IBM Security Z Security

 View Only
  • 1.  How to handle message C2P0337W

    Posted Sun December 05, 2021 08:42 PM
    Hello,

    we've received C2P0337W messages: HISTORY data lost, increase bufnum and/or bufsize
    The recommendation by the explanation is to increase the number of buffers or the bufsize to prevent data loss.

    I don't actually have an idea which buffers or parameters I must adjust or increase . Is there a any suitable config parm to be adjusted or
    can this be managed in JCL of the started task (region size or whatever) ?

    Perhaps I've overlooked a topic in the zAlert manuals . 

    Best Regards
    Rüdiger Lukas
       



    ------------------------------
    Ruediger Lukas
    ------------------------------


  • 2.  RE: How to handle message C2P0337W

    Posted Mon December 06, 2021 02:55 AM
    Edited by Jeroen Tiggelman Mon December 06, 2021 03:00 AM
    Hi Rüdiger,

    There is a discussion of the buffers in the Alert book, Chapter 2 "zSecure Alert configuration", section "Configuration guidelines and performance implications", subsection "Buffers".

    In section "Configuring zSecure Alert", you can see under "Alert configuration: specify general settings" in Figure 5 "Setup Alert panel: Copying the default zSecure Alert configuration" that there are parameters "Buffer size" and "Number of buffers". In the following description of those parameters, you can read that these correspond to OPTION BUFSIZE or BUFSIZEMB and OPTION NUMBUFS, and there is a pointer to the Installation book for a further description of the OPTION command.

    In the Installation and Deployment Guide you can find the pertinent information in Chapter 12 "Setup of zSecure Alert" in the subsections "Configuration guidelines and performance implications" and "Other commands" - "OPTION command".

    I hope this helps,

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------



  • 3.  RE: How to handle message C2P0337W

    Posted Mon December 06, 2021 08:17 AM
    Hi Jeroen,

    many thanks for your hints and explanation . Yes, it helps .
    I looked at our configuration and I found the parameters I've recently overlooked  .
    Our zAlert is set up with 
    Buffer size . . . . . . 16384 KB
    Number of buffers . . . 32
    I guess we've implemented the "maximum" values regarding the manuals and I assume that we can't increase them or am I wrong anyhow ?

    Best regards
    Rüdiger

    ------------------------------
    Ruediger Lukas
    ------------------------------



  • 4.  RE: How to handle message C2P0337W

    Posted Mon December 06, 2021 08:31 AM
    Hi rudiger,

    you specified the value in KB but you can also specify it in MB which would increase the buffersize considerably :) But if you change it to MB make sure you pick a sensible value otherwise you will most likely run out of storage.

    cheers

    rene

    ------------------------------
    RENE van TIL
    ------------------------------



  • 5.  RE: How to handle message C2P0337W

    Posted Mon December 06, 2021 12:26 PM
    Hello Rene,

    Perfect. This gives me an opportunity for an increasement .
    I will check out how I can implement a suitable "MB" value for the buffersize parameter 
    without running out of storage .

    Many Thx and best regards
    Rüdiger

    ------------------------------
    Ruediger Lukas
    ------------------------------



  • 6.  RE: How to handle message C2P0337W

    Posted Mon December 06, 2021 07:16 AM
    Hi rudiger,

    the definition of the number of buffers and the size of them is defined as part of the Set that the Alert started task is using. If you start the Alert UI (SE.A.A) that set is the one with "Y" in column Act. If you edit that set with a line command E it will show you the parameters for Alert including the number and size of the buffers.

    The defaults are 1024Kb for the size and 10 of these buffers are created. I guess these values havent been changed. I would start with increasing the bufsize as 1Mb is rather small.

    If they are allready much larger then you might want to have a look at the actual number of number of SMF records produced during an interval and then do some of the math described in Chapter 12 of the installation & deployment guide. Or simply increase the size/number and keep an eye on the "C2P0108I BufUsed" message that the Alert started task shows but bear in mind that there might be much higher peak values.

    Which SMF records alert collects can be easily determined by looking at the Alert started task. A display is issued regularly and it shows one or more C2P0115I messages saying what SMF records are being collected.

    cheers

    rene



    ------------------------------
    RENE van TIL
    ------------------------------