IV65900: LOG FILE AGENT WINDOWS EVENT LOG EVENT ID NOT DETECTED PROPERLY

Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005

APAR status

• Closed as program error.

Error description

• When Windows event ID is zero,  Log File Agent shows random
  Event ID.
  
  Set trace to below and in the Log FIle Agent log you see
  following ERROR message "Error retrieving EventId".
  
  ERROR (UNIT:logmonitor ALL) (UNIT:GenericAgent ALL)
  (UNIT:kumpfile ALL) (UNIT:Kum0regx ALL) (UNIT:kumprmfr ALL)
  (UNIT:WinLogQuery ALL)
  
  Log snippet:
  (2014/10/02,21:33:04.004C-414:winlogqueryclass.cpp,799,"renderEv
  ent") Error retrieving EventId
  

Local fix

Problem summary

• When the Windows Event log event ID is zero, Log File Agent
  shows a random event ID.
  
  This occurs on Windows operating systems only with Log File
  Agent version 6.3.0 Interim Fix 0003 (6.3.0-TIV-ITM_LFA-IF0003)
  and earlier.
  

Problem conclusion

• Initialize EventID to zero.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
  
  | interim fix | 6.3.0-TIV-ITM_LFA-IF0004
  
  available at
  http://www.ibm.com/support/docview.wss?uid=swg24039388
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM LOG FILE AG

• Fixed component ID

  5724C04LF

Applicable component levels

• R630 PSY

     UP