IBM Support

IV85644: SYSLOGD PROBE IS SHUTTING DOWN WHEN ENCOUNTERING A VERY LOG SYSLOG MESSAGE.

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as fixed if next.

Error description

  • Here is the error in the probe debug log:
    
    Read Thread (011673F8)
    2016-06-02T08:34:53: Debug: D-ETC-004-050: THREAD MGR: thread
    Read
    Thread (011673F8) running
    2016-06-02T08:34:54: Error: E-UNK-000-000: Failed to read from
    socket -
    WinSock error. Message too long.
    2016-06-02T08:34:54: Debug: D-UNK-000-000: Closing UDP socket on
    port
    514
    2016-06-02T08:34:54: Error: E-P_S-102-000: Socket Error
    Received.
    Reading Thread Exitting
    2016-06-02T08:34:54: Debug: D-ETC-004-051: THREAD MGR: thread
    Read
    Thread (011673F8) stopped
    2016-06-02T08:34:54: Information: I-P_S-104-000: Stopping...
    2016-06-02T08:34:54: Information: I-UNK-000-000: Probewatch:
    Going Down
    
    The reason why is the message coming to syslogd is extremely
    large and it caused the probe to shutdown.  The probe should NOT
    have shut down.
    

Local fix

  • restart probe.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * Users of the syslogd probe on Windows.                       *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * Log messages over 2056 characters caused the syslogd probe   *
    * on Windows to shut down.  The probe on Windows will now      *
    * allow the long messages, but truncate them if necessary.     *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * Upgrade to probe-nco-p-syslogd-5_4                           *
    ****************************************************************
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IV85644

  • Reported component name

    SYSLOG PROBE

  • Reported component ID

    5724P03SL

  • Reported release

    100

  • Status

    CLOSED FIN

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-06-13

  • Closed date

    2016-08-29

  • Last modified date

    2016-08-29

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

  • R100 PSN

       UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSSHTQ","label":"Tivoli Netcool\/OMNIbus"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"100","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 August 2016