The collect is empty on the TCIM server, but the agent appears to be working correctly. An IEF450I C2EAUDIT STEP1 - ABEND=S000 U0915 REASON=00000000 TIME=hh.mm.ss JOB#=nnnnnn message is seen in the syslog.
(Please note: this also applies to Tivoli Security Information and Event Manager, TSIEM.)
The z/OS Enabler gets a U0915 abend reported in the syslog. This occurs when a collect process is attempting to start based upon the schedule in the TCIM management console. The agent continues to run but the collect process fails. Additional errors may be seen in the syslog:
+C2E120I: 5050: C2EAUDIT: 50462976: Collect SMF error occurred in CKRCARLA - see
+C2E102I: 5050: C2EAUDIT: 84017408: End of zOS_collect_events.sh with rc=8; id=18.1.xxx
+C2E103I: 5050: C2EAUDIT: 16909748: Agent root is /path/etc/C2EAUDIT/actuator
The sysprint may be empty even though the messages point to the sysprint.
Other messages that relate to the zFS/HFS datasets used by the TCIM z/OS agent such as allocation of space or availability of storage devices may also be seen in the syslog prior to the U0915 abend, like those below:
IGD17273I ALLOCATION HAS FAILED FOR ALL VOLUMES SELECTED FOR DATA SET
IGD17277I THERE ARE (8) CANDIDATE VOLUMES OF WHICH (7) ARE ENABLED O QUIESCED
IGD17290I THERE WERE 1 CANDIDATE STORAGE GROUPS OF WHICH THE FIRST 1 WERE
ELIGIBLE FOR VOLUME SELECTION. THE CANDIDATE STORAGE GROUPS WERE:dasdxx
IGD17279I 1 VOLUMES WERE REJECTED BECAUSE THE SMS VOLUME STATUS WAS
IGD17279I 2 VOLUMES WERE REJECTED BECAUSE THEY WERE ON THE EXCLUDE L
IEF196I IEC614I EXTEND FAILED - RC 000, DIAGNOSTIC INFORMATION IS
IEF196I (04034379) ,
IEF196I OMVS, ,ZFS.OMVS.ETC.C2EAUDIT
IEC614I EXTEND FAILED - RC 000, DIAGNOSTIC INFORMATION IS (04034379)
493 OMVS, ,ZFS.OMVS.ETC.C2EAUDIT
zFS/HFS most likely ran out of space or dasd is not available for the allocation of the short lived files. The zFS/HFS is made up of short lived and long lived files in the run and log directories. The long lived files are files that remain after and between the collect process. The short lived files are files that only exist during the collect process. The short lived files are where large amounts of the space is used.
Diagnosing the problem
Look for additional error messages in the syslog prior to the U0915 error message. The additional error messages will provide the data needed to diagnose the problem.
Execute "df -kv" from the UNIX command line and look at the output. Specifically review the HFS/ZFS related to C2EAUDIT and review the total and available space. At least 50% of the total space needs to be available to allow the allocation of the short lived files. However more space may be required depending on the amount of SMF records being processed:
$ df -kv
Mounted on Filesystem Avail/Total Files Status
/u/usr/lpp/c2e (OMVS.TIVOLI.C2EAUDIT) 53860/65520 4294967140 available
HFS, Read/Write, Device:79, ACLS=Y
File System Owner : xxxx Automove=Y Client=Y
Filetag : T=off codeset=0
Filetag : T=off codeset=0
Resolving the problem
The problem is an allocation related problem with the short lived files during the collect process. The problem can only be corrected by addressing the cause of the allocation failure. Increase the space so that at least 50% of the total space is available. However more space may be required depending on the amount of SMF records being processed.
|Security||Tivoli Security Information and Event Manager||2.0||Enterprise|
|Security||IBM Security zSecure Audit|
|Security||IBM Security zSecure suite|