IJ52847: LWE REGISTRY CONFIGURATION DATA NOT DELETED AFTER AUDIT DISABLE

APAR status

• Closed as program error.

Error description

• When a new policy is installed for audit log, the audit registry
  config currently in memory is updated to the latest info and the
  LWE garbage collector (LWE GC) is triggered to clean up defunct
  producers.There could be a case where the LWE GC finishes first
  and registry update second, resulting in stale data being loaded
  in memory when there are no producers present (when audit is
  disabled).The next time audit is enabled, the old config data is
  used to configure a new audit producer.
  

Local fix

Problem summary

• When a new policy is installed for audit log, the audit registry
  config currently in memory is updated to the latest info and the
  LWE garbage collector (LWE GC) is triggered to clean up defunct
  producers.There could be a case where the LWE GC finishes first
  and registry update second, resulting in stale data being loaded
  in memory when there are no producers present (when audit is
  disabled).The next time audit is enabled, the old config data is
  used to configure a new audit producer.
  

Problem conclusion

• This problem is fixed in 5.1.9.7
  To see all Spectrum Scale APARs and their respective
  Fix solutions refer to page: 
  https://public.dhe.ibm.com/storage/spectrumscale/spectrum_scale
  _apars.html
  
  
  Benefits of the solution:
  Fixed the code so that the LWE registry configuration is deleted
  when there are no producers present.
  
  Work Around:
  None
  
  Problem trigger:
  - Enable File Audit Logging on node A
  - Generate IOs so that there event producers are configured and
  events are generated in the audit log
  - Disable File Audit Logging on node B
  - Re-enable File Audit Logging on node A- Generate IOs on node B
  
  
  Symptom:
  Unexpected Results/Behavior
  
  Platforms affected:
  Linux
  
  Functional Area affected:
  File Audit Logging
  
  Customer Impact:
  High Importance
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SPEC SCALE STD

• Fixed component ID

  5737F33AP

Applicable component levels