PH12072: SMF RECORDS NOT RECORDED WITH SECURITY AUDITING USING THE SMF EMITTER WITH SECURITY_FORM_LOGIN AND SECURITY_FORM_LOGOUT

APAR status

• Closed as program error.

Error description

• SMF records not recorded with security auditing using the SMF
  Emitter with SECURITY_FORM_LOGIN and SECURITY_FORM_LOGOUT
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server V8.5 and V9.0 for z/OS               *
  ****************************************************************
  * PROBLEM DESCRIPTION: When enabled to use SMF                 *
  *                      emitter auditing, event types           *
  *                      SECURITY_FORM_LOGIN and                 *
  *                      SECURITY_FORM_LOGOUT are not found in   *
  *                      SMF logs.                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  There are 2 problems that are preventing event types
  SECURITY_FORM_LOGIN and SECURITY_FORM_LOGOUT from being
  captured.
  First, there was a problem with security code not properly
  setting these events. This APAR corrects that.
  Secondly, the IRRADU00 RACF utility often relied upon to read
  SMF records does not support these event types. If the
  customer is going to rely on IRRADU00, they will have to wait
  for the following RACF RFE to be fulfilled: 138284 .
  

Problem conclusion

• Security code has corrected a code problem contributing to
  failure to log these event types. The z/OS WebSphere
  Application Server Knowledge Center will be updated to
  indicate these events a currently unavailable using IRRADU00
  to read SMF data until RFE 138284 is completed.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.19 and 9.0.5.5  Please refer to the
  Recommended
  Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?
  rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels