IJ46937: LOG FILE AGENT MAY CRASH IF REGEXLOGSOURCES OPTION IS USED MONITORING REMOTE LOGS ON Z/OS TARGETS

APAR status

• Closed as fixed if next.

Error description

• If LFA is used to monitor remote logs through SSH and the target
  machine is z/OS the agent can crash
  
  The kloagent core dump will show a segmentation fault in
  _libssh2_ntohu32 function with the following call stack:
  #0 0x00002b7597e42884 in _libssh2_ntohu32 () from
  /opt/ibm/itm/lx8266/lo/lib/libklossh-gsk8.so
  #1 0x00002b7597e6008e in sftp_readdir () from
  /opt/ibm/itm/lx8266/lo/lib/libklossh-gsk8.so
  #2 0x00002b7597e61280 in libssh2_sftp_readdir_ex () from
  /opt/ibm/itm/lx8266/lo/lib/libklossh-gsk8.so
  #3 0x00002b75fc0edd42 in libssh2_sftp_readdir_ex () from
  /opt/ibm/itm/lx8266/lo/lib/libkloudp.so
  #4 0x00002b75fc0ebbfb in ssh_session_sftp_readdir () from
  /opt/ibm/itm/lx8266/lo/lib/libkloudp.so
  

Local fix

• Workaround is to use LogSources configuration option specifying
  the individual files to be monitored
  

Problem summary

• when using ssh to connect to zOS remote system for logging is
  immediately getting a core dump Two instances, but the one with
  the problem is "LeA_ZOS"
  

Problem conclusion

Temporary fix

• To resolve this issue, we have included APAR IJ46937 fix changes
  in the LFA 6.3.0 FP5 build and delivered it as a TestFix.
  

Comments

• Changing APAR status from INTRAN to OPEN.
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels