PH56548: SYSLOGD DISCARDS MESSAGES RECEIVED OVER A TCP CONNECTION

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• syslogd support for receiving messages over a TCP connection is
  incorrectly parsing the message structure.  The resultant
  message structure results in the message being discarded.
  
  VERIFICATION STEPS:
  syslogd is started with the -t option.
  D TCPIP,,N,ALL,SERVER,PORT=514 shows the syslogd TCP listener
  has a non-zero CONNECTIONSIN value.
  Packet trace or external network trace shows the message content
  being sent to syslogd begins with <nn> where the nn are numeric
  values.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All users of the IBM Communications Server for z/OS 2.5 and  *
  * 3.1 IP: Syslog Daemon                                        *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * z/OS syslogd discards messages received over a TCP           *
  * connection.                                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the PTF                                                *
  ****************************************************************
  z/OS syslogd only supports receiving messages that use
  octet-counting framing over a TCP connection. If a message is
  framed using another method, syslogd discards the message and
  closes the connection without generating an error message.
  

Problem conclusion

• Code will be amended to allow z/OS syslogd to recognize both
  non-transparent (traditional) framing and octet-counting framing
  when receiving messages over a TCP connection. A new FSUM1303
  error message will be issued to indicate if the framing method
  is unrecognized, a trailer character is not found, or the
  message length is not valid for a message.
  
  z/OS Communications Server: IP Configuration Guide, chapter
  "Configuring the syslog daemon", topic "Message considerations
  when receiving using TCP" is updated as follows:
  
  The syslogd supports receiving messages over TCP connections
  with octet-counting framing. That is, the message begins with
  the message length followed by a space. Octet-counting framing
  is described in RFC 6587 Transmission of Syslog Messages over
  TCP.
  
  z/OS syslogd also supports receiving messages over TCP
  connections with non-transparent (traditional) framing. Rather
  than specifying the length of the message, non-transparent
  framing relies on the use of a trailer character at the end of
  the message. z/OS syslogd will recognize the following ASCII
  characters as a trailer ending the message - LF (x'0A'), NULL
  (x'00'), and CRLF (x'0D0A').
  
  The following new message is added:
  FSUM1303 recv tcp message error (hostname ipaddr portnum):
  reason
  
  Explanation:
  z/OS syslog daemon (syslogd) found an error while processing a
  message from a remote syslogd client over a TCP connection. The
  TCP connection is closed.
  In the message text:
  hostname - The hostname of the remote syslogd client that sent
  the log message. If the hostname is unknown, hostname is N/A.
  ipaddr - The IP address of the remote syslogd client that sent
  the log message.
  portnum - The port of the remote syslogd client that sent the
  log message.
  reason - The reason syslogd was not able to process the message.
  The possible values are:
  -unrecognized framing method - syslogd was not able to recognize
  the framing of the message. The first byte of the message was
  not an ASCII less-than sign (x'3C') indicating non-transparent
  framing or an ASCII digit from 0-9 (x'30' - x'39') indicating
  octet-counting. Only octet-counting and non-transparent framing
  are supported.
  -trailer character not found - The message received was
  recognized as using non-transparent framing, but syslogd was not
  able to determine the end of the message. A trailer character
  was not found in the first 16,384 bytes of data. The ASCII
  trailer characters supported by the z/OS syslogd are: LF
  (x'0A'), NUL (x'00'), and CRLF (x'0D0A').
  -message length not valid - The message received was recognized
  as using octet-counting framing but the message length at the
  beginning of the message was not valid. The message length can
  be up to 5 digits long and must be followed by a space.
  
  System Action:
  Processing continues. z/OS syslogd will close the TCP connection
  with the remote client. The TCP inbound thread associated with
  the connection becomes available for a new connection.
  
  System Programmer Response:
  Configure the remote client to use octet-counting framing if it
  is supported. If the remote client only supports non-transparent
  framing, ensure the remote client is configured to use one of
  the following ASCII trailer characters to indicate the end of
  the message: LF (x'0A'), NUL (x'00'), or CRLF (x'0D0A').
  Refer to RFC 6587 "Transmission of Syslog Messages over TCP"
  which describes both framing methods.
  If you continue to receive FSUM1303 error messages after
  ensuring that the remote client is configured correctly, contact
  the IBM Support Center and provide the file that contains the
  syslogd error messages.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI93689 UI93690

Modules/Macros

• EZASYTCP EZASLMSC EZASLOGD
  

Fix information

• Fixed component name

  TCP/IP MVS

• Fixed component ID

  5655HAL00

Applicable component levels

• R250 PSY UI93689

     UP23/10/21 P F310

• R310 PSY UI93690

     UP23/10/21 P F310

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.