Fixes are available
Tivoli Log File Agent, Version 6.3.0 Fix Pack 01 (6.3.0-TIV-ITM_LFA-FP0001)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 04 6.3.0-TIV-ITM_LFA-IF0004
Tivoli Log File Agent, Version 6.3.0 Fix Pack 02 (6.3.0-TIV-ITM_LFA-FP0002)
Tivoli Log File Agent, Version 6.3.0 Interim Fix 05 6.3.0-TIV-ITM_LFA-IF0005
APAR status
Closed as program error.
Error description
When an event which is detected by the Log File agent is output from a situation using a Take Action command, by a redirection, etc.; a single-byte character "\" is displayed as double-byte"middle point" character. The character is correctly displayed in the portal indicating that it is correctly read and translated by the agent when read from the monitored log file. The problem only occurs when the attribute containing backslash is used in a Take Action command. When the character is read from input monitored file, it is converted from ibm-943_P15A-2003 to UTF-8, becoming 0xC2A5 (UTF8 representation of backslash\yen). When the take action is performed, the agent translates it from UTF-8 to CP932 which results in the character code 0xFCFC. Affected Versions: The problem exists on the Log File Agent version 6.3.0 interim fix 0003 and earlier, with Japanese locale. It is platform independent. Problem Determination: On the LO agent system, enable: KBB_RAS1= ERROR (UNIT:logmonitor all)(UNIT:kum0nget all) (UNIT:kumprmfr ALL) (UNIT:task ALL) (UNIT:command ALL) The agent RAS1 log <hostname>_lo_[instance]_kloagent_<timestamp>-<nn>.log contains trace entries are similar to the following: ... (54B982FE.000A-B30:kum0nget.c,411,"TranslateStringToUTF8") Entry (54B982FE.000B-B30:kum0nget.c,419,"TranslateStringToUTF8") Converting string buffer from ibm-943_P15A-2003 to UTF-8 ... (54B982FE.000F-B30:kumprmfr.c,449,"KUMP_ReadMonitorFileUnicodeRe cord") <0x5FD6678,0x19> +54B982FE.000F 00000000 2045206C 696E6461 C2A56C69 6E6461C2 .E.linda..linda. +54B982FE.000F 00000010 A56C696E 6461200D 0A ... ... (54B982FE.00BE-F20:tasklibrary.cpp,1531,"ConvertCommandToLocal") Converting UTF-8 command to codepage 932 ... (54B982FE.00DC-F20:tasklibrary.cpp,864,"executeTaskRequest") Executing task cmd /c "echo lindaチチlindaチチlinda >>c:\output.sit" RECREATE INSTRUCTIONS: Using a kloagent instance on a Windows platform running a Japanese locale: 1. In the conf file, monitor a log file. LogSources=testin.log 2. Create a simple format file: FORMAT TEMS_Shell_I_Event %s %s C1 $1 CustomSlot1 C2 $2 CustomSlot2 msg $2 END 3. Create a situation on the portal, with an action that outputs a custom slot attribute to a file: - CustomSlot1=='E' Action tab: cmd /c "echo &{KLO_LOGFILEEVENTS.CustomSlot2} >>c:\output.sit" 4. Start the agent instance. 5. Input data to the monitored file: C:>echo E linda\linda\linda >> testin.log
Local fix
Problem summary
When an event which is detected by the agent is output from a situation using a Take Action command, by a redirection, etc.; a single-byte backslash character ("\") is displayed as a double-byte "middle point" character. The character is correctly displayed in the portal indicating that it is correctly read and translated by the agent when read from the monitored log file. The problem only occurs when the attribute containing backslash is used in a Take Action command. When the character is read from the monitored file, it is converted from ibm-943_P15A-2003 to UTF-8 0xC2A5 - the UTF8 representation of backslash\yen). When the take action is performed either at the agent or the monitoring server, the agent translates the 0xC2A5 from UTF-8 to the native CP932 which results in the 0xFCFC character code. The problem exists on the Log File Agent version 6.3.0 Interim Fix 0003 (6.3.0-TIV-ITM_LFA-IF0003) and earlier, with Japanese locale. It can occur on Windows and UNIX platforms.
Problem conclusion
Translate using code page 932, instead of code page 943 on all platforms. The fix for this APAR is included in the following maintenance vehicle: | interim fix | 6.3.0-TIV-ITM_LFA-IF0004 available at http://www.ibm.com/support/docview.wss?uid=swg24039388
Temporary fix
Comments
APAR Information
APAR number
IV68698
Reported component name
ITM LOG FILE AG
Reported component ID
5724C04LF
Reported release
630
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2015-01-19
Closed date
2015-02-26
Last modified date
2015-02-26
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
ITM LOG FILE AG
Fixed component ID
5724C04LF
Applicable component levels
R630 PSY
UP
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSCTNX2","label":"Tivoli Log File Agent"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"630","Edition":"","Line of Business":{"code":"","label":""}}]
Document Information
Modified date:
26 February 2015