Tivoli Log File Agent, Version 6.2.3.1 Interim Fix 01 6.2.3.1-TIV-ITM_LFA-IF0001

Download Description

(C) Copyright International Business Machines Corporation 2012.
All rights reserved.

Component: Tivoli(R) Log File Agent,
Version 6.2.3 Fix Pack 1

Component ID: 5724C04LF

Interim Fix: 0001, (6.2.3.1-TIV-ITM_LFA-IF0001)

Date: June 8, 2012

Contents:

1.0 General description
2.0 Problems fixed
3.0 Architecture and prerequisites
4.0 Image directory contents
5.0 Installation instructions
6.0 Additional installation information
7.0 Known problems and workarounds
8.0 Additional product information
9.0 Notices


1.0 General description
===============
This fix resolves the APARs and defects listed in the "Problems Fixed"
section below. This fix also includes the superseded fixes listed in
section 2.3.


2.0 Problems fixed
============
The following problems are addressed by this fix.

2.1 APARs
-------------

APAR: IV20230
Abstract: LFA INCORRECTLY MATCHES WHEN WILD CARDS USED IN
LOGSOURCES
Additional information: When the LogSources statement in the .conf
file contains a pattern (* or ?) to match, the agent matches
the string pattern starting anywhere in the name of each
file in that directory, even if there are no wildcards at
the start of the pattern. As a result, more files may match
than expected, such as files with additional characters
preceding the pattern.

For example, a pattern such as:
LogSources=defghi*.log

matches files such as abcdefghi-1.log, where 'abc' is not
part of the pattern.

APAR: IV19470
Abstract: MEMORY LEAK WITH USE OF *DISCARD*
Additional information: Use of the special predefined event class
*DISCARD* with either REGEX or FORMAT statement causes a
memory leak because storage for part of the event is not
freed when the event is discarded. As a result, the size of
the agent process increased.

APAR: IV17283
Abstract: DOUBLE SINGLE QUOTES ARE SEEN IN EVENTS WHEN SENT TO ITM
Additional information: Escaped single quote characters ('') appear
in events when sent to IBM Tivoli Monitoring. This behavior
results from compatibility with the Tivoli Enterprise Console
Log File Adapter when sending events to the Tivoli Enterprise
Console.

For example:
-------------- Monitored file -----------------------
Feb 7 09:18:08 <hostname> root: abcd'TEST'abcd
-----------------------------------------------------

--------------As seen in the portal------------------
Feb 7 09:18:08 <hostname> root: abcd''TEST''abcd
-----------------------------------------------------

APAR: IV16664
Abstract: %S@ IN A PRINTF STATEMENT IN FMT FILE RESULTS IN GARBLED
SLOTS
Additional information: A %s immediately followed by an @ sign
(%s@) in a PRINTF statement in the .fmt file results in
pieces of the format expression appearing in the output
slots, instead of the actual data. All subsequent slots
are also incorrect.

APAR: IV15874
Abstract: U_INVALID_CHAR_FOUND ERROR WHEN CONVERTING UTF8 STRINGS
Additional information: When translating UTF-8 characters to UTF-16
for ICU regular expression processing, the translation fails
with an U_INVALID_CHAR_FOUND error. This is because only a
partial multi-byte UTF-8 character is read into the buffer,
which causes the encoding conversion to fail. This might occur
when the agent is operating in multi-line mode, for example
when monitoring a syslog pipe or using a multi-line pattern in
the .fmt file.

The following error is seen in the agent log
<hostname>_lo_<instance>_kloagent_<timestamp>.log:
(4F1FFCD1.0006-1E:kum0regx.c,206,"KUM0_IsRegExPatternMatch")
*****Error: u_strFromUTF8 failed for string <log record>
...
+4F1FFCD1.0006 <log record> pRegEx @1BCA8D90
status 10 <U_INVALID_CHAR_FOUND>
(4F1FFCD1.0007-1E:kum0regx.c,267,"KUM0_IsRegExPatternMatch")
*****Error: uregex_setText failed for string <log record>:@A6087

APAR: IV15682
Abstract: PORT IY99731 FIX INTO ITM EIF COMPONENT KEF
Additional information: Under heavy load, if the Event Integration
Facility event cache file wraps, its event header may be
included in the event string, corrupting the event being sent
to the event receiver.

This APAR is included in this fix for the Log File Agent on
Windows(R) systems only. For UNIX(R)/Linux(R) systems, a
provisional fix must be requested to obtain this fix.

APAR: IV09148
Abstract: EIF-REMOVE LIMITATION ON USING FIXED LOG NAMES PER IZ08862
Additional information: The PreFilter statements in the .conf
file do not allow custom Windows Event log names. This
limitation was present in the EIFEvent library base code.

