IBM Tivoli Netcool/Impact V7.1.0 Fix Pack 21 (7.1.0-TIV-NCI-FP0021)

************************************************************************************************************************************************************************************
* A change introduced by this Fix Pack might negatively affect existing product function.
* 1. When using GetHTTP to send Form Parameters, the parameters are not sent as UTF8.
      The issue is fixed with APAR IJ32032 planned for 7.1.0-TIV-NCI-FP0022.
      Refer to doc https://www.ibm.com/support/pages/apar/IJ32032 for a description of the problem.
* 2. Netcool Impact 7.1.0-TIV-NCI-FP0021 adversely affects the functionality of the updatefornewevents property.
      The fix is delivered with APAR IJ32039 planned for 7.1.0-TIV-NCI-FP0022.
      In the meantime, a fix is for IJ32039 is available by contacting support.
      Refer to document  https://www.ibm.com/support/pages/node/6444783 for a description of the problem.
* 3. Problems adding Data to the TimeRangeGroup data type.
      The issue is fixed with APAR IJ32875 planned for 7.1.0-TIV-NCI-FP0022.
      Refer to doc https://www.ibm.com/support/pages/apar/IJ32875 for a description of the problem.
* 4. Mutual Authentication is not working with GetHTTP and RESTful DSA: After upgrading
      to Netcool/Impact 7.1.0 FP19 and above, mutual authentication with GetHTTP or the
      RESTful DSA fails even when the correct client certificate and key are added to the key
      store. The certificate request fails with an SSL handshake failure.
      The fix is delivered with APAR IJ33969 planned for 7.1.0-TIV-NCI-FP0023.
      Refer to doc https://www.ibm.com/support/pages/apar/IJ33969 for a description of the problem.
* 5. The impact-http-headers.jar is missing from server only installs.
      The issue is fixed with APAR IJ39619 planned for 7.1.0-TIV-NCI-FP0026.
***********************************************************************************************************************************************************************************

The following Netcool/Impact APARs are delivered with Fix Pack 21:
IJ28706: NOI RE PIVOT EVENT CHANGES REVERTS TO ORIGINAL VALUE
IJ29450: SPURIOUS ERROR REPORTED WHEN RUNNING WEB DOCUMENTER
IJ29544: IMPACT FAILOVER WHEN OBJECT SERVER REPOSITORY BOX IS DETACHED FROM NETWORK
IJ29957: RELATED EVENT CONFIG HANG ON MILLIONS OF GROUP EVENT INSTANCES
IJ30137: MWM POLICY RUNS EVENT SUPPRESSION/UN-SUPPRESSION IN THE WRONG ORDER
IJ30194: ENSURE FILTER PRIORITY IS PRESERVED FOR A TRIGGER EDIT
IJ30275: CONFAUTH4LDAP.SH DOES NOT HANDLE THE $ CHARACTER IN THE PASSWORD CORRECTLY
IJ30309: LINK STATUS FOR MULTIPLE NODE PARENT
IJ30330: NETCOOL/IMPACT FIX PACK 20: CAN'T SAVE IMPACTDB DATASOURCE CHANGES: ???EN_US.DERBYSQLDATASOURCEEDITOR.ENCRYPTDERBY???
IJ30609: SERVER.XML BAD ENTRIES GENERATES FP20 INSTALL FAILURE
IJ30671: FP20 NCI_IMPORT FAILS WHEN OPVIEW/DISPLAYS CONTAINS FILES WITHOUT A CLUSTERNAME PREFIX
IJ30680: WSINVOKEDL OR REFERENCING COMPLEX OBJECTS IN AN IMPACT POLICY MAY FAIL ON FIX PACK 20
IJ30898: NOI - ADVANCED TAB NOT REFLECTING THE CHANGES
IJ30908: DERBY DATABASE FILES (*.DAT) RETAIN THEIR LARGE SIZES, EVEN AFTER RUNNING THE REPORT_PURGEDATA POLICY
IJ30995: THE PROGRESS FOR STEP 2 OF SEASONALITY CONFIG DOES NOT PROGRESS
IJ31001: EXECUTING THE SE_CLEANUPDATA POLICY RESULTS IN AN ERROR RUNNING SEASONAL CONFIGURATIONS

Security-related APARs:
IJ30144: SECURITY APAR CVE CVE-2020-13956
IJ30640: Cookie with Insecure or Improper or Missing SameSite attribute
IJ31517: SECURITY APAR: UPGRADE TO LATEST IBM SDK 8 IN IMPACT 710 FP21

