IZ40646: UA SNMP TRAP VALUE_LIST TRUNCATES IF SEMICOLON IN AN ATTR VAL

APAR status

• Closed as program error.

Error description

• Customer is using Universal Agent to receive traps from Vantage.
  He noted that the "Value List" on TEP Report workspace has
  always been truncated on the same point.
  Checking the UA logs with SNMP debug, a semi-colon appears in
  the point where the "Value List" is truncated.
  
  Event in UA log:
  ----------------------------------------------------------------
  
  (4936E911.0000-39C:kumsrttb.c,1305,"KUMS_ReceiveTrapToBuffer")
  1081203181613000;1.3.6.1.4.1.344.5.2;6;1;SVH040029;Agent;Unchang
  ed;serve rVantage;svEvent;Status
  Events;Indeterminate;ServerVantage Trap definition.
  ;{svTrapTime=6:16:10 PM}{svRuleName=Alto Consumo de
  CPU}{svTaskName=ztesteHomologacao2}{svServerName=SVH040029}{svEv
  entMessa ge=Clause Message System Extended.Total CPU
  Utilization %(Number of Processes: "10") >= 5 Val:
  14.43;}{svUserDefinedMessage=RuleURL
  http://vantage.bnc/procedimentos/mq_evt_dis_Event ID
  9542.htm}{svUserDefinedSeverityLevel=Priority High};
  ----------------------------------------------------------------
  
  The event above has 7 VarBinds:
  ----------------------------------------------------------------
  --------
  {svTrapTime=6:16:10 PM}
  
  {svRuleName=Alto Consumo de CPU}
  
  {svTaskName=ztesteHomologacao2}
  
  {svServerName=SVH040029}
  
  {svEventMessage=Clause Message System Extended.Total CPU
  Utilization
  %(Number of Processes: "10") >= 5 Val: 14.43;} <**** TRUNCATED
  HERE ****
  
  {svUserDefinedMessage=RuleURL
  http://vantage.bnc/procedimentos/mq_evt_di
  s_Event ID 9542.htm}
  
  {svUserDefinedSeverityLevel=Priority High}
  ----------------------------------------------------------------
  --------
  
  As you can see, the "svEventMessage" VarBind has a semi-colon in
  the end of the string (14.43;) that can be causing this problem.
  
  If you look at the UA logs you will see the event with the
  semi-colons as delimiter. Each field inside a semi-colon is a
  column of Report workspace on TEP:
  ----------------------------------------------------------------
  
  (4936E911.0000-39C:kumsrttb.c,1305,"KUMS_ReceiveTrapToBuffer")
  1081203181613000;                  <=== Time Stamp
  1.3.6.1.4.1.344.5.2;               <=== Object_ID
  6;                                 <=== Generic_Trap
  1;                                 <=== Specific_Trap
  SVH040029;                         <=== Source_Name
  Agent;                             <=== Source_Type
  Unchanged;                         <=== Source_Status
  serverVantage;                     <=== Enterprise_Name
  svEvent;                           <=== Alert_Name
  Status Events;                     <=== Category
  Indeterminate;                     <=== Severity
  ServerVantage Trap definition.  ;  <=== Description
                                     <=== Value_List
  {svTrapTime=6:16:10 PM}{svRuleName=AltoConsumo de
  CPU}{svTaskName=ztesteHomologacao2}{svServerName=SVH040029}{svEv
  entMessa ge=Clause Message System Extended.Total CPU
  Utilization %(Number of Processes: "10") >= 5 Val:
  14.43;}{svUserDefinedMessage=RuleURL
  http://vantage.bnc/procedimentos/mq_evt_dis_Event ID
  9542.htm}{svUserDefinedSeverityLevel=Priority High};
  ----------------------------------------------------------------
  
  The last character is value of svEventMessage attribute is a
  ';' character and that is character
  that UA is looking for as delimiter for the top level SNMP TRAP
  attributes, e.g.   Obj_ID;GenericTrap;SpecificTrap; ...
  ;Value_List;
  
  But since th attribute value of svEventMessage contains a ';' in
  list of values in Value_List, UA stops parsing Value_List and
  never pulls out values for svUserDefinedMessage and
  svUserDefinedSeverityLevel.
  
  The TEP screen, UA log, MDL file and TRAPCNFG file are in
  ECuRep:
  * Directory:
  /ecurep/pmr/5/5/55869,228,631/mail20081204-200255-1962078_Esteva
  n_Chaves /Chamado_IBM.zip_unzip
  
  Related Files and Output:
  Customer sent to ECuRep the new UA log with
  "KUMP_OUTPUT_DEBUG=Y".
  * Directory:
  /ecurep/pmr/5/5/55869,228,631/mail20081219-162957-1003528_Esteva
  n_Chaves /svh060035_um_494bb591-01.zip_unzip
  * File:
  svh060035_um_494bb591-01.log
  
  Also in:
  https://ecurep.mainz.de.ibm.com/aex/browseServer.jsp?browseDirec
  tory=/ec
  urep/pmr/5/5/55869,228,631/mail20081219-162957-1003528_Estevan_C
  haves/svh060035_um_494bb591-01.zip_unzip
  

Local fix

• The only work around is if ';' characters can be
  suppressed from Value_List's member attribute values.
  

Problem summary

• When the VALUE_LIST attribute of a Universal Agent SNMP trap
  contains a semicolon, the VALUE_LIST attribute is truncated.
  
  The Universal Agent uses the semi-colon character as its
  delimiter between each SNMP trap attribute.  If it's Value_List
  attribute contains a semi-colon then UA prematurely truncates
  the value of the trap's Value_List attribute.
  

Problem conclusion

• The Value_List attribute is scanned for semi-colon characters
  and replaces them with comma characters before submitting the
  SNMP trap to the Universal Agent for attribute parsing.
  
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
     | fix pack | 6.2.0-TIV-ITM-FP0003
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  UNIVERSAL AGENT

• Fixed component ID

  5724K1000

Applicable component levels

• R620 PSY

     UP