This APAR is included in this fix for the Log File Agent on
Windows systems only. For UNIX/Linux systems, these fixes are
included in IBM Tivoli Monitoring Shared Libraries (TEMA)
component of IBM Tivoli Monitoring 6.2.2 Fix Pack 8
(6.2.2-TIV-ITM-FP0008). You must install the Shared Libraries
(ax) component separately.

2.2 Defects
--------------
None.

2.3 Superseded fixes
-------------------------
None.

2.4 APARs and defects included from superseded fixes
---------------------------------------------------------------
None.


3.0 Architecture and prerequisites
======================
This fix is supported on all operating systems listed in the Tivoli
Log File Agent User's Guide, version 6.2.3.1.

3.1 Prerequisites for this fix
--------------------------------
The prerequisite level for this fix is as follows:

- IBM Tivoli Monitoring, Version 6.2.2: Fix Pack 02 or higher
(6.2.2-TIV-ITM-FP0002)
- IBM Tivoli Monitoring 6.2.3.1 Log File Agent Multiplatform
Multilingual (CI5GAML) available from PassPort Advantage.

As this fix is cumulative, it can be installed on any fix level for
this version, release, and mod level above the prerequisite.

4.0 Image directory contents
===================
This fix image contains the following files:

- 6.2.3.1-TIV-ITM_LFA-IF0001.README
- 6.2.3.1-TIV-ITM_LFA-IF0001.tar
- 6.2.3.1-TIV-ITM_LFA-IF0001.zip.

Note: The .tar and .zip files are identical in content. Use the .tar
file if you are working in a UNIX environment; use the .zip file if
you are working in a Windows environment.

The fix archive file contains the following files:
6.2.3.1-TIV-ITM_LFA-IF0001/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/itmpatch.exe
6.2.3.1-TIV-ITM_LFA-IF0001/kloaix523.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_aix523_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/kloaix526.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_aix526_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klohp11.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_hp11_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klohp116.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_hp116_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klohpi116.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_hpi116_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/kloli6263.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_li6263_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klols3263.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_ls3263_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klols3266.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_ls3266_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klolx8266.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_lx8266_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klosol283.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_sol283_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klosol286.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_sol286_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/klosol606.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_sol606_tema_if0001.tar
6.2.3.1-TIV-ITM_LFA-IF0001/KLOWINNT.dsc
6.2.3.1-TIV-ITM_LFA-IF0001/klo_winnt_tema_if0001.cab
6.2.3.1-TIV-ITM_LFA-IF0001/lo_dd_062204006.xml
6.2.3.1-TIV-ITM_LFA-IF0001/lo_dd.properties
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/aix523/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/aix526/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/hp11/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/hp116/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/hpi116/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/li6263/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/ls3263/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/ls3266/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/lx8266/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/sol283/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/sol286/itmpatch
6.2.3.1-TIV-ITM_LFA-IF0001/patchtool/sol606/itmpatch

Each tar or cab file has updates to the IBM Tivoli Enterprise
Monitoring Server component for a specific platform. The platform that
each file applies to is included in its name.

5.0 Installation instructions
==================
This fix can only be installed over an existing installation. Use the
following steps to install this fix.

5.1 Before installing the fix
-------------------------------
- The prerequisites listed under section 3.1 entitled 'Prerequisites
for this fix' must be installed before this fix can be installed.

- For the purpose of this README, the symbol <CANDLEHOME> is the
IBM Tivoli Monitoring installation directory. The default value
for CANDLEHOME is '/opt/IBM/ITM' on UNIX systems and 'C:\IBM\ITM'
on Windows systems.

- Before installing this fix on UNIX systems, set the environment
variable CANDLEHOME to the IBM Tivoli Monitoring installation
directory.

For example:
> CANDLEHOME=/opt/IBM/ITM
> export CANDLEHOME

- Because there is no uninstall utility for this fix, make sure to
perform a backup of your environment before installing this fix.

5.2 Local agent update
--------------------------
1. Transfer the appropriate archive file
(6.2.3.1-TIV-ITM_LFA-IF0001.tar or .zip) to a temporary directory
on the system that contains the agent to be updated. For the
purpose of this README, the symbol <TEMP> represents the fully
qualified path to this directory. Note: On Windows systems, this
path includes the drive letter.

2. Expand the archive file using the "tar" command on UNIX systems
or an extract utility on Windows systems. This step creates a
directory structure that contains fixes for all of the supported
platforms.

3. Use the "itmpatch" command to install the fix for the operating
system of that agent. For more information on the "itmpatch"
command, see section 6.2.

