IV15762: INCOMPLETE EVENT DESCRIPTION IN WINDOWS 2008

IBM Tivoli Monitoring 6.2.2 Fix Pack 9 (6.2.2-TIV-ITM-FP0009)
IBM Tivoli Monitoring: Windows (R) OS Agent 6.2.2.4-TIV-ITM_WIN-IF0004

APAR status

• Closed as program error.

Error description

• Approver Initials:    gc
  
  Description:
  Starting From Windows 2008 and Vista, and following releases,
  the additional event information that could be inserted or
  appended to the event description, are not displayed in the
  description attribute of the Event Log attribute group,
  if the base description of the event is missing.
  Only the default string "N/A" is displayed in TEP when the
  description is not available.
  
  RECREATE INSTRUCTIONS:
  Using the Windows event viewer, identify an event which has a
  missing description and verify that it appears as N/A in TEP.
  The additional data of the event can be displayed in the Windows
  event viewer looking at the event properties, in the XML view of
  the Details tab.
  

Local fix

Problem summary

• Event description is incomplete in the Windows OS Agent Event
  Log attribute group on Windows 2008.
  
  On Windows 2008, Vista and subsequent releases, event
  information that could be inserted or appended to the event
  description is not displayed in the description attribute of the
  Event Log attribute group if the base description of the event
  is missing. Instead, the default string "N/A" is displayed in
  the portal when the description is not available.
  For this APAR fix to be effective, a new environment variable
  has been added. See the Install Actions section of the APAR
  conclusion for more details.
  

Problem conclusion

• For Windows 2008 and beyond, the following environment variables
  can be used in the KNTENV file to control this behavior:
  
  Install Actions:
  
  NT_LOG_APPEND_XML_DATA - Set to 1 to enable, 0 to disable
  (default) - When enabled, this will cause the EventData or
  UserData to be appended to the event description up to the
  maximum length of 1128 bytes and truncated beyond that. The data
  will be appended in XML format as it can be displayed in the
  Windows event viewer by looking at the event properties in the
  XML view of the Details tab.
  
  NT_LOG_TRACE_EVENTID - Set to a specific event ID - When
  specified, this will trace the complete event information in XML
  format in the trace log file.  This parameter can be used for
  Windows 2008 and later, only after setting
  NT_LOG_APPEND_XML_DATA=1.
  
  
  The fix for this APAR is contained in the following maintenance
  package:
    | fix pack | 6.2.2-TIV-ITM-FP0009
    | fix pack | 6.2.3-TIV-ITM-FP0002
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM AGENT WINDO

• Fixed component ID

  5724C040W

Applicable component levels

• R622 PSY

     UP

• R623 PSY

     UP

• R610 PSN

     UP

• R620 PSN

     UP

• R621 PSN

     UP