PI95338: SMF PROCESSING WITH MULTIPLE RULES REPORTS INCORRECT ACCESSES

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When processing SMF data and there are multiple rules in the
  collection policy, accesses to database artifacts can be
  attributed to incorrect users. Incorrect users include userids
  that were specified in secondary rules in the policy that should
  not cause an event to be reported.
  Example:
  Rule 1 contains DB name "A" and userid "1234"
  Rule 2 contains DB name "B" and userid "5678'.
  When userid "5678" accesses DB name "A", we would incorrectly
  cause an event to be reported.
  When userid "1234" accesses DB name "B", we would again
  incorrectly cause an event to be reported.
  This is due to the RULE control block chain not being properly
  segregated when searching for DBD artifacts in the RECON data
  sets.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of IBM Security Guardium S-TAP for IMS *
  *                 on z/OS                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: When processing SMF data and there are  *
  *                      multiple rules in the collection        *
  *                      policy, accesses to database artifacts  *
  *                      can be attributed to incorrect users.   *
  *                      Incorrect users include userids that    *
  *                      were specified in secondary rules in    *
  *                      the policy that should not cause an     *
  *                      event to be reported.                   *
  *                                                              *
  *                      Example:                                *
  *                      Rule 1 contains DB name "A" and userid  *
  *                             "1234"                           *
  *                      Rule 2 contains DB name "B" and userid  *
  *                             "5678".                          *
  *                      When userid "5678" accesses DB name     *
  *                             "A", we would incorrectly cause  *
  *                             an event to be reported.         *
  *                      When userid "1234" accesses DB name     *
  *                            "B", we would again incorrectly   *
  *                            cause an event to be reported.    *
  *                                                              *
  *                      This is due to the RULE control block   *
  *                      chain not being properly segregated     *
  *                      when searching for DBD artifacts in     *
  *                      the RECON data sets.                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Apply the supplied PTF to resolve this issue.
  

Problem conclusion

• N/A
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI56470 UI56471 UI56472

Modules/Macros

•    AUISFIN  AUISFMG  AUISFQDS
  

Fix information

• Fixed component name

  SEC GUAR STAP I

• Fixed component ID

  5655STM00

Applicable component levels

• RA00 PSY UI56470

     UP18/06/19 P F806

• RA13 PSY UI56471

     UP18/06/19 P F806

• R910 PSY UI56472

     UP18/06/19 P F806

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.