On UNIX systems, if the fix was expanded to <TEMP>/6.2.3.1-TIV-ITM_LFA-IF0001,
the install command is:

> <TEMP>/6.2.3.1-TIV-ITM_LFA-IF0001/itmpatch -h <CANDLEHOME>
-i <TEMP>/6.2.3.1-TIV-ITM_LFA-IF0001/klo_xxxxxx_tema_if0001.tar

where:
- xxxxxx corresponds to the value in the first column returned
by the ./cinfo -i command.

In the following example, the file is "klo_li6243_tema_if0001.tar".
> ./cinfo -i
lo Tivoli Log File Agent
li6263 Version: 06.23.01.00

On Windows systems, if the fix was expanded to
<TEMP>\6.2.3.1-TIV-ITM_LFA-IF0001, the install command is:

> <TEMP>\6.2.3.1-TIV-ITM_LFA-IF0001\itmpatch -h <CANDLEHOME>
-i <TEMP>\6.2.3.1-TIV-ITM_LFA-IF0001\klo_winnt_tema_if0001.cab

Note: The itmpatch.exe provided with older releases of IBM Tivoli
Monitoring did not support updating 64-bit Windows systems with
32-bit binaries. For 64-bit Windows systems, you must use the
itmpatch.exe provided with this interim fix.

5.3 Remote agent update
----------------------------
1. Transfer the appropriate archive file
(6.2.3.1-TIV-ITM_LFA-IF0001.tar or .zip) to a temporary directory
on the IBM Tivoli Enterprise Monitoring Server system. For the
purpose of this README, the symbol <TEMP> represents the fully
qualified path to this directory. Note: On Windows systems, this
path includes the drive letter.

2. Expand the archive file using the "tar" command on UNIX systems or
an extract utility on Windows systems. This step creates a directory
structure that contains fixes for all of the supported platforms.

3. To add the agent fix bundles into the remote deploy depot, use
the "tacmd addBundles" command found in $CANDLEHOME/bin on UNIX
systems or in %CANDLE_HOME%\bin on Windows systems. For more
information on the "tacmd addBundles" command, see the IBM Tivoli
Monitoring Administrator's Guide.

On UNIX systems,
if the fix was expanded to <TEMP>/6.2.3.1-TIV-ITM_LFA-IF0001:
> $CANDLEHOME/bin/tacmd addBundles -n
-i <TEMP>/6.2.3.1-TIV-ITM_LFA-IF0001

On Windows systems,
if the fix was expanded to <TEMP>\6.2.3.1-TIV-ITM_LFA-IF0001:
> %CANDLE_HOME%\bin\tacmd addBundles -n
-i <TEMP>\6.2.3.1-TIV-ITM_LFA-IF0001

where:
-n indicates that prerequisite bundles are not automatically
added. The -n parameter must be used because the fix
directory does not contain any prerequisites that the fix
might require. Please see Section 3.1 for the prerequisites
for this fix.
-i is the directory that contains the deployment bundles to be
added to the depot.

4. To log in to the Tivoli Enterprise Monitoring server, and deploy
the fix to the appropriate nodes where the agent is running, use
the following "tacmd" commands. For more information on the
"tacmd login" and "tacmd updateAgent" commands, see the IBM Tivoli
Monitoring Administrator's Guide.

On UNIX systems:
> $CANDLEHOME/bin/tacmd login -s <server>
-u <itmuser>
-p <password>

> $CANDLEHOME/bin/tacmd listSystems

The output shows the Managed System Name for the OS agent on the
remote system to be updated. Use this value as the target of the
"tacmd updateAgent" command.

> $CANDLEHOME/bin/tacmd updateAgent -t lo
-n <Managed system name>
-v 062301001

On Windows systems:
> %CANDLE_HOME%\bin\tacmd login -s <server>
-u <itmuser>
-p <password>

> %CANDLE_HOME%\bin\tacmd listSystems

The output shows the Managed System Name for the OS agent on the
remote system to be updated. Use this value as the target of the
"tacmd updateAgent" command.

> %CANDLE_HOME%\bin\tacmd updateAgent -t LO
-n <Managed system name>
-v 062301001

Note:
- The component (-t) for the "tacmd updateAgent" command is
specified as two characters (LO), not three characters (KLO).
- The node (-n) for the "tacmd updateAgent" command is the managed
system name of the operating system (OS) agent to be updated.
The target node for the "tacmd updateAgent" command is always
an OS agent.

5.4 Agent support update
------------------------------
There are no agent support updates for the Tivoli Enterprise
Monitoring Server, Tivoli Enterprise Portal Server,or Tivoli
Enterprise Portal Desktop included in this fix or any of the
superseded fixes. No additional installation steps are required.