List of Impact APARs that have documentation updates or have additional information:
IJ22979 : NEW PROPERTIES ADDED FOR  WEB SERVICES DSA CONNECTIONS
IJ28706 : NOI RE PIVOT EVENT CHANGES REVERTS TO ORIGINAL VALUE
IJ29544 : IMPACT FAILOVER WHEN OBJECT SERVER REPOSITORY BOX IS DETACHED FROM NETWORK
IJ30275 : CONFAUTH4LDAP.SH DOES NOT HANDLE THE $ CHARACTER IN THE PASSWORD CORRECTLY
IJ31001: EXECUTING THE SE_CLEANUPDATA POLICY RESULTS IN AN ERROR RUNNING SEASONAL CONFIGURATIONS

2.0 Additional Support added in Fix Pack 21
JazzSM 1.1.3.0 DASH 3.1.3.10
IBM Installation Manager 1.9.1.4
2.1 Browser Support with Fix Pack 21
Browser: Firefox 86, Google Chrome 89, Microsoft Internet Explorer - 11, Microsoft Edge 88, Safari 14
Operating Systems: RHEL 8.3, zLinux RHEL 7.8, SLES 12.5, 15.2

2.2 Component Updates

Java(TM) SE Runtime Environment "1.8.0_281" (8.0.6.25 (SR6 FP25))
WebSphere Application Server Liberty was updated to version 21.0.0.1
Apache Ant(TM) version 1.9.15

Please note the following Components were deprecated or disabled:
Deprecated support:
Refer to the following published document:
https://www.ibm.com/support/pages/node/6347586
1. IBM Connections integration support
2. Jabber support for 3rd party extensions

Disabled components:
- Starting in FP20, the "Event Isolation and Correlation" is disabled
by default. Refer to the following page for more information: https://www.ibm.com/support/pages/node/6357077

- Starting in FP21 there are changes for TLS, with support for the "com.ibm.jsse2.overrideDefaultTLS" property being dropped with Java
version "1.8.0_281" (8.0.6.25 (SR6 FP25)). This means it is not possible to enforce TLS1.2 using the jvm.properties file (in FP21only). 
TLS 1.2 can be enforced by editing the java.security file instead  For more information see
https://www.ibm.com/docs/en/sdk-java-technology/8?topic=customization-matching-behavior-sslcontextgetinstancetls-oracle

2.3 Enhancements in Fix Pack 21
Fix Pack 21 includes the following enhancements:

- Disable HTTP methods
https://www.ibm.com/support/knowledgecenter/SSSHYH_7.1.0/com.ibm.netcoolimpact.doc/admin/security.html
A new configuration property, HTTP_BLOCKED_METHODS has been added to the Impact application which can be used to filter out incoming HTTP requests
with specific methods. The TRACE method is blocked by default. 
The GET, POST, PATCH, PUT and DELETE methods cannot be blocked as they are required by the application to function correctly.

- IJ28706: NOI RE PIVOT EVENT CHANGES REVERTS TO ORIGINAL VALUE
Previously changes to the Pivot event were not preserved. The change was only applicable for while the Related Events Details page was opened.
IJ28706 provides for changes to the Pivot event to be preserved in the database.

- RFE 40578: Add option to set a flag  in Omnibus AFTER an event is read and BEFORE it is sent for processing
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=40578
This RFE adds the option to set an Omnibus field for events, after they are read by Impact, but before they are sent for processing. 
The concept is that a field will be set for the entire time the event is being processed. This is to allow for extra control to ensure that the 
event is not re-read whilst it is being processed. The processing policy has the responsibility for un-setting the field, if required. 
The Event Reader should have a clause in the filter to exclude events with this field set. i.e. ImpactReadFlag=0
The Event Reader should also use another field to stop re-reading/re-processing events whose only change is that the ImpactReadFlag
went from 1 to 0. Otherwise we would end up in a loop!
There are two new properties to be documented to control this:
impact.<reader name>.objectserver.updatefornewevents
impact.<reader name>.objectserver.updateforneweventsexpr
These new properties are similar in syntax to the existing properties documented here:
https://www.ibm.com/support/knowledgecenter/SSSHYH_7.1.0/com.ibm.netcoolimpact.doc/common/dita/ts_serial_value_omnibus_eventreader_failover_failback_config_eventreader.html

- RFE 146208: "Optimize List" button of OMNIbusEventReader must follow policies included by a "Load" statement
http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=146208
When selecting fields for an OMNIbus Event Reader, the optimize function will now search secondary policies for EventContainer fields. 
If a policy from an active event filter references another policy (via the Javascript load method), the optimize function will add any EventContainer
fields from the secondary policies to the list of selected fields.

