in the syslog prior to the U0915 error message. The additional error messages will provide the data needed to diagnose the problem.


Execute "df -kv" from the UNIX command line and look at the output. Specifically review the HFS/ZFS related to C2EAUDIT and review the total and available space. At least 50% of the total space needs to be available to allow the allocation of the short lived files. However more space may be required depending on the amount of SMF records being processed:

$ df -kv
Mounted on Filesystem Avail/Total Files Status
/u/usr/lpp/c2e (OMVS.TIVOLI.C2EAUDIT) 53860/65520 4294967140 available
HFS, Read/Write, Device:79, ACLS=Y
File System Owner : xxxx Automove=Y Client=Y
Filetag : T=off codeset=0
Filetag : T=off codeset=0


Resolving the problem

The problem is an allocation related problem with the short lived files during the collect process. The problem can only be corrected by addressing the cause of the allocation failure. Increase the space so that at least 50% of the total space is available. However more space may be required depending on the amount of SMF records being processed.

Cross reference information
Segment Product Component Platform Version Edition
Security Tivoli Security Information and Event Manager 2.0 Enterprise
Security IBM Security zSecure Audit
Security IBM Security zSecure suite

Rate this page:

(0 users)Average rating

Document information


More support for:

Tivoli Compliance Insight Manager
Actuator /Agent

Software version:

8.5

Operating system(s):

z/OS

Software edition:

Enterprise

Reference #:

1298003

Modified date:

2014-05-02

Translate my page

Machine Translation

Content navigation