IBM Tivoli Netcool/Impact V7.1.0 Fix Pack 23 (7.1.0-TIV-NCI-FP0023)

Download Description

*********************************************************************************************************************************************************
WARNING!

1. Log4j vulnerabilities (CVE-2021-44228,CVE-2021-45105,CVE-2021-45046 and CVE-2021-44832) affect IBM Tivoli Netcool/Impact V7.1.0 Fix Pack 23.
   Fix Pack 23 has been refreshed to include fixes for the Log4j vulnerabilities. Any downloads from before 2nd February 2022 should be deleted and the package should be re-downloaded from Fix central.
   
   To determine if the updated "Refresh" package has been applied, one can run the $IMPACT_HOME/bin/versioninfo script and look for the following line on the output:
   ======================================================================
   Impact Installed Component Version
   ======================================================================
   Version: 7.1.0.23 R
   Where the "R" refers to "Refresh"
   
   If the refresh has already been installed, there is no need to apply interim fix 10 (7.1.0-TIV-NCI-IF0010).
   
   During the upgrade, the previous versions of Log4j will be moved to a backup location for rollback purposes. These versions are not actively used by the product however security scans may continue to flag the backup copy. If the files must be removed but the rollback capability is still required, an archive of the backup location should be created before deleting the log4j files.
2. For systems being upgraded from FP22 for which RFE IRISCART-779 is enabled (integrating CNEA with on-prem Event Analytics) please review
   additional steps here

• https://www.ibm.com/docs/en/tivoli-netcoolimpact/7.1
• Download attached package to review readme file for fix pack 7.1.0.23 Fix pack
• Review list of enhancements, pre-req, installation instruction, and known issues section.

The following Netcool/Impact APARs are delivered with Fix Pack 23:

IJ32748: OPTION TO RETURN RAW DATA FROM RESTFULAPI FUNCTION
IJ33307: PREVENT UPDATING KEY FIELD WHEN UPDATING THE OBJECT SERVER DATA ITEM IN THE UI
IJ33412: NEED TO REMOVE THE "SE_HISTORICALEVENTS" DATA SOURCE, AND ANY REFERENCES IN THE NOI_CONSTANTS POLICY AND SEASONALITY PROJECT
IJ33464: FIX MYSQL DATASOURCE CODE FOR RECENT VERSIONS OF THE MYSQL-CONNECTOR-JAVA DRIVER
IJ33476: SERVER TAKES OVER AS PRIMARY BEFORE SYNC COMPLETE
IJ33726: MEMORY LEAK WITH LOG4J OUTPUTSTREAMMANAGER HASHMAP ENTRIES
IJ33787: IBM IMPACT FIXPACK UPDATE FROM 7.1.0.20 -> 7.1.0.21 FAILED, CANNOT UPGRADE TO IMPACT FP21 IF SSL -FIPS IS ENABLED
IJ33878: NCI_IMPORT DOES NOT IMPORT TIMERANGEGROUP DATA TYPES
IJ33929: OBJECTSERVER DATASOURCE WAIT TIME FOR CONNECTION FROM POOL
IJ33969: REGRESSION: GETHTTP FUNCTION NOT LOADING KEY STORE
IJ33998: NOI PATTERN NOT GROUPING EVENTS
IJ34203: TOOL REQUIRED TO RE-BUILD DERBY INDEXES IN IMPACTDB FOR NOI
IJ34234: FOR TBSM UI DATA PROVIDER, IMPACT REQUIRES TO SEND THE PRE-EMPTIVE AUTHENTICATION TO DASH UI DURING THE HTTP REQUEST
IJ34702: VERSION CONTROL STOPS WORKING ON RHEL6 AFTER FP22

Security-related APARs:
IJ34306: SECURITY APAR: UPGRADE APACHE ANT 1.9 IN IMPACT 710 FP23
IJ34747: SECURITY APAR: UPGRADE TO LATEST IBM SDK 8 IN IMPACT 710 FP23
IJ34910: SECURITY APAR: POSSIBLE OVERFLOW VULNERABILITY IN APACHE MINA SS HD FOR IMPACT

