IBM Security Z Security

Hello All,

We are testing an upgrade from zSecure 2.5 to 3.1.  The suite was installed to a different set of libraries, so we've updated the CKR exec to point to that and we're successful launching the panels and using release 3.1 for Admin/Audit.

I am working on getting Alert up and running.  C2POLICE and C2$RPARM were updated with the new CPREFIX and STEPLIB.  We issued the F C2POLICE,SIPL to bring down the task, started it after and it's reflecting release 3.1.0.  I can use the panels to verify and refresh the Alert configuration (same one we were using on release 2.5), but no enabled alerts are actually being captured. I do not see any errors to go on.

The only thing I can note is that I did not receive the upgrade panel when accessing the Alert configuration in SE.A that is described here:
Setup panel for upgrading zSecure Alert

Any thoughts regarding why the alerts have stopped triggering?

Thanks,
Matt

Hi matt,

you only get the upgrade panel if Alert was shipped with a new version of the table it uses to store its data. But in 2.5 and 3.1 its the same level F. So no upgrade needed.

Why no alerts are triggered i cant say but i would start with having a look in C2PDEBUG in the started task to see if all is ok with the CARLa engine used there. If that looks ok you could issue a F C2POLICE,DEBUG ALL and in the STC you should see what smf records/wto's are captured during an interval

that should look something like this

C2P0105I Received command DEBUG ALL           
C2P0424I MDB linecount=00000001 MsgNo=$HASP100
C2P0424I MDB linecount=00000001 MsgNo=IRR010I 
C2P0424I MDB linecount=00000001 MsgNo=ICH70001
C2P0424I MDB linecount=00000001 MsgNo=$HASP373
C2P0424I MDB linecount=00000001 MsgNo=IEF403I

C2P0333I Buffer stats for buffer 08                     
C2P0325I Buffer stats: SMF(cnt,len)  00001035-00411803  
C2P0544I Rectype Subtype   Count                        
C2P0544I      30   total      56                        
C2P0544I               1      15                        
C2P0544I               4      28                        
C2P0544I               5      13                        
C2P0544I      42             380                        
C2P0544I      80   total     599                        
C2P0544I               2     466                        
C2P0544I               5      33                        
C2P0544I               7      32                        
C2P0544I              28       6                        
C2P0544I              30      29                        
C2P0544I              32       7                        
C2P0544I              33       2                        
C2P0544I              38       6                        
C2P0544I              39      16                        
C2P0544I              45       1                        
C2P0544I              54       1                        
C2P0326I Buffer stats: WTO(cnt,len)  00000003-00001962  
C2P0232I Buffer stats: ACMN(cnt,len) 00000016-00000969   

if nothing appears to be captured, we will have to look further

cheers

rene

Hello All,

We are testing an upgrade from zSecure 2.5 to 3.1.  The suite was installed to a different set of libraries, so we've updated the CKR exec to point to that and we're successful launching the panels and using release 3.1 for Admin/Audit.

I am working on getting Alert up and running.  C2POLICE and C2$RPARM were updated with the new CPREFIX and STEPLIB.  We issued the F C2POLICE,SIPL to bring down the task, started it after and it's reflecting release 3.1.0.  I can use the panels to verify and refresh the Alert configuration (same one we were using on release 2.5), but no enabled alerts are actually being captured. I do not see any errors to go on.

The only thing I can note is that I did not receive the upgrade panel when accessing the Alert configuration in SE.A that is described here:
Setup panel for upgrading zSecure Alert

Any thoughts regarding why the alerts have stopped triggering?

Thanks,
Matt

Hi Rene,

Thanks for the tip, it does appear that no records are being captured for the interval:
C2P0105I Received command DEBUG ALL            
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 19            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 20            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 01            
C2P0233I No records collected this interval    
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 02            
C2P0233I No records collected this interval    

I will try and debug why that is happening.

Hi matt,

you only get the upgrade panel if Alert was shipped with a new version of the table it uses to store its data. But in 2.5 and 3.1 its the same level F. So no upgrade needed.

