IBM Support

OA57086: JOBTAG FORMATTING CAN RESULT IN AN EMPTY FIELD

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • JOBTAG formatting can result in an empty field.
    This means that jobtag(job) with newlist header=leef results in
    missing data.
    

Local fix

  • n/a
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: Users of zSecure Audit exploiting the        *
    *                 software to prepare data for QRadar SIEM.    *
    ****************************************************************
    * PROBLEM DESCRIPTION: The zSecure Audit QRadar SIEM interface *
    *                      might generate LEEF files that contain  *
    *                      no 'job=' operands and empty values in  *
    *                      the 'jobtag=' operand for RACF access   *
    *                      events.                                 *
    ****************************************************************
    * RECOMMENDATION: Apply the PTF provided and review the        *
    *                 documentation update.                        *
    ****************************************************************
    When the zSecure Audit QRadar SIEM interface processes SMF data
    with RACF access events (SMF records type 80), the generated
    records for these events in the LEEF file might be missing a
    'job=' operand and the 'jobtag=' operand might contain empty
    value.
    

Problem conclusion

  • The zSecure Audit QRadar SIEM interface has been modified so
    that 'job=' and 'jobtag=' operands are properly formatted.
    PLEASE NOTE the documentation update as provided by the APAR
    tracking comment data.
    

Temporary fix

Comments

APAR Information

  • APAR number

    OA57086

  • Reported component name

    ZSEC BASE,ADMIN

  • Reported component ID

    5655T0100

  • Reported release

    231

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-03-11

  • Closed date

    2019-03-22

  • Last modified date

    2019-04-02

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UA98875

Modules/Macros

  • CKAOUSMF GKROUSMF
    

Fix information

  • Fixed component name

    ZSEC BASE,ADMIN

  • Fixed component ID

    5655T0100

Applicable component levels

  • R231 PSY UA98875

       UP19/03/26 P F903

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSCE68R","label":"zSecure Admin"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"231","Edition":""}]

Document Information

Modified date:
02 April 2019