IV71539: %NNNN SYSTEM PARAMETERS NOT RESOLVED IN WINDOWS EVENT LOG EVENTS

Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005

APAR status

• Closed as program error.

Error description

• On Windows 2003, the Log File Agent does not resolve %nnnn
  system parameters in Windows Event Log events.  Windows Event
  Viewer is able to resolve the %nnnn to the correct message.
  
  For example, the event is seen as:
  DCOM got error "%1058" attempting to start the service
  COMSysApp with arguments "" in order to run the server:
  {7F19-11D2}
  
  With a minimum of the following tracing KBB_RAS1: ERROR
  (UNIT:EventLog ALL)
  the agent log
  <hostname>_lo_[instance]_kloagent_<timestamp>-0<n>.log shows
  log entries similar to the following:
  
  ...
  ...:eventlog.cpp,1955,"ModifyParameter") Entry
  ...:eventlog.cpp,1969,"ModifyParameter") Scanning <DCOM
  got error "%1058" attempting to start the service COMSysApp with
  arguments "" in order to run the server:
  {7F19-11D2} > for replaceable parameters.
  ...:eventlog.cpp,2175,"ModifyParameter") No parameters to
  format.
                                           !!!!!!!!!!!!!!!!!!!!!!!
  ...:eventlog.cpp,2185,"ModifyParameter") Scan results
  <DCOM got error "%1058" attempting to start the service
  COMSysApp with
  arguments "" in order to run the server:
  {7F19-11D2} >
  ...:eventlog.cpp,2192,"ModifyParameter") Exit
  ...:eventlog.cpp,1600,"DisplayRecord") Event Log Record:
  <DCOM got error "%1058" attempting to start the service
  COMSysApp with
  arguments "" in order to run the server:
  {7F19-11D2}>
  ...:eventlog.cpp,1607,"DisplayRecord") Exit
  ...
  
  
  RECREATE INSTRUCTIONS:
  
  1. Configure the Log File agent with a .conf file, which
  includes WINEVENTLOGS=System.
  2. Start the kloagent.
  3. Wait for the occurrence of an event which contains a system
  parameter (%nnnn).
  
  The event will be displayed with the "%nnnn" value unresolved.
  

Local fix

Problem summary

• On Windows 2003, the Log File Agent does not resolve %nnnn
  system parameters in Windows Event Log events.  Windows Event
  Viewer is able to resolve the %nnnn to the correct message.
  
  This problem might also be seen on Windows 2008, when
  UseNewEventLogAPI=N is set in the agent configuration file.
  

Problem conclusion

• Add code to handle the event parameters and the parameter
  message file.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
  
     | interim fix | 6.3.0-TIV-ITM_LFA-IF0005
  
  Note: The Log File Agent fix is available at
  http://www.ibm.com/support/docview.wss?uid=swg24041113
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM LOG FILE AG

• Fixed component ID

  5724C04LF

Applicable component levels

• R630 PSY

     UP