6.0 Additional installation information
========================

6.1 Installation instructions for agent baroc file
-----------------------------------------------------
There are no updates to the baroc files included in this fix or
any of the superseded fixes. No additional installation steps are
required.

6.2 Additional information on using "itmpatch" command
--------------------------------------------------------------
The "itmpatch" command has the following syntax:

Usage: itmpatch -h <installation home> [OPTIONS]

itmpatch -h <installation home>
-t { <patch_file_directory> | <patch_file> }

itmpatch -h <installation home>
-i { <patch_file_directory> | <patch_file> }

where:
-h Specifies the IBM Tivoli Monitoring installation directory
-i Specifies the path to the directory or patch file to be installed
-t Generates a report of the actions to be taken by the patch


For example, on UNIX systems:
- To preview the fix installation, use the "-t" option:
> <CANDLEHOME>/bin/itmpatch -h <CANDLEHOME> -t <TEMP>

- To install the fix, use the "-i" option:
> <CANDLEHOME>/bin/itmpatch -h <CANDLEHOME> -i <TEMP>

where:
<CANDLEHOME> is the fully qualified IBM Tivoli Monitoring
installation directory. On Windows systems, this path must include
the drive letter.
<TEMP> represents the fully qualified directory specification, where
the fix is located. On Windows systems, this must include the drive
letter.

6.3 Verifying the update
----------------------------
1. To verify the agent was updated correctly, use the "tacmd" command
to view the agent's current version after the agent is restarted.
You are required to log in to a Tivoli Enterprise Monitoring
Server prior to viewing the agent version.

For example:
On UNIX systems, where $CANDLEHOME is the IBM Tivoli Monitoring
installation directory, the default location is '/opt/IBM/ITM'.

> $CANDLEHOME/bin/tacmd login -s <server>
-u <itmuser>
-p <password>
> $CANDLEHOME/bin/tacmd listSystems -t LO

On Windows systems, where %CANDLE_HOME% is the IBM Tivoli
Monitoring installation directory, the default location
is 'C:\IBM\ITM'.

> %CANDLE_HOME%\bin\tacmd login -s <server>
-u <itmuser>
-p <password>

> %CANDLE_HOME%\bin\tacmd listSystems -t LO

Note: The component (-t) for the "tacmd listSystems" command is
specified as two characters (LO), not three characters (KLO).

When the agent update is successful, the agent version is:
06.23.01.01.

After the agent is restarted, you can also use the GUI to verify
the agent was successfully updated.

For the agent on Windows systems, the version number is
06.23.01.01.


2. To verify the agent you are running contains the updates from the
fix, see the following lines in the agent log
<hostname>_<productCode>_<instance>_k<productCode>agent_<timestamp>.log:
located in $CANDLEHOME/logs on UNIX systems and
%CANDLE_HOME%\tmaitm6[_x64]\logs on Windows systems.

+4EC55E63.0001 Component: ira
+4EC55E63.0001 Driver: afac_lfa_6231:201205211505/...
+4EC55E63.0001 Timestamp: May 21 2012 ...

7.0 Known problems and workarounds
=========================
None.

8.0 Additional product information
======================
None.

9.0 Notices
=======
This information was developed for products and services offered in the
United States. IBM may not offer the products, services, or features
discussed in this document in other countries. Consult your local IBM
representative for information on the products and services currently
available in your area. Any reference to an IBM product, program, or
service is not intended to state or imply that only that IBM product,
program, or service may be used. Any functionally equivalent product,
program, or service that does not infringe any IBM intellectual
property right may be used instead. However, it is the user's
responsibility to evaluate and verify the operation of any non-IBM
product, program, or service.

IBM may have patents or pending patent applications covering subject
matter described in this document. The furnishing of this document does
not grant you any license to these patents. You can send license
inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

The following paragraph does not apply to the United Kingdom or any
other country where such provisions are inconsistent with local law:

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION
"AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Some states do not allow disclaimer of express or implied warranties in
certain transactions, therefore, this statement may not apply to you.

Trademarks and service marks
------------------------------------
IBM, the IBM logo, and ibm.com are trademarks or registered trademarks
of International Business Machines Corp., registered in many
jurisdictions worldwide. Other product and service names might be
trademarks of IBM or other companies. A current list of IBM trademarks
is available on the Web at "Copyright and trademark information" at
www.ibm.com/legal/copytrade.shtml.

Linux is a registered trademark of Linus Torvalds in the United States,
other countries, or both.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks
of Microsoft Corporation in the United States, other countries, or
both.

UNIX is a registered trademark of The Open Group in the United States
and other countries.

Other company, product, or service names may be trademarks or service
marks of others.