Why no alerts are triggered i cant say but i would start with having a look in C2PDEBUG in the started task to see if all is ok with the CARLa engine used there. If that looks ok you could issue a F C2POLICE,DEBUG ALL and in the STC you should see what smf records/wto's are captured during an interval

that should look something like this

C2P0105I Received command DEBUG ALL           
C2P0424I MDB linecount=00000001 MsgNo=$HASP100
C2P0424I MDB linecount=00000001 MsgNo=IRR010I 
C2P0424I MDB linecount=00000001 MsgNo=ICH70001
C2P0424I MDB linecount=00000001 MsgNo=$HASP373
C2P0424I MDB linecount=00000001 MsgNo=IEF403I

C2P0333I Buffer stats for buffer 08                     
C2P0325I Buffer stats: SMF(cnt,len)  00001035-00411803  
C2P0544I Rectype Subtype   Count                        
C2P0544I      30   total      56                        
C2P0544I               1      15                        
C2P0544I               4      28                        
C2P0544I               5      13                        
C2P0544I      42             380                        
C2P0544I      80   total     599                        
C2P0544I               2     466                        
C2P0544I               5      33                        
C2P0544I               7      32                        
C2P0544I              28       6                        
C2P0544I              30      29                        
C2P0544I              32       7                        
C2P0544I              33       2                        
C2P0544I              38       6                        
C2P0544I              39      16                        
C2P0544I              45       1                        
C2P0544I              54       1                        
C2P0326I Buffer stats: WTO(cnt,len)  00000003-00001962  
C2P0232I Buffer stats: ACMN(cnt,len) 00000016-00000969   

if nothing appears to be captured, we will have to look further

cheers

rene

Hello All,

We are testing an upgrade from zSecure 2.5 to 3.1.  The suite was installed to a different set of libraries, so we've updated the CKR exec to point to that and we're successful launching the panels and using release 3.1 for Admin/Audit.

I am working on getting Alert up and running.  C2POLICE and C2$RPARM were updated with the new CPREFIX and STEPLIB.  We issued the F C2POLICE,SIPL to bring down the task, started it after and it's reflecting release 3.1.0.  I can use the panels to verify and refresh the Alert configuration (same one we were using on release 2.5), but no enabled alerts are actually being captured. I do not see any errors to go on.

The only thing I can note is that I did not receive the upgrade panel when accessing the Alert configuration in SE.A that is described here:
Setup panel for upgrading zSecure Alert

Any thoughts regarding why the alerts have stopped triggering?

Thanks,
Matt

I confirmed the IEFU86 exit was active:

-D PROG,EXIT,MOD=C2PSMF86 CSV462I 13.39.16 PROG,EXIT DISPLAY 214 MODULE  C2PSMF86 EXIT(S) SYSSTC.IEFU86    SYS.IEFU86

and a DISPLAY shows the SMF filtering should have the types I'm interested in included

C2P0106I zSecure Alert options and status  289               C2P0134I Version 3.1.0 23.321 01:05:00.80                    C2P0140I C2PC area located at 21777000                       C2P0602I Task runs in SYSSTC service class                   C2P0110I Number of data buffers is 20                        C2P0111I Current buffer index is 14                          C2P0107I BufSize (Kbytes) 20480                              C2P0108I BufUsed (KBytes) 1                                  C2P0109I Report interval (sec) 60                            C2P0477I Current report interval ends 14:21:25               C2P0125I Averaging period (sec) 300                          C2P0126I Preprocessing task interval is (min) 60             C2P0478I Next preprocessing run starts 14:49:09              C2P0725I Refresh of alert reporting task uses stop/start modeC2P0436I Extended Monitoring is not active                   C2P0129I System data collection start time is 01:00:00       C2P0144I CKFREEZE collection started task name is C2PCOLL    C2P0360I Daily CKFREEZE DSName is                            C2P0360I              C2P0135I Preprocessing CARLa member is xxxxS                 C2P0127I Main report member xxxx                             C2P0128I Report DDName SC2PSAMP                              C2P0148I Report DSName      C2P0378I WTO task console name is C2PWTOT2                   C2P0115I SMF Filter Rectype(7)                               C2P0115I SMF Filter Rectype(30) Subtype(1)                   C2P0115I SMF Filter Rectype(42)                              C2P0115I SMF Filter Rectype(80) All subtypes                 C2P0115I SMF Filter Rectype(83)                              C2P0115I SMF Filter Rectype(90)                              C2P0115I SMF Filter Rectype(92) Subtype(15)                  C2P0115I SMF Filter Rectype(119) All subtypes                C2P0116I WTO Filter Prefix(IRR421I)                          C2P0116I WTO Filter Prefix(CSV410I)                          C2P0116I WTO Filter Prefix(IRR812I)                          C2P0116I WTO Filter Prefix(CSV420I)                          C2P0116I WTO Filter Prefix(IEE351I)                          C2P0116I WTO Filter Prefix(IEE9)                             C2P0116I WTO Filter Prefix(IFA786W)                          C2P0116I WTO Filter Prefix(IFA780A)                          C2P0116I WTO Filter Prefix(IFA782A)                          C2P0116I WTO Filter Prefix(C2P0100A)                         C2P0116I WTO Filter Prefix(C2P0335E)                         C2P0116I WTO Filter Prefix(CKN165I)                          C2P0149I End of display 

Hi Rene,

Thanks for the tip, it does appear that no records are being captured for the interval:
C2P0105I Received command DEBUG ALL            
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 19            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 20            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 01            
C2P0233I No records collected this interval    
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 02            
C2P0233I No records collected this interval    

I will try and debug why that is happening.

