IV85156: SECUREMAIN.SH DOES NOT PROPERLY RECOGNIZE SITUATION DATA FILES

IBM Tivoli Monitoring 6.3.0 Fix Pack 7 (6.3.0-TIV-ITM-FP0007)

APAR status

• Closed as program error.

Error description

• "secureMain -g <GROUP> lock" leaves some files that need to
  writable by the group ID without group write permissions. The
  following files are affected:
  <CANDLEHOME>/<arch>/<pc>/bin/psit_*.str
  <CANDLEHOME>/<arch>/<pc>/bin/*_agntstat.sta
  <CANDLEHOME>/<arch>/<pc>/bin/*_autoattr.asa
  <CANDLEHOME>/<arch>/<pc>/bin/*_thresholds.xml
  
  This problem was originally reported against the MQ agent under
  APAR IV56725. The current PMR reports the same symptom for the
  UD agent. It turns out the symptom applies to any ITM agent.
  

Local fix

• After running secureMain.sh run this command to set group write
  authority for situation data files:
  
  find ${CANDLEHOME} \( -name "psit_*.str" -o -name
   "*_agntstat.sta" -o -name "*_autoattr.asa" -o -name
   "*_thresholds.xml" \) -exec chmod g+w {} \;
  

Problem summary

• On UNIX and Linux, the secureMain utility controls access to IBM
   Tivoli Monitoring components. The Tivoli Enterprise Monitoring
  Agent (TEMA) component used by all agents creates a set of files
   in <CANDLEHOME>/<platform>/<pc>/bin. These data files require
  group write access for the agent to run properly. When
  secureMain is used to set permissions for the component, these
  files are set with group read only access. The file name
  patterns affected are: psit_*.str, *_agntstat.sta,
  *_autoattr.asa, and *_thresholds.xml.
  
  When this happens, messages like the following are written to
  the agent log:
  
    (531F0D57.0087-B:kraapsit.cpp,1169,"writePersistSituation")
    Unable to open file
  /opt/IBM/ITM/ls3263/mq/bin/psit_XXXXXXX_xxxxxxxx_XX.str for
  recording, error=13
  

Problem conclusion

• The code was changed to set group write authority for affected
  files.
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
    | fix pack | 6.3.0-TIV-ITM-FP0007
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  OMEG DIST INSTA

• Fixed component ID

  5608A41CI

Applicable component levels