IBM Support

PH12072: SMF RECORDS NOT RECORDED WITH SECURITY AUDITING USING THE SMF EMITTER WITH SECURITY_FORM_LOGIN AND SECURITY_FORM_LOGOUT

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • SMF records not recorded with security auditing using the SMF
    Emitter with SECURITY_FORM_LOGIN and SECURITY_FORM_LOGOUT
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server V8.5 and V9.0 for z/OS               *
    ****************************************************************
    * PROBLEM DESCRIPTION: When enabled to use SMF                 *
    *                      emitter auditing, event types           *
    *                      SECURITY_FORM_LOGIN and                 *
    *                      SECURITY_FORM_LOGOUT are not found in   *
    *                      SMF logs.                               *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    There are 2 problems that are preventing event types
    SECURITY_FORM_LOGIN and SECURITY_FORM_LOGOUT from being
    captured.
    First, there was a problem with security code not properly
    setting these events. This APAR corrects that.
    Secondly, the IRRADU00 RACF utility often relied upon to read
    SMF records does not support these event types. If the
    customer is going to rely on IRRADU00, they will have to wait
    for the following RACF RFE to be fulfilled: 138284 .
    

Problem conclusion

  • Security code has corrected a code problem contributing to
    failure to log these event types. The z/OS WebSphere
    Application Server Knowledge Center will be updated to
    indicate these events a currently unavailable using IRRADU00
    to read SMF data until RFE 138284 is completed.
    
    The fix for this APAR is currently targeted for inclusion in
    fix pack 8.5.5.19 and 9.0.5.5  Please refer to the
    Recommended
    Updates
    page for delivery information:
    http://www.ibm.com/support/docview.wss?
    rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH12072

  • Reported component name

    WEBSPHERE FOR Z

  • Reported component ID

    5655I3500

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-05-15

  • Closed date

    2019-11-21

  • Last modified date

    2020-07-09

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBSPHERE FOR Z

  • Fixed component ID

    5655I3500

Applicable component levels

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"850","Line of Business":{"code":"LOB36","label":"IBM Automation"}}]

Document Information

Modified date:
10 July 2020