Tivoli Netcool/OMNIbus 8.1.0 Fix Pack 12, 8.1.0-TIV-NCOMNIbus-FP0012

Download Description

The following defect solutions are included in this release:

8.1.0-TIV-NCOMNIbus-FP0012
--------------------------

IV93678
OMNIbus would not run correctly under Linux v4 kernels. This
problem is now fixed. The fix relies on backwards binary
compatibility.


IV93701
Within
$OMNIHOME/extensions/eventgrouping/gateway/AGG_GATE.map.parts
(part of the optional Scope Base Event Grouping extension added
to OMNIbus 8.1.0.4), the MasterCorrelationSiteNameMap mapping is
missing an 'ON INSERT ONLY' clause on the ScopeID field. If the
contents of the AGG_GATE.map.parts are added to any gateway
configurations, then you must manually add this 'ON INSERT ONLY'
clause.


IV93957
Probes that connect to an ObjectServer which has reached its
table store soft limit can fail to disconnect and reconnect
properly. This failure results in the probe permanently remaining
in SAF mode. This issue is now resolved.


IV94202
To address possible security issues, the JRE for Tivoli
Netcool/OMNIbus V8.1.0 is updated to IBM JRE 7.0 SR10 FP5.


IV94895
A new optional security audit log is now added. This log contains
detailed SQL command activity of users that belong to specified
user groups. The audit is active if the existing property
'Sec.AuditLevel' is set at 'info' or 'debug' level. Further
configuration is available through use of two new ObjectServer
properties, 'Sec.AuditSqlLog' and 'Sec.AuditGroups'. The groups
that are audited by default are the 'System' or 'Administrator'
groups. Log file rotation is also supported for this log.


IV95095
While a probe is running with raw capture turned on, the last
record in the raw capture file might incomplete. To fix this
issue, each probe raw capture record is now explicitly flushed to
disk.

IV95423
Netcool/OMNIbus server components use X.509 certificates for
authentication to establish SSL/TLS encrypted connections. The
Common Name attribute of the certificate subject field is used to
identify the server and historically must match the OMNIbus
server name, for example 'NCOMS'.
In response to RFE 86799 'IBM Netcool SSL certificate naming
format incompatible with organisations PKI format and policy'
instead of the OMNIbus server name, it is now possible to use a
fully qualified domain name or wildcard domain name like
'*.ibm.com' as the Common Name attribute value. For example, the
distinguished name "CN=netcool.ibm.com, O=IBM, OU=Cloud,
L=London, C=GB" can be used for an ObjectServer running on host
name 'netcool' in the 'ibm.com' domain. When you use a domain
name as the Common Name value, it is important that the value
matches the server address that is recorded in the interfaces
file omni.dat / sql.ini otherwise the connection does not
proceed.


IV95440
The X.509 certificate that is used by Netcool/OMNIbus server
components for authentication during a SSL/TLS encrypted
connection handshake is stored in the omni.kdb key database. The
certificate is identified by a label that must match the OMNIbus
server name, for example NCOMS. A new advanced property
'Ipc.SSLCertificateLabel' is now added to Netcool/OMNIbus server
components, which helps to specify the certificate to use for
encrypted connections by using the certificate label. In order
for SSL/TLS encrypted connections to proceed, the value that is
used must match a certificate label in the key database. If the
Ipc.SSLCertificateLabel property is not specified, then the
default value of the Netcool/OMNIbus server name is used to
select the certificate in the key database. It is now possible
for two or more OMNIbus processes to share a certificate by using
the new property. For example, all Netcool/OMNIbus server
processes running on host 'netcool' in the 'ibm.com' domain can
share a single certificate with subject value
"CN=netcool.ibm.com, O=IBM, OU=Cloud, L=London, C=GB".

IV95444
The following Process Agent properties and associated command
line arguments have been reclassified as advanced, and no longer
appear in standard help text:


ApiCheck -apicheck
MessagePoolSize -msgpoolsize
PidFile -pidfile
PidMessagePoolSize -pidmsgpool
StackSize -stacksize
TraceEventQueue -traceevtq
TraceMessageQueue -tracemsgq
TraceMutexLocks -tracemtx
TraceNetLibrary -tracenet

The following properties and associated arguments have been
reclassified as deprecated:

WalkHostTable -walkhosttab


IV95875
The following deprecated SSL properties and associated arguments
are now removed from advanced help text and property dump output.

Ipc.SSLEnable -sslenable
Ipc.SSLCertificate -sslcertificate
Ipc.SSLPrivateKeyPassword -sslprivatekeypassword

To provide compatibility with earlier versions, the properties
are still permitted to appear in the properties file or command
line where they are ignored.


IV96149
The values of tokens/elements set by the "eventfactory" URI of
the probe HTTP interface were not being logged in the probe log
file. This issue is now resolved.


IV96150
Raw Capture was not written out for events that are received by
the "eventfactory" URI of the probe HTTP interface. This issue is
now resolved.


IV96183
JSON strings that contain % characters sent to the "eventfactory"
URI of the probe HTTP interface might be corrupted. This issue is
now resolved.