IBM Support

OA56078: WHEN RUNNING CKQRADAR WITH ACF2, A CKR1483 MESSAGE IS THROWN

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • When running the CKQRADAR started task under ACF2, the following
    message is thrown in the log and processing of data halts
    
    
    
    CKR1483 12 Syslog alert ACF2 has more than 1 line, ACF2 at
    CKRCARLA(CKQLEEFL) line 1211
    LEEF:1.0|CA|ACF2|2.3|ACF2-D|devTimeFormat=yyyy-MM-dd'T'HH:mm:ss.
    SSSZ devTime=2018-08-21T19:21:37.510+0100 usrname=DFHSM
    name=DFHSM job=TSTA 21 Aug 2018 19:21:33.44 ARCABKUP
    terminal=STCINRDR intent=INPUT class=DATASET vol=*SMS*
    dsn=@TRM916.VOLUME usrPriv=nCn STC sum=ACF2 id DFHSM NON_CNCL
    INPUT dataset @TRM916.VOLUME on TRM916 from STCINRDR
    res=@TRM916.VOLUME auth=NON_CNCL reason=logging ACF2-|
    auth=reason=VOLUME
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: Users of zSecure Audit for ACF2 exploiting   *
    *                 the software to send data to a SIEM system.  *
    ****************************************************************
    * PROBLEM DESCRIPTION: zSecure Audit can send malformed        *
    *                      records to a SIEM system and might      *
    *                      issue a MSGCKR1483 and terminate while  *
    *                      processing SMF data.                    *
    ****************************************************************
    * RECOMMENDATION: Apply the PTF provided.                      *
    ****************************************************************
    When zSecure Audit is processing SMF data to prepare input for a
    SIEM system (for example as part of the C2RJPREP job or a near
    real-time feed), it can produce malformed records. Also it might
    issue a MSGCKR1483 which begins with the text "Syslog alert ACF2
    has more than 1 line ..." (version 2.3.0) or "Syslog message
    <name> has more than 1 line ..." (version 2.3.1) and terminate.
    This might happen while processing ACF2 generated SMF records
    having sub-types 'D' or 'V'.
    

Problem conclusion

  • zSecure Audit for ACF2 has been modified so that it does not
    produce malformed records.
    

Temporary fix

Comments

APAR Information

  • APAR number

    OA56078

  • Reported component name

    AUDIT-R,A,T ACF

  • Reported component ID

    5655T0200

  • Reported release

    230

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-09-04

  • Closed date

    2018-10-15

  • Last modified date

    2018-11-01

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UA97671 UA97672

Modules/Macros

  • C2ELEEF  CKQCEFG  CKQLEEF  CKQLEEFL
    

Fix information

  • Fixed component name

    ZSEC BASE,ADMIN

  • Fixed component ID

    5655T0100

Applicable component levels

  • R230 PSY UA97671

       UP18/10/17 P F810

  • R231 PSY UA97672

       UP18/10/17 P F810

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSCE68R","label":"zSecure Admin"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"230","Edition":""}]

Document Information

Modified date:
01 November 2018