   (in a NOI installation); by using the following steps:
1.Find appropriately named ImpactDB_NOI_FP21.zip file located in $IMPACT_HOME/install/dbcore.
2.Stop all ImpactServers in the cluster (primary and secondary that run Derby DB).
3.Backup/Remove the existing ImpactDB directory structure in $IMPACT_HOME/db/<ServerName>/derby.
4.Copy the zip file found in step 1 to $IMPACT_HOME/db/<ServerName>/derby and unzip it.
5.Start Impact Server primary, let it fully initialize and start, and now start secondary server and let it re-sync from the primary.

- Enabling LDAP Authentication
When editing the $IMPACT_HOME/install/security/impactdap.properties before
enabling LDAP Authentication, ensure the version of the impactdap.properties is from the latest install! 
* Do not copy a props file from a different/older FixPack. 
* Ensure to only edit the properties, do not delete/remove any of the properties before running the
$IMPACT_HOME/install/security/confAuth4LDAP.sh script

4.0 Known Issues and suggested workaround in Fix Pack 21

- FIPS: The enablement of "com.ibm.jsse2.usefipsprovider=true" flag prevents WebSphere Liberty apps from starting properly

- The following applies only to Netcool/Impact Clients with Netcool Operations Insight (NOI) - and only for those with Existing configurations:
After upgrading to Netcool/Impact 7.1.0 FP13 (and above), run through the Wizard; confirm, verify & save the configuration. Refer to:Event Analytics Configuration 
1. It is a known issue that custom roll-up changes to properties and params files are overwritten. Running through the wizard will repair these.
2. Also for seasonality View, it is advisable to run through the Wizard to make sure the right columns are displayed.  
Refer to the following to the link, for appropriate actions related to "Migration of rollups in Netcool/Impact":
https://www.ibm.com/support/knowledgecenter/SSTPTP_1.4.1/com.ibm.netcool_ops.doc/soc/event_analytics/concept/soc_ea_rollup_migrate.html

- The EventReader service for Seasonality Events is called "ProcessSeasonalityEvents" and it does not (by default) read updated or 
de-duplicated events. "Get updated events" is not selected (by default) in the UI for the "ProcessSeasonalityEvents" Service, on the Event Mapping tab. 
The reason for this is due to the wide Filter for the "ProcessSeasonalityEvents" Event Reader service. By default, the filter is set to "1=1". 
With this wide filter, if "Get updated events" was enabled, and Seasonality rules fired, this could lead to an infinite loop. i.e.
Seasonality Rules updating events which in turn get read by the reader and fire the Seasonality Rules again.
The solution is for the Event Mapping Filter to be set, in such a way, as to avoid already processed events. i.e. if the Seasonality rules are setting the
Service field to "something" then the Event Mapping Filter could be set to restrict these.

- NOI: Impact Event Isolation and Correlation page does not load if non-default cluster name is used (such as NCICLUSTER_Z)
To resolve this issue, perform the following actions:
  - stop the Impact GUI server $IMPACT_HOME/bin/stopGUIServer.sh
  - copy or rename the file with the correct cluster name. For example:
  cp $IMPACT_HOME/opview/displays/NCICLUSTER-EIC_configure.html  $IMPACT_HOME/opview/displays/NCICLUSTER_Z-EIC_configure.html
  - restart the Impact GUI server $IMPACT_HOME/bin/startGUIServer.sh
  - go to the Event Isolation and Correlation page and confirm the page is displayed without the errors.

- NOI 1.6: The Event Analytics Configuration wizard reports an Unexpected Token error when the Impact GUI server under the Turkish locale 
Symptom: When loading the Event Analytics configuration page, an "Unexpected token: E" error is reported. Configuration cannot continue.
Root Cause:When the Impact GUI server is running under the Turkish locale, the GUI server is unable to find the contents of the uiproviderconfig directory.
Resolution: Switch to a different locale and restart the Impact GUI server

- Customization made to web.xml is overwritten
Symptom: Any customization made to the web.xml file of a .war file (such as opview.war and netcool.war)  may be overwritten during the upgrade process.
Resolution: Please check the web.xml file after completing the upgrade and reapply the customization. You can find the old customization in the following directory. 
Merge the customization, as appropriate: <backup>/install/gui_backup/<prior-fp name>/wlp/usr/servers/ImpactUI/apps/ImpactUI.ear

- On Test environments, where more than on instance of Impact is installed (under the same user ID), Installation Manager may suppress the pop-up 
message "insufficient space for back-up directory" when performing the preliminary system checks (at Fix Pack update).
Resolution: A minimum of 900MB of space is required for updates. If it is really to have more than one instance of Impact on the environment, 
each instance should be installed under different user IDs and under under different directories. 

- The Prerequisite Scanner will report a failure when it checks the OS Version for SUSE Linux Enterprise Server 15 or later. This failure can be ignored as
SUSE Linux Enterprise Server 15 is supported by Netcool/Impact.