IBM Support

Collecting Troubleshooting Data for the zSecure Suite of Products

Technote (FAQ)


Question

What basic data should be collected to document a problem with any member of the zSecure suite when reporting a problem to IBM?

Answer


Collecting Troubleshooting data early, even before opening the PMR, helps IBM® Support quickly determine if:

  1. Symptoms match known problems (rediscovery).
  2. There is a non-defect problem that can be quickly identified and resolved.
  3. A workaround exists which may reduce current severity.



For all zSecure products, please provide a concise problem description that includes a timeline, sequence of events, and error messages issued by zSecure, the underlying security product or any other component involved in the problem. It is also important to submit the correct product version and current level of maintenance. If a system dump (SVC dump) is captured, please include its title and save it as it may be required for detailed diagnosis.

Are you upgrading? Or has this product worked previously? If so, what has changed since then?


Table of Contents:

zSecure Adapters for QRadar
zSecure Admin
zSecure Alert
zSecure Audit
zSecure CICS Toolkit
zSecure Command Verifier
zSecure Manager for RACF on z/VM
zSecure Visual

Sending Large Files
Submitting Information to IBM Support
Online Self-Help Resources
Related Information

zSecure Adapters for QRadar

- You will need to let IBM Support know whether you are licensed to run ONLY the Adapters for QRadar, or if you also run other products in the zSecure suite.


- Where are you seeing the problem? Provide the most recent sysprint from the problem job. If only licensed for zSecure Adapters, the provided sample job for creating data used with QRadar is CKQJLEEF. Otherwise this job can be either CKQJLEEF or C2EJQRLF.

Home

zSecure Admin

-For Admin ISPF errors, send in screenshots and session sysprint.


-Sending in the output from the CKFCOLL job used in creating your current CKFREEZE file is something support will ask for very frequently. This will show whether your CKFREEZE contains all needed and relevant information to your problem.

-Depending on what your problem is you may also want to send in DB2 level and audit information, system load at the time of your problem, and a syslog covering the time frame of the problem.

-A copy of your CKFREEZE can sometimes be requested by support. See 'Sending Large Files' for information on how to do this.

-Check preexisting PTFs for any that may relate to your problem.

Home

zSecure Alert

-Describe the nature of your problem. Are you running ACF2 or RACF? Does Alert properly start up and can you perform a Verify/Refresh via a line command on the SE.A.A panel? If not what errors do you receive and be sure to save off a sysprint for submission to zSecure Support.


-Is there a particular Alert number that is not properly alerting you when you believe it should?

-Sending in your C2PCUST dataset can be very useful for issues with Alert, and can sometimes be requested by Support. See 'Sending Large Files' for information on how to do this.

-This technote may prove useful, Why is zSecure Alert not reporting some selected alerts?

-Whether you are using RACF or ACF2, check preexisting PTFs for any that may relate to your problem.

Home

zSecure Audit

-Describe the nature of your problem. Are you running ACF2, RACF, or Top Secret? What part of Audit is your problem associated with? For example, this may be status(AU.S) or compliance testing(AU.R).


-If compliance, please provide the subset of rules you are testing against as well as the individual failing rule(s). Check out our fixes by version page for any new PTFs relating to compliance testing.

-Ensure that your CKFREEZE is up to date (less than a day old) and please provide output from the CKFCOLL job used to create it.

Home

zSecure CICS Toolkit

-Along with the zSecure CICS Toolkit release and maintenance level, you will also want to provide the underlying CICS release.


-Provide the JCL and joblog for any reports/jobs involved, and also Include screenshots that may contain any relevant output/messages.

-Check preexisting PTFs for any that may relate to your problem.

Home

zSecure Command Verifier

-Please provide both the expected behavior of Command Verifier and the actual behavior you are experiencing, with output.


-Check preexisting PTFs for any that may relate to your problem.

Home

zSecure Manager for RACF on z/VM

-Please provide Installation - Defined settings (CKRSITE load library), and CKVECOLL parameters specified when creating your active CKFREEZE.


-Your active C2R$PARV configuration profile as well as any relevant SMF data is also useful in diagnosing problems.

-Check preexisting PTFs for any that may relate to your problem.

Home

zSecure Visual

-Please provide information on your server as a whole. This info can be found in about-server.box inside the run subdirectory. You can also find this information from the Server Information option of the Help menu.


-Server logs, bbracf.log and server.log, are found in the log subdirectory within the Server Root directory. This directory is identified by the C2RSERVE parameter in the C2R$PARM used by the Server.

You can use the c2rdiag command to collect diagnostic information, which includes logs and other information, for sending to support. This is executed by navigating to the the Server Root directory and running the command ./bin/c2rdiag and creates file, C2Rdiag_dump_xxxx.tar (where xxxx represents a time stamp) which you can then transfer to IBM in binary mode.
*Note c2rdiag must be run under a userid with root authority*

-The SYSPRINT from the last CKRCARLA run, the CKGPRINT from the last CKGRACF run, and the commands issued are available through the client's communication window.

-The MVS syslog surrounding the time of the error can also help.

-Check preexisting PTFs for any that may relate to your problem.

Home

Submitting Information to IBM Support

After a Case is open, you can submit data files to IBM using one of the following methods:

    -FTP: Please go to this link for instructions on how to send data via FTP for My Support cases: FTP instructions
    Additional information for z/OS data is available at this link. This information has not yet been updated for My support Cases. Substitute the My Support case number for the PMR, Branch and Country number in the examples.
      NOTE:PDDU is not yet supported for My Support cases

    -Email: If FTP is not possible, or if files are <2MB, use the email ecurep@ecurep.ibm.com.

To email please follow these conventions:

Email small files (<2MB) to ibmsecurity_support@ecurep.ibm.com. The subject line MUST follow this format - TSaaaaaaaaa

Where aaaaa = Case number, xxx = Descriptive text for the file

Your Case will be updated when either an email or file arrives, but only if the naming convention for the subject or file is followed. If you do not follow the specified naming convention, the email or file will be stored incorrectly and will effectively be lost.


Home

Sending Large Files

When submitting large files to Support, some additional steps may be needed.

Submitting a CKFREEZE, SMF, or C2PCUST dataset:
1) Execute the following TSO command to put the CKFREEZE/SMF/C2PCUST file into XMIT format.
NOTE: SMF datasets may not need to be placed in XMIT format unless the support analyst requests you to do so. These SMF datasets may be tersed and sent to IBM. Please send the DCB parameters of your SMF datasets to the support analyst for instructions prior to sending

XMIT x.x DATASET('my.file') OUTDATASET('my.file.xmit')

(the notation of "x.x" is just a dummy required operand acting as a place holder, as the output is going to a data set, not a network destination)

2) Then execute TRSMAIN against the data set "my.file.xmit", giving an output data set name the low level qualifier of "TRS".

3) Transmit via FTP using the above information in binary mode.

Home

Online Self-Help Resources

  • Review up-to-date product information at the zSecure support page. (Enter the zSecure product you are looking for within the product finder search bar).

  • Utilize the IBM Service Request (SR) tool to access the IBM Security zSecure support team when requiring assistance from IBM.
  • Access online content on supported versions of the zSecure suite via the IBM Knowledge Center.

Home

Related Information

Recommended Fixes:
Home


Cross reference information
Segment Product Component Platform Version Edition
Security IBM Security zSecure suite

Document information

More support for: IBM Security zSecure Admin

Software version: Version Independent

Operating system(s): z/OS

Software edition: Enterprise

Reference #: 1980023

Modified date: 26 February 2018