List of Impact APARs that have documentation updates or have additional information:
IJ32748: OPTION TO RETURN RAW DATA FROM RESTFULAPI FUNCTIONS
IJ33171: NEED TO HAVE DOCUMENTATION ON THE URL ENCODING CHANGES DONE TO GETHTTP IN FP19
IJ33307: PREVENT UPDATING KEY FIELD WHEN UPDATING THE OBJECT SERVER DATA ITEM IN THE UI
IJ33397: GETBYXPATH EXAMPLE AMEND WITH BETTER EXAMPLES ON HOW TO HANDLE BULK OPERATIONS
IJ33464: FIX MYSQL DATASOURCE CODE FOR RECENT VERSIONS OF THE MYSQL-CONNECTOR-JAVA DRIVER
IJ33728: GETVAR METHOD DOCUMENTATION UPDATE
IJ33744: ADD CLARIFICATION REGARDING FILTERS FOR LDAP AUTHENTICATION
IJ33849: TRIGGER IMPACT POLICY USING REST API
IJ33929: OBJECTSERVER DATASOURCE WAIT TIME FOR CONNECTION FROM POOL
IJ33969: GETHTTP FUNCTION NOT LOADING KEY STORE
IJ34149: UPDATE SUPPORTED TLS PROTOCOLS
IJ34203: TOOL REQUIRED TO RE-BUILD DERBY INDEXES IN IMPACTDB FOR NOI
IJ34215: IMPROVE THE DOCUMENTATION AND TRACING OF THE EVENT FILTER WORKFLOW
IJ34615: FULL 7.1.0.19 WITH NOI EXT. INSTALLATION IS MISSING 'IS_FROM_OLD_CONFIG_RUN' COLUMN IN DERBY TABLE
IJ34923: GETHTTP CONVERTS POST TO GET AFTER REDIRECT
 

2.0 Additional Support added in Fix Pack 23
JazzSM 1.1.3.0 DASH 3.1.3.12
IBM Installation Manager 1.9.1.6
2.1 Browser Support with Fix Pack 23
Browser: Firefox 89, Google Chrome 91, Microsoft Edge 91, Safari 14
Operating Systems: RHEL 8.4, zLinux RHEL 7.8, SLES 12.5, 15.2

2.2 Component Updates
Java(TM) SE Runtime Environment "1.8.0_301" (8.0.6.35 (SR6 FP35))
WebSphere Application Server Liberty has been updated to version 21.0.0.8
Apache Ant(TM) version 1.9.16
Please note the following Components being deprecated or disabled:
Deprecated support:
https://www.ibm.com/support/pages/node/6347586
1. IBM Connections integration support
2. Jabber support for 3rd party extensions
Disabled components:
- Starting in FP20, the "Event Isolation and Correlation" is disabled by default. Refer to the following page for more information:
https://www.ibm.com/support/pages/node/6357077

2.3 Enhancements in Fix Pack 23
Fix Pack 23 includes the following enhancements:

- RFE: Add support for multiple ObjectServers in Runbook Automation (Netcool Impact)
https://automation-management.ideas.aha.io/ideas/IRISCART-I-182
Customer is extending their Netcool landscape to integrate several sites into one centralized stack. Doing so, multiple ObjectServer (one pair per site) are connected to this centralized approach, resulting in a need for Impact to support this scenario when running the Runbook Automation enrichment. Currently, Impact only connects to one EventReader, hence only a single pair of ObjectServers.

- RFE email reader support for OAUTH
https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=102118
Use case:  Email reader will be compatible with cloud-based email services such as Microsoft Office 365, Google. This provides an extra level of security for the email client.

- RFE: Netcool Impact 7.1 - OAuth integration [Google]
https://automation-management.ideas.ibm.com/ideas/IRISCART-I-372
https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=148178
Use Case:  Single Sign-On or Authentication system that uses Google OAuth. This helps operations use various product features like MWM.

- RFE: OAuth: REST DSA: Support for OAuth Authentication
Use Case: Ability to create Impact RESTful DSA connection with Token authentication

- RFE: IRISCART-779: NOI CNEA and Impact combined system to leverage both capability sets in one system
https://bigblue.aha.io/features/IRISCART-779
In a Hybrid setup, on-prem Event Analytics groupings can be displayed on the OCP CNEA UI as Scope-based groups.

3.0 Troubleshooting Netcool Impact 7.1 
General issues 
- You now can (if needed) reset the Derby DB to a default state (in a NOI installation); by using the following steps:
1.Find appropriately named ImpactDB_NOI_FP23.zip file located in $IMPACT_HOME/install/dbcore.
2.Stop all ImpactServers in the cluster (primary and secondary that run Derby DB).
3.Backup/Remove the existing ImpactDB directory structure in $IMPACT_HOME/db/<ServerName>/derby.
4.Copy the zip file found in step 1 to $IMPACT_HOME/db/<ServerName>/derby and unzip it.
5.Start Impact Server primary, let it fully initialize and start, and now start the secondary server and let it re-sync from the primary.