Hi matt,

you only get the upgrade panel if Alert was shipped with a new version of the table it uses to store its data. But in 2.5 and 3.1 its the same level F. So no upgrade needed.

Why no alerts are triggered i cant say but i would start with having a look in C2PDEBUG in the started task to see if all is ok with the CARLa engine used there. If that looks ok you could issue a F C2POLICE,DEBUG ALL and in the STC you should see what smf records/wto's are captured during an interval

that should look something like this

C2P0105I Received command DEBUG ALL           
C2P0424I MDB linecount=00000001 MsgNo=$HASP100
C2P0424I MDB linecount=00000001 MsgNo=IRR010I 
C2P0424I MDB linecount=00000001 MsgNo=ICH70001
C2P0424I MDB linecount=00000001 MsgNo=$HASP373
C2P0424I MDB linecount=00000001 MsgNo=IEF403I

C2P0333I Buffer stats for buffer 08                     
C2P0325I Buffer stats: SMF(cnt,len)  00001035-00411803  
C2P0544I Rectype Subtype   Count                        
C2P0544I      30   total      56                        
C2P0544I               1      15                        
C2P0544I               4      28                        
C2P0544I               5      13                        
C2P0544I      42             380                        
C2P0544I      80   total     599                        
C2P0544I               2     466                        
C2P0544I               5      33                        
C2P0544I               7      32                        
C2P0544I              28       6                        
C2P0544I              30      29                        
C2P0544I              32       7                        
C2P0544I              33       2                        
C2P0544I              38       6                        
C2P0544I              39      16                        
C2P0544I              45       1                        
C2P0544I              54       1                        
C2P0326I Buffer stats: WTO(cnt,len)  00000003-00001962  
C2P0232I Buffer stats: ACMN(cnt,len) 00000016-00000969   

if nothing appears to be captured, we will have to look further

cheers

rene

Hello All,

We are testing an upgrade from zSecure 2.5 to 3.1.  The suite was installed to a different set of libraries, so we've updated the CKR exec to point to that and we're successful launching the panels and using release 3.1 for Admin/Audit.

I am working on getting Alert up and running.  C2POLICE and C2$RPARM were updated with the new CPREFIX and STEPLIB.  We issued the F C2POLICE,SIPL to bring down the task, started it after and it's reflecting release 3.1.0.  I can use the panels to verify and refresh the Alert configuration (same one we were using on release 2.5), but no enabled alerts are actually being captured. I do not see any errors to go on.

The only thing I can note is that I did not receive the upgrade panel when accessing the Alert configuration in SE.A that is described here:
Setup panel for upgrading zSecure Alert

Any thoughts regarding why the alerts have stopped triggering?

Thanks,
Matt

Hi Matt

The output of F C2POLICE,DISPLAY confirms that the content of C2PCUST was picked up OK.

After you stopped the 2.5.0 version of C2POLICE using SIPL, did you happen to check if the SMF exit was inactivated?  See the install manual.

If the exit lingered, you would have an exit module without buffers to write into, since SIPL removes them, with code from a prior release.

I confirmed the IEFU86 exit was active:

-D PROG,EXIT,MOD=C2PSMF86 CSV462I 13.39.16 PROG,EXIT DISPLAY 214 MODULE  C2PSMF86 EXIT(S) SYSSTC.IEFU86    SYS.IEFU86

and a DISPLAY shows the SMF filtering should have the types I'm interested in included

