IZ18978: ITM 6.1 FP06, TEC EVENT PARSING_FAILED

APAR status

• Closed as program error.

Error description

• Customer has ITM 6.1 FP06, monitoring Windows event viewer, the
  Situation event is sent to TEC successfully, but event is not
  processed. Following error is displayed in the reception log:
  .
  ### END EVENT ###
  PROCESSED
  
  1~63896~1~1206730489(mars 28 14:54:49 2008)
  ### EVENT ###
  ITM_NT_Event_Log;source='ITM';sub_source='Primary:Q4R600:NT';cms
  _hostname='PPROD
  ITMG0001.PROD.PIRSR';cms_port='3661';integration_type='N';master
  _reset_flag='';a
  ppl_label='';situation_name='Event_COM_Critical';situation_type=
  'P';situation_or
  igin='Primary:Q4R600:NT';situation_time='03/28/2008
  14:54:50.000';situation_stat
  us='Y';hostname='Q4R600';origin='172.21.16.141';adapter_host='HU
  B_PPRODITMG0001'
  ;severity='CRITICAL';date='03/28/2008';msg='Event_COM_Critical[(
  Source="COM" AND
   Type="Error" ) ON Primary:Q4R600:NT (Source=COM Type=Error
  )]';situation_displa
  yitem='';category='None';category_u='None';computer='Q4R600';knt
  _date='03/28/08'
  ;description='Not located in
  C:\WINDOWS\System32\netevent.dll;;C:\WINDOWS\System
  32\xpsp2res.dll.  The description for Event ID ( 99 ) in Source
  ( COM ) could no
  t be found.  It contains the following insertion string(s):  2
  COD2 3 2008-03-28
  _14:54:49 COD2_ViSecuriteCAIS INTRO\BTSAdm Windows 99 ?
  Fujitsu.DMR.Exceptions.F
  DException:_FDException@Fujitsu.DMR.CAIS.Security_:_La_cha?ne_de
  _caract?re_n'est
  _pas_en_base_64_valide.
  ___at_Microsoft.VisualBasic.CompilerServices.Symbols.Co
  ntainer.InvokeMethod(Method_TargetProcedure,_Object[]_Arguments,
  _Boolean[]_CopyB
  ack,_BindingFlags_Flags)
  ___at_Microsoft.VisualBasic.CompilerServices.NewLateBi
  nding.LateGet(Object_Instance,_Type_Type,_String_MemberName,_Obj
  ect[]_Arguments,
  _String[]_ArgumentNames,_Type[]_TypeArguments,_Boolean[]_CopyBac
  k)  ___at_RAMQ.C
  O.COD2_ViSecuriteCAIS_cpo.Securite.VerifierSignature(CaisMessage
  __objCaisMessage
  ,_Object__strTypIntrvn,_Boolean__bolIntvObli,_Boolean__blnVerifT
  imeStampPKCS7,_c
  olctInfoSigna&__objColcInfoSigna,_XmlElement__xmlElemSignature)
  ___at_RAMQ.CO.C
  OD2_ViSecuriteCAIS_cpo.Securite.TraiterSignature(colctInfoSigna&
  __objColcInfoSig
  na,_XmlDocument&__objX';description_u='
  ';entry_time='1080328145449000';event_id
  ='99';log_name='Application';log_name_u='Application';server_nam
  e='Primary:Q4R60
  0:NT';knt_source='COM';source_u='COM';time='14:54:49';timestamp=
  '108032814544900
  0';type='Error';user='N/A';user_u='N/A';situation_eventdata='~';
  END
  
  ### END EVENT ###
  PARSING_FAILED~'Line 1: syntax error'
  .
  Similar to apar IZ11449 but not the same. Tin Kam reviewed this:
  .
  The double semicolon was escaped by the TEMS (turning into 4
  seimicolons) and for some reason, that causes the single quote
  in the rest of the data not to be escaped which subsequently
  caused the parse fail error on the TEC side.
  .
  

Local fix

Problem summary

• If an ITM event data contains single quotes after an escaped
  semi-colon or tilda, the single quote(s) are not properly
  escaped in the event forwarded to TEC causing a parse fail error
  on the TEC server.
  

Problem conclusion

• The Translate_ResultBuffer function has been changed to
  properly escaped single quotes after escaped semi-colon's or
  tilda's.
  
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
   | fix pack | 6.1.0-TIV-ITM-FP0007
   | fix pack | 6.2.0-TIV-ITM-FP0001
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  OA26795

Fix information

• Fixed component name

  TEMS

• Fixed component ID

  5724C04MS

Applicable component levels

• R610 PSY

     UP

• R620 PSY

     UP