IV54710: WINDOWS EVENT LOG NOT MONITORED ON SOME WINDOWS 2012 SYSTEMS AFTER INSTALLING 6.3.0-TIV-ITM_LFA-IF0001

Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005

APAR status

• Closed as program error.

Error description

• ENVIRONEMNT:
  LFA agent 6.3
  Windows 2012
  
  
  
  PROBLEM DESCRIPTION:
  On some Windows 2012 systems, after installing Log File Agent
  v6.3 interim fix 0001 (6.3.0-TIV-ITM_LFA-IF001), Windows Event
  Log events are no longer monitored.  The Data Collection Status
  workspace shows File Status:  "231".
  
  With a minimum of "KBB_RAS1:  ERROR tracing, the agent log
  <hostname>_lo_<instance>_kloagent_<timestamp>.log contains trace
  entries similar to the following:
  - - -
  ...
  ...:kum0fdp0.c,162,"KUM0_DynamicFileOpen")
  fopen(\\.\pipe\KLO_gail_LogfileEvents_evl(System), rb) returned
  NULL errno 231 'Unknown error'
  ...
  - - -
  
  
  
  RECREATE INSTRUCTIONS:
  On a Windows 2012 system:
  
  1. Install Log File Agent v6.3 (CIGM6ML).
  2. Install 6.3.0-TIV-ITM_LFA-IF0001.
  3. Configure a Log File agent instance to monitor Windows Event
  Log.
  4. Start the Log File agent instance.
  

Local fix

• Uninstall 6.3.0-TIV-ITM_LFA-IF0001.
  Re-install Log File Agent, v6.3 (CIGM6ML).
  

Problem summary

• On some Windows 2012 systems, after installing Log File Agent
  v6.3 interim fix 0001 (6.3.0-TIV-ITM_LFA-IF001), Windows Event
  Log events are no longer monitored.
  The Data Collection Status workspace shows File Status:  "231",
  'ERROR_PIPE_BUSY' All pipe instances are busy.
  

Problem conclusion

• Do not attempt to get the file attributes to determine if it is
  a directory, if we already know it is a pipe.
  
  The fix for this APAR is included in the following maintenance
  vehicle:
  
  | interim fix | 6.3.0-TIV-ITM_LFA-IF0002
  
  available at
  http://www.ibm.com/support/docview.wss?uid=swg24037287.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM LOG FILE AG

• Fixed component ID

  5724C04LF

Applicable component levels

• R630 PSY

     UP