OA62236: RACF SMF EVENTS WITH A MISSING CLASS DO NOT RESULT IN A LEEF RECORD BEING GENERATED

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• RACF SMF TYPE=80 events with a missing CLASS do not result in a
  LEEF record being generated.
  
  For example SETROPTS LIST events are missing.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Audit exploiting the        *
  *                 software to prepare data for QRadar SIEM.    *
  ****************************************************************
  * PROBLEM DESCRIPTION: The zSecure Audit QRadar SIEM interface *
  *                      might generate LEEF files that does not *
  *                      contain records of RACF events with a   *
  *                      missing class name.                     *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  When a SMF source being processed by zSecure Audit contains
  RACF event records without a RACF class, the generated LEEF file
  does not contain such records at all.
  

Problem conclusion

• The zSecure Audit QRadar SIEM interface has been modified so
  that it properly writes LEEF records for SMF events without a
  RACF class name.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ06844 UJ06845

Modules/Macros

• CKQLEEF  CKQLEEFL
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R240 PSY UJ06845

     UP21/10/21 P F110

• R250 PSY UJ06844

     UP21/10/21 P F110

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.