IBM Security Z Security

 View Only
  • 1.  ALERT for wto - IOEZ00551E

    Posted Thu October 12, 2023 07:30 PM

    Hello, i have various alerts in place for WTO's but I can not get this one working: IOEZ00551E Aggregate SYS9.xxxx.yyyy.zzzz ran out of space. I have modeled the alert off a valid alert and have performed the verify, refresh, and recreate.

    The one thing i noticed is the "Change data source filter: WTO msg IOEZ0055" can not fit the whole message under prefix. I tried using IOE and IOEZ as a prefix but the alert won't hit. If i try to blank it out, there is an 'Enter required field' message displayed and i must enter something.

    Maybe i modeled this WTO alert off the wrong alert but does anyone have any ideas ? thanks, Joe



    ------------------------------
    Joseph Sumi
    ------------------------------


  • 2.  RE: ALERT for wto - IOEZ00551E

    IBM Champion
    Posted Fri October 13, 2023 06:56 AM

    This may help - https://www.ibm.com/support/pages/increase-length-zsecure-alert-wto-message-id



    ------------------------------
    Hartanto Ario Widjaya
    IBM Champion for zSystems (2022-2023)

    https://hartan.to | https://securitypuppy.com

    Check out https://securitypuppy.com/links for a collection of mainframe links!

    Check out https://securitypuppy.com/training for a collection of free mainframe training!
    ------------------------------



  • 3.  RE: ALERT for wto - IOEZ00551E

    Posted Fri October 13, 2023 12:05 PM

    Hello, thanks ... i followed the technote and received the alert for IOEZ00551E.

    I will also open a ticket for the ui as well. thanks to both of you !!



    ------------------------------
    Joseph Sumi
    ------------------------------



  • 4.  RE: ALERT for wto - IOEZ00551E

    Posted Thu October 19, 2023 08:54 AM

    Hi Joe,

    Just to clarify; the WTO message id field in the UI allows you to define up to an 8 character prefix, which might be enough to accomodate the complete message ID, but for longer message IDs it is not. That still means you can specify an 8 character prefix, which then populates a FILTER ADDWTO(PREFIX(xxxxxxxx)) entry for the alert configuration.

    The description for this parameter:

    "Prefix
    Specifies the first characters of the WTO message identifier. If you want to include all ICH messages,
    simply specify ICH. If you only want to include ICH408I messages, specify the full seven (7)
    characters of the message identifier. The maximum length of the message prefix is eight (8)
    characters. The minimum length is one (1) character."

    This is still true and that part will not be changed.

    What Rene mentioned will be handled as a defect is the inability to process longer message IDs by the C2POLICE started task. The probable solution will be to implement a similar method to the one described by the technote you used to get this working in your environment. This means longer message IDs will be supported without customisation.

    I hope that clarifies things.

    Regards, Mike



    ------------------------------
    Mike Riches
    ------------------------------



  • 5.  RE: ALERT for wto - IOEZ00551E

    Posted Thu October 19, 2023 10:23 AM

    Hello Mike - that suggestion did not work. I set my customized skeleton back to C2PSGLOB. I modifed the prefix to 8 characters:

    WTO message ids and filters for this alert         
    Prefix    Prefix    Prefix    Prefix    Prefix     
    IOEZ0055                                           

    Maybe i misunderstood your update and you were clarifying that the defect to be fixed is to accept/recognize the 8-char prefix as compared to having the UI changed to allow a 10-char prefix ...... ? 

    thanks.



    ------------------------------
    Joseph Sumi
    ------------------------------



  • 6.  RE: ALERT for wto - IOEZ00551E

    Posted Thu October 19, 2023 10:37 AM

    Sorry Joe, I think there has been a misunderstanding as I was not suggesting you change anything.

    At the moment you will need to customise your own C2PSGLOB as per the technote.

    Once zSecure Development provide an enhancement sometime down the road, this C2PSGLOB customisation will no longer be required.



    ------------------------------
    Mike Riches
    ------------------------------



  • 7.  RE: ALERT for wto - IOEZ00551E

    Posted Thu October 19, 2023 11:15 AM

    Hello, yes, I understand now. Thanks.



    ------------------------------
    Joseph Sumi
    ------------------------------



  • 8.  RE: ALERT for wto - IOEZ00551E

    Posted Fri October 13, 2023 07:55 AM

    Hi joe,

    looks we never thought of messages longer then 8. So you cannot specify "IOEZ00551E" in the UI. Besides this the started task doesnt accept "IOEZ00551E" as a filter. i think you can open a defect.

    cheers

    rene



    ------------------------------
    RENE van TIL
    ------------------------------