- Enabling LDAP Authentication
When editing the $IMPACT_HOME/install/security/impactdap.properties before
enabling LDAP Authentication, ensure the version of the impactdap.properties
is from the latest install! 
* Do not copy a props file from a different/older fix pack. 
* Ensure to only edit the properties, do not delete/remove any of the properties before running the
$IMPACT_HOME/install/security/confAuth4LDAP.sh script

4.0 Known Issues in Fix Pack 23

- The following applies only to Netcool/Impact Clients with Netcool Operations
Insight (NOI) - and only for those with Existing configurations:
After upgrading to Netcool/Impact 7.1.0 FP13 (and above), run through the
Wizard; confirm, verify & save the configuration. Refer to: Event Analytics Configuration 
1. It is a known issue that custom roll-up changes to properties and params files are overwritten. Running through the wizard will repair these.
2. Also for seasonality View, it is advisable to run through the Wizard to make sure the right columns are displayed.  
Refer to the following link, for appropriate actions related to"Migration of rollups in Netcool/Impact":
https://www.ibm.com/docs/noi/1.4.1?topic=analytics-migration-rollups-in-netcoolimpact-v71013

- The EventReader service for Seasonality Events is called "ProcessSeasonalityEvents" and it does not (by default) read updated or
de-duplicated events. "Get updated events" is not selected (by default) in the UI for the "ProcessSeasonityEvents" Service, on the Event Mapping tab. 
The reason for this is due to the wide Filter for the "ProcessSeasonityEvents" Event Reader service. By default, the filter is set to "1=1". With this wide filter, 
if "Get updated events" was enabled, and Seasonality rules fired, this could lead to an infinite loop. i.e.
Seasonality Rules updating events which in turn get read by the reader and fire the Seasonality Rules again. 
The solution is for the Event Mapping Filter to be set, in such a way, as to avoid already processed events. i.e. if the Seasonality rules are setting the
Service field to "something" then the Event Mapping Filter could be set to restrict these.

- NOI 1.6: The Event Analytics Configuration wizard reports an Unexpected Token error when the Impact GUI server under the Turkish locale 
Symptom: When loading the Event Analytics configuration page, an "Unexpected token: E" error is reported. Configuration cannot continue.
Root Cause: When the Impact GUI server is running under the Turkish locale, the GUI server is unable to find the contents of the uiproviderconfig directory.
Resolution: Switch to a different locale and restart the Impact GUI server

- Customization made to web.xml is overwritten Symptom: Any customization made to the web.xml file of a .war file (such as opview.war and netcool.war)  
may be overwritten during the upgrade process.
Resolution: Please check the web.xml file after completing the upgrade and reapply the customization. You can find the old customization in the following directory. 
Merge the customization, as appropriate:
<backup>/install/gui_backup/<prior-fp name>/wlp/usr/servers/ImpactUI/apps/ImpactUI.ear

- For Impact systems since 7.1 FP20 where the Runbook Automation add-on is installed:
In the "RBA_EventReader" service, on the "Event Mapping", under the "Event Matching" tab, the "Stop testing after first match" option needs
to be always selected. The "Test events with all filters" option should not be used (except for limited testing)! The "Test events with all filters"
option will be removed in a future Fix Pack.

- On Test environments, where more than one instance of Impact is installed (under the same user ID), Installation Manager may suppress the pop-up 
message "insufficient space for back-up directory" when performing the preliminary system checks (at Fix Pack update).
Resolution: A minimum of 900MB of space is required for updates. If it is really to have more than one instance of Impact on the
environment, each instance should be installed under different user IDs and under different directories. 

- The Prerequisite Scanner reports a failure when it checks the OS Version for SUSE Linux Enterprise Server 15 or later. 
This failure can be ignored as SUSE Linux Enterprise Server 15 is supported by Netcool/Impact.

- In the embedded help documentation, the product version is erroneously listed as 7.1.0.19 for non-English versions in the table of contents and
 front page. The embedded documentation for all supported languages is up to date for 7.1.0.23.

- Default type values disappear from the NOI.DEFAULTVALUES table. 
Symptoms: 
1. An error in PG_PROCESSTYPES policy logs, for example: com.micromuse.response.common.PolicyProcessingException:
ReferenceError: "TYPE_DEFAULT_EVENTID" is not defined. (NOI_UTILS#1594) in PG_PROCESSTYPES2. An export of the configuration using 
NOI_DefaultValues_Configure will show undefined values for the following 5 fields:
type.resourcelist=undefined
type.default.eventid=undefined
type.default.eventtype=undefined
type.servername.column=undefined
type.serverserial.column=undefined
3. No IBMExtractedType field are set for incoming events, which means events won't match deployed patterns.
Resolution:
1. To fix the issue, export the NOI configuration using nci_trigger to call the NOI_DefaultValues_Export policy.
2. Manually edit the produced file to set the 5 fields above. By default, these fields are set to 
type.resourcelist=NODE
type.default.eventid=IDENTIFIER
type.default.eventtype=ALERTGROUP
type.servername.column=SERVERNAME
type.serverserial.column=SERVERSERIAL
3. Update the NOI.DEFAULTVALUES table by using nci_trigger to call the NOI_DefaultValues_Configure policy.
Document reference: https://www.ibm.com/docs/noi/1.6.3?topic=wizard-exporting-event-analytics-configuration