OA68614: ZSECURE AUDIT AND ZSECURE ADAPTERS FOR SIEM COMPONENTS REPORT LICENSE ERRORS WITH ZSCC ONLY LICENSE

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• zSecure Audit and zSecure Adapters for SIEM components report
  license errors with zSCC only license.
  
  For example, with CKQEXSMF:
  CKQ0976 16 IBM Security zSecure SMF Collector product or feature
  disabled or not installed here
  CKQ0974 16 IBM Security zSecure SMF Collector disabled or not
  installed here for requested focus
  
  
  For example, with CKFCOLL when specifying FOCUS=AUDITRACF:
  CKF0976 16 IBM Security zSecure Collect product or feature
  disabled or not installed here
  CKF0974 16 IBM Security zSecure Collect disabled or not
  installed here for requested focus
  
  CKF0973 16 IBM Security product code AUDITRACF disabled or not
  installed
  

Local fix

• For CKFCOLL, specify instead either FOCUS=ZSCC or FOCUS=LICENSE.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure having only zSecure         *
  *                 Compliance Center (zSCC) entitlement key.    *
  ****************************************************************
  * PROBLEM DESCRIPTION: zSecure SMF collector fails with        *
  *                      MSGCKQ0974/CKQ0976. zSecure Collect     *
  *                      issues MSGCKF0973/MSGCKF0974/MSGCKF0976 *
  *                      and terminates in cases where the       *
  *                      FOCUS command specifies                 *
  *                      AUDITxxx/QRADARxxx products. The same   *
  *                      applies to zSecure main processing      *
  *                      engine (CKRCARLA) when any of the       *
  *                      following CARLa statements refer to     *
  *                      AUDITxxx/QRADARxxx products:            *
  *                       o LIMIT FOCUS.                         *
  *                       o NEWLIST LICENSE.                     *
  *                       o IMBED LICENSE.                       *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  When only zSecure Compliance Center (zSCC) entitlement key is
  available, the zSecure SMF collector (CKQEXSMF) started task
  fails with a MSGCKQ0976 which begins with the text "IBM Security
  zSecure SMF Collector product or feature disabled..." followed
  by a MSGCKQ0974 which begins with the text "IBM Security zSecure
  SMF Collector disabled...". Similar behavior is observed when
  invoking zSecure collect with a FOCUS command referring to the
  AUDITxxx/QRADARxxx products. The zSecure main processing engine
  also fails when the 'LIMIT FOCUS', 'NEWLIST LICENSE', or 'IMBED
  LICENSE' CARLa statements are referring AUDITxxx/QRADARxxx
  products.
  

Problem conclusion

• zSecure code has been modified, so that it allows usage of the
  AUDITxxx/QRADARxxx product features in cases where only zSecure
  Compliance Center (zSCC) entitlement key is available and the
  aforementioned features are requested by the appropriate
  commands/statements as described by the APAR. The zSecure SMF
  collector started task is also allowed to run.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  OA68048

• APAR is sysrouted TO one or more of the following:

  UJ98243 UJ98244

Modules/Macros

• CKCINITL GKCINITL
  

Fix information

• Fixed component name

  Z SEC AND COMP

• Fixed component ID

  5655CC100

Applicable component levels

• R310 PSY UJ98244

     UP25/10/18 P F510

• R320 PSY UJ98243

     UP25/10/18 P F510

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.