APAR status
Closed as program error.
Error description
CKR1483 12 Syslog message SYSSTAT has more than 1 line. This can be seen when CKQRADAR processes SMF record type 90 subtype 9, for example: CKR1483 12 Syslog message SYSSTAT has more than 1 line, SYSSTAT at CKRCARLA(CKQLEEFL) line 838 LEEF:1.0|IBM|z/OS|2.5|90-9|devTimeFormat=yyyy-MM-dd'T'HH:mm:ss.S SSZ.devTime=2023-03-21T09:53:53.820+0100.actrec=0.inactrec=4.sum =Operator command IPL SMF for subsys SYS write SMF types 0:3,6:18,21:33,36:39,41:98,100:125,127:180,182:255 -| .actrec=1.inactrec=5 -| .actrec=2.inactrec=19 -| .actrec=3.inactrec=20 etc.
Local fix
N/A
Problem summary
**************************************************************** * USERS AFFECTED: Users of zSecure Audit exploiting the * * software to prepare data for QRadar SIEM. * **************************************************************** * PROBLEM DESCRIPTION: zSecure Audit might issue a MSGCKR1483 * * while processing SMF data to prepare * * input for the QRadar SIEM. * **************************************************************** * RECOMMENDATION: Apply the PTF provided. * **************************************************************** When an SMF source being processed by zSecure Audit contains "System status" records (type 90) having sub-types 5, 9, 13, or 15, the zSecure Audit generates incorrectly formatted data resulting in a MSGCKR1483 which begins with the text "Syslog message SYSSTAT has more than 1 line...".
Problem conclusion
zSecure Audit has been modified, so that it does not issue a MSGCKR1483 while processing SMF data to prepare input for the QRadar SIEM for SMF records types 90, sub-types 5, 9, 13, and 15.
Temporary fix
Comments
APAR Information
APAR number
OA64563
Reported component name
ZSEC BASE,ADMIN
Reported component ID
5655T0100
Reported release
250
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2023-03-21
Closed date
2023-05-17
Last modified date
2023-06-01
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
UJ92815
Modules/Macros
CKASINT CKQCEFG CKQLEEF CKQLEEFL GKRSINT
Fix information
Fixed component name
ZSEC BASE,ADMIN
Fixed component ID
5655T0100
Applicable component levels
R250 PSY UJ92815
UP23/05/24 P F305
[{"Business Unit":{"code":"BU011","label":"Systems - zSystems software"},"Product":{"code":"SG19O","label":"IBM Security zSecure Admin"},"Platform":[{"code":"PF054","label":"z Systems"}],"Version":"250"}]
Document Information
Modified date:
01 June 2023