IZ35470: Logmon/LogmonX caches event log provider DLLs for too long, preventing application removal

IBM Tivoli 4.0.0-TIV-SSM-FP0010
IBM Tivoli 4.0.0-TIV-SSM-FP0011
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 12 README 4.0.0-TIV-SSM-FP0012
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 13 README 4.0.0-TIV-SSM-FP0013
IBM Netcool System Service Monitor SSM 4.0 Fix Pack 14 README 4.0.0-TIV-SSM-FP0014
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.14-TIV-SSM-IF0001
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 2 README 4.0.0.14-TIV-SSM-IF0002
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 3 README 4.0.0.14-TIV-SSM-IF0003
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 4 README 4.0.0.14-TIV-SSM-IF0004
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 5 README 4.0.0.14-TIV-SSM-IF0005
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 6 README 4.0.0.14-TIV-SSM-IF0006
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 7 README 4.0.0.14-TIV-SSM-IF0007
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 8 README 4.0.0.14-TIV-SSM-IF0008
IBM Netcool System Service Monitor SSM 4.0 Interim Fix 1 README 4.0.0.15-TIV-SSM-IF0001

APAR status

• Closed as program error.

Error description

• In order to monitor the windows event log you need to open
  specific third party DLLs to get the text formatting for any
  applications event. The SSM caches these DLLs to improve
  performance when large numbers of events are being processed.
  However this can cause issues if another application needs to
  access the DLL as it becomes locked by the SSM.
  
  We should consider removing DLLs from the cache if they are
  inactive for a period of time.
  

Local fix

Problem summary

• We were retaining DLL handles between samples. This meant that
  handles remain around potentially indefinitely. This could mean
  that you cannot uninstall those DLL's as the SSM still has them
  open.
  

Problem conclusion

• SSM will close handles that have been open for over 2 minutes
  during every sample. It also clears the cache of handes when a
  control row is removed. This should prevent DLL's remaining open
  indefinitely.
  
  The fix for this APAR is contained in the following maintenance
  packages:
     | fix pack | 4.0.0-TIV-SSM-FP0006
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  NETCOOL SYS SVC

• Fixed component ID

  5724P4300

Applicable component levels

• R400 PSY

     UP