MUST GATHER: Collecting Troubleshooting Data for the zSecure Suite of Products

Collecting troubleshooting data early, even before opening the case, helps IBM® Support quickly determine ehrther:

1. Symptoms match known problems (rediscovery).
2. There is a nondefect problem that can be quickly identified and resolved.
3. A workaround exists which can reduce current severity.

Table of Contents:

zSecure Adapters for SIEM
zSecure Admin
zSecure Alert
zSecure Audit
zSecure CICS Toolkit
zSecure Command Verifier
zSecure Manager for RACF on z/VM
zSecure Visual

Sending Large Files
Submitting Information to IBM Support
Online Self-Help Resources
Related Information
 

zSecure Adapters for SIEM

- You need to let IBM Support know whether you are licensed to run ONLY the Adapters for SIEM, or if you also run other products in the zSecure suite such as Audit, Alert, and/or Admin.

- Where are you seeing the problem? Provide the most recent sysprint from the problem job. If only licensed for zSecure Adapters, provide the output from the sample job for creating data (CKQJLEEF).
Home
 

zSecure Admin

 

-Sending in the output from the CKFCOLL job used in creating your current CKFREEZE file is something support asks for frequently. This job output will show whether your CKFREEZE contains all needed and relevant information to your problem.

-Depending on what your problem is you might also want to send in DB2 level and audit information, system load at the time of your problem, and a syslog covering the time period of the problem.

-A copy of your CKFREEZE can sometimes be requested by support. See 'Sending Large Files' for information on how to do this.

-Check preexisting PTFs for any that might relate to your problem.

Home
 

zSecure Alert

-Describe the nature of your problem. Are you using Top Secret, ACF2, or RACF? Does Alert properly start without an abend? If it starts, can you perform a Verify and Refresh via a line command on the SE.A.A panel? If not what errors do you receive? Be sure to save off a sysprint for submission to zSecure Support.

-Is there a particular Alert number that is not properly alerting you when you believe it should?

-Sending in your C2PCUST data set can be very useful for issues with Alert, and can sometimes be requested by Support. See 'Sending Large Files' for information on how to do this.

-This technote might prove useful, Why is zSecure Alert not reporting some selected alerts?

-Whether you are using Top Secret, RACF, or ACF2, check preexisting PTFs for any that might relate to your problem.

Home
 

zSecure Audit

-Describe the nature of your problem. Are you running ACF2, RACF, or Top Secret? What part of Audit is your problem associated with? For example, this might be status(AU.S) or compliance testing(AU.R).

-If compliance, provide the subset of rules you are testing against as well and note the individual failing rules. Check out our fixes by version page for any new PTFs relating to compliance testing.

-Ensure that your CKFREEZE is up to date (less than a day old) and provide the complete output from the CKFCOLL job used to create the CKFREEZE file.

Home
 

zSecure CICS Toolkit

-Along with the zSecure CICS Toolkit release and maintenance level, you will need to provide the underlying z/OS and CICS release information.

-Provide the JCL and job log for any reports/jobs involved, and also include screen captures that might contain any relevant output or messages.

-Check preexisting PTFs for any that might relate to your problem.

Home
 

zSecure Command Verifier

-Provide both the expected behavior of zSecure Command Verifier and the actual behavior you are experiencing. Send the output that shows what you are experiencing that is not as expected.

-Check preexisting PTFs for any that might relate to your problem.

Home
 

zSecure Manager for RACF on z/VM

-Provide Installation - Defined settings (CKRSITE load library), and CKVECOLL parameters specified when creating your active CKFREEZE.

-Your active C2R$PARV configuration profile and any relevant SMF data is also useful in diagnosing problems.

-Check preexisting PTFs for any that might relate to your problem.

Home
 

Security zSecure Visual Server

Submitting Information to IBM Support

After a Case is open, you can submit data files to IBM using one of the following methods:
 

• -FTP: Use this link for instructions on how to send data via FTP for My Support cases: FTP instructions
  Additional information for z/OS data is  also available at this link. 
  -Email: If FTP is not possible, or if files are <2MB, use the email ecurep@ecurep.ibm.com.

To email, follow these conventions:

Email small files (<2MB) to ibmsecurity_support@ecurep.ibm.com. The subject line must follow this format - TSaaaaaaaaa xxxx

Where aaaaa = Case number, xxx = Descriptive text for the file

Your IBM Support Case is updated when either an email or file arrives, but only if the naming convention for the subject or file is followed. If you do not follow the specified naming convention, the email or file will be stored incorrectly and will effectively be lost.

Home
 

Sending Large Files

When submitting large files to Support, some additional steps might be needed.

Submitting a CKFREEZE, UNLOAD, SMF, or C2PCUST data set:
1) Execute the following TSO command to put the CKFREEZE/UNLOAD/SMF/C2PCUST file into XMIT format.
NOTE: SMF data sets might not need to be placed in XMIT format unless the support analyst requests you to do so. These SMF data sets can be tersed and sent to IBM. Send the DCB parameters of your SMF data sets to the support analyst for instructions before sending the SMF data to IBM.

XMIT x.x DATASET('my.file') OUTDATASET('my.file.xmit')

(the notation of "x.x" is just a dummy required operand acting as a place holder, as the output is going to a data set, not a network destination)

2) Then execute TRSMAIN against the data set "my.file.xmit", giving an output data set name the low-level qualifier of "TRS" (for example, "my.file.xmit.trs").

3) Transmit using FTP in binary mode by using the previously provided information and instructions.

Home
 

Online Self-Help Resources

 

• Review up-to-date product information at the zSecure support page. (Enter the zSecure product you are looking for within the product finder search bar).
   
• Access online content on supported versions of the zSecure Suite using the IBM Documentation Web Page.

Home
 

Related Information

Recommended Fixes:

• zSecure Base (can include Admin, Audit, Alert, Visual, and Adapters for SIEM)
• zSecure Audit for ACF2
• zSecure Command Verifier
• zSecure CICS Toolkit
• zSecure Manager for RACF on z/VM
• zSecure Visual

Home