C2P0106I zSecure Alert options and status  289               C2P0134I Version 3.1.0 23.321 01:05:00.80                    C2P0140I C2PC area located at 21777000                       C2P0602I Task runs in SYSSTC service class                   C2P0110I Number of data buffers is 20                        C2P0111I Current buffer index is 14                          C2P0107I BufSize (Kbytes) 20480                              C2P0108I BufUsed (KBytes) 1                                  C2P0109I Report interval (sec) 60                            C2P0477I Current report interval ends 14:21:25               C2P0125I Averaging period (sec) 300                          C2P0126I Preprocessing task interval is (min) 60             C2P0478I Next preprocessing run starts 14:49:09              C2P0725I Refresh of alert reporting task uses stop/start modeC2P0436I Extended Monitoring is not active                   C2P0129I System data collection start time is 01:00:00       C2P0144I CKFREEZE collection started task name is C2PCOLL    C2P0360I Daily CKFREEZE DSName is                            C2P0360I              C2P0135I Preprocessing CARLa member is xxxxS                 C2P0127I Main report member xxxx                             C2P0128I Report DDName SC2PSAMP                              C2P0148I Report DSName      C2P0378I WTO task console name is C2PWTOT2                   C2P0115I SMF Filter Rectype(7)                               C2P0115I SMF Filter Rectype(30) Subtype(1)                   C2P0115I SMF Filter Rectype(42)                              C2P0115I SMF Filter Rectype(80) All subtypes                 C2P0115I SMF Filter Rectype(83)                              C2P0115I SMF Filter Rectype(90)                              C2P0115I SMF Filter Rectype(92) Subtype(15)                  C2P0115I SMF Filter Rectype(119) All subtypes                C2P0116I WTO Filter Prefix(IRR421I)                          C2P0116I WTO Filter Prefix(CSV410I)                          C2P0116I WTO Filter Prefix(IRR812I)                          C2P0116I WTO Filter Prefix(CSV420I)                          C2P0116I WTO Filter Prefix(IEE351I)                          C2P0116I WTO Filter Prefix(IEE9)                             C2P0116I WTO Filter Prefix(IFA786W)                          C2P0116I WTO Filter Prefix(IFA780A)                          C2P0116I WTO Filter Prefix(IFA782A)                          C2P0116I WTO Filter Prefix(C2P0100A)                         C2P0116I WTO Filter Prefix(C2P0335E)                         C2P0116I WTO Filter Prefix(CKN165I)                          C2P0149I End of display 

Hi Rene,

Thanks for the tip, it does appear that no records are being captured for the interval:
C2P0105I Received command DEBUG ALL            
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 19            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0424I MDB linecount=00000008 MsgNo=IST663I  
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 20            
C2P0233I No records collected this interval    
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0424I MDB linecount=00000005 MsgNo=IST1436I 
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 01            
C2P0233I No records collected this interval    
C2P0300I Data capture timer loop               
C2P0306I Health Check completed                
C2P0333I Buffer stats for buffer 02            
C2P0233I No records collected this interval    

I will try and debug why that is happening.

Hi matt,

you only get the upgrade panel if Alert was shipped with a new version of the table it uses to store its data. But in 2.5 and 3.1 its the same level F. So no upgrade needed.

Why no alerts are triggered i cant say but i would start with having a look in C2PDEBUG in the started task to see if all is ok with the CARLa engine used there. If that looks ok you could issue a F C2POLICE,DEBUG ALL and in the STC you should see what smf records/wto's are captured during an interval

that should look something like this

C2P0105I Received command DEBUG ALL           
C2P0424I MDB linecount=00000001 MsgNo=$HASP100
C2P0424I MDB linecount=00000001 MsgNo=IRR010I 
C2P0424I MDB linecount=00000001 MsgNo=ICH70001
C2P0424I MDB linecount=00000001 MsgNo=$HASP373
C2P0424I MDB linecount=00000001 MsgNo=IEF403I

C2P0333I Buffer stats for buffer 08                     
C2P0325I Buffer stats: SMF(cnt,len)  00001035-00411803  
C2P0544I Rectype Subtype   Count                        
C2P0544I      30   total      56                        
C2P0544I               1      15                        
C2P0544I               4      28                        
C2P0544I               5      13                        
C2P0544I      42             380                        
C2P0544I      80   total     599                        
C2P0544I               2     466                        
C2P0544I               5      33                        
C2P0544I               7      32                        
C2P0544I              28       6                        
C2P0544I              30      29                        
C2P0544I              32       7                        
C2P0544I              33       2                        
C2P0544I              38       6                        
C2P0544I              39      16                        
C2P0544I              45       1                        
C2P0544I              54       1                        
C2P0326I Buffer stats: WTO(cnt,len)  00000003-00001962  
C2P0232I Buffer stats: ACMN(cnt,len) 00000016-00000969   

if nothing appears to be captured, we will have to look further

cheers

rene

Hello All,

We are testing an upgrade from zSecure 2.5 to 3.1.  The suite was installed to a different set of libraries, so we've updated the CKR exec to point to that and we're successful launching the panels and using release 3.1 for Admin/Audit.

I am working on getting Alert up and running.  C2POLICE and C2$RPARM were updated with the new CPREFIX and STEPLIB.  We issued the F C2POLICE,SIPL to bring down the task, started it after and it's reflecting release 3.1.0.  I can use the panels to verify and refresh the Alert configuration (same one we were using on release 2.5), but no enabled alerts are actually being captured. I do not see any errors to go on.

The only thing I can note is that I did not receive the upgrade panel when accessing the Alert configuration in SE.A that is described here:
Setup panel for upgrading zSecure Alert

Any thoughts regarding why the alerts have stopped triggering?

Thanks,
Matt