IV68698: WITH JAPANESE LOCALE, BACKSLASH CHARACTER IS WRONGLY TRANSLATED WHEN INCLUDED IN TAKE ACTION COMMAND STRING

Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005

APAR status

• Closed as program error.

Error description

• When an event which is detected by the Log File agent is
  output from a situation using a Take Action command, by a
  redirection, etc.; a single-byte character "\" is displayed
  as double-byte"middle point" character.
  
  The character is correctly displayed in the portal indicating
  that it is correctly read and translated by the agent when read
  from the monitored log file.
  
  The problem only occurs when the attribute containing backslash
  is used in a Take Action command.  When the character is read
  from input monitored file, it is converted from
  ibm-943_P15A-2003 to UTF-8, becoming 0xC2A5 (UTF8 representation
  of backslash\yen).  When the take action is performed, the agent
  translates it from UTF-8 to CP932 which results in the character
  code 0xFCFC.
  
  Affected Versions:
  The problem exists on the Log File Agent version 6.3.0 interim
  fix 0003 and earlier, with Japanese locale.  It is platform
  independent.
  
  
  Problem Determination:
  On the LO agent system, enable:
  KBB_RAS1= ERROR (UNIT:logmonitor all)(UNIT:kum0nget all)
  (UNIT:kumprmfr ALL) (UNIT:task ALL) (UNIT:command ALL)
  
  The agent RAS1 log
  <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log
  contains trace entries are similar to the following:
  
  ...
  (54B982FE.000A-B30:kum0nget.c,411,"TranslateStringToUTF8") Entry
  (54B982FE.000B-B30:kum0nget.c,419,"TranslateStringToUTF8")
  Converting string buffer from ibm-943_P15A-2003 to UTF-8
  ...
  (54B982FE.000F-B30:kumprmfr.c,449,"KUMP_ReadMonitorFileUnicodeRe
  cord") <0x5FD6678,0x19>
  +54B982FE.000F     00000000   2045206C 696E6461  C2A56C69
  6E6461C2   .E.linda..linda.
  +54B982FE.000F     00000010   A56C696E 6461200D  0A
  ...
  ...
  (54B982FE.00BE-F20:tasklibrary.cpp,1531,"ConvertCommandToLocal")
  Converting UTF-8 command to codepage 932
  
  ...
  (54B982FE.00DC-F20:tasklibrary.cpp,864,"executeTaskRequest")
  Executing task cmd /c "echo linda&#65409;&#65409;linda&#65409;&#65409;linda
  >>c:\output.sit"
  
  RECREATE INSTRUCTIONS:
  Using a kloagent instance on a Windows platform running a
  Japanese locale:
  
  1. In the conf file, monitor a log file.
  
  LogSources=testin.log
  
  2. Create a simple format file:
  
  FORMAT TEMS_Shell_I_Event
  %s %s
  C1 $1 CustomSlot1
  C2 $2 CustomSlot2
  msg $2
  END
  
  3.  Create a situation on the portal, with an action that
  outputs a custom slot attribute to a file:
  - CustomSlot1=='E'
  Action tab:
  cmd /c "echo &{KLO_LOGFILEEVENTS.CustomSlot2} >>c:\output.sit"
  
  4. Start the agent instance.
  
  5. Input data to the monitored file:
  
  C:>echo  E linda\linda\linda >> testin.log
  

Local fix

Problem summary

• When an event which is detected by the agent is output from a
  situation using a Take Action command, by a redirection, etc.; a
  single-byte backslash character ("\") is displayed as a
  double-byte "middle point" character.
  
  The character is correctly displayed in the portal indicating
  that it is correctly read and translated by the agent when read
  from the monitored log file.
  
  The problem only occurs when the attribute containing backslash
  is used in a Take Action command.  When the character is read
  from the monitored file, it is converted from ibm-943_P15A-2003
  to UTF-8 0xC2A5 - the UTF8 representation of backslash\yen).
  When the take action is performed either at the agent or the
  monitoring server, the agent translates the 0xC2A5 from UTF-8 to
  the native CP932 which results in the 0xFCFC character code.
  
  The problem exists on the Log File Agent version 6.3.0 Interim
  Fix 0003 (6.3.0-TIV-ITM_LFA-IF0003) and earlier, with Japanese
  locale.  It can occur on Windows and UNIX platforms.
  

Problem conclusion

• Translate using code page 932, instead of code page 943 on all
  platforms.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
  
  | interim fix | 6.3.0-TIV-ITM_LFA-IF0004
  
  available at
  http://www.ibm.com/support/docview.wss?uid=swg24039388
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM LOG FILE AG

• Fixed component ID

  5724C04LF

Applicable component levels

• R630 PSY

     UP