IBM Support

OA55177: ZSECURE SMF REPORTS A VIOLATION USING THE UNIX LOOKUP SERVICE, WHEN ICH408I MESSAGE SHOWS UNIX STAT SERVICE WAS USED.

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • zSecure SMF reports indicate a violation using the Unix lookup
    service, when ICH408I message indicates Unix stat service was
    used.  The zSecure reports should indicate the same USS service
    used as was indicated in the ICH408I message.
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: Users of zSecure Audit exploiting SMF        *
    *                 reports (RACF events).                       *
    ****************************************************************
    * PROBLEM DESCRIPTION: zSecure Audit might report an incorrect *
    *                      value of the the UNIX_FUNCTION field    *
    *                      (newlist type SMF) incorrectly.         *
    ****************************************************************
    * RECOMMENDATION: Apply the PTF provided.                      *
    ****************************************************************
    The UNIX_FUNCTION field (newlist type SMF) might contain a value
    "lookup" while the MSGICH408I system message reports an other
    value.
    

Problem conclusion

  • zSecure Audit has been modified so that the UNIX_FUNCTION field
    value is properly resolved in cases where the original field
    value is "lookup" meaning that the actual value is supplied by
    the SMF record 80's relative section 291.
    

Temporary fix

Comments

APAR Information

  • APAR number

    OA55177

  • Reported component name

    ZSEC BASE,ADMIN

  • Reported component ID

    5655T0100

  • Reported release

    230

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-03-20

  • Closed date

    2018-04-19

  • Last modified date

    2018-06-08

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UA95965

Modules/Macros

  • CKASINT  GKRSINT
    

Fix information

  • Fixed component name

    ZSEC BASE,ADMIN

  • Fixed component ID

    5655T0100

Applicable component levels

  • R230 PSY UA95965

       UP18/04/20 P F804

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSCE68R","label":"zSecure Admin"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"230","Edition":""}]

Document Information

Modified date:
08 June 2018