IBM OS Agents Version 6.3.0 FixPack 5 Scripting Feature - United States  FIX README

ABSTRACT
 This feature allows users to define scripts to run at Tivoli Monitoring OS agents sites at a defined frequency.

CONTENT
(C) Copyright International Business Machines Corporation 2015. All rights reserved.
Component: IBM(R) Tivoli(R) Monitoring OS Agents, Version 6.3.0 FixPack 5

Date: 30 June 2015

Contents:

1.0 Introduction
1.1 Quick Start
2.0 New Attribute groups
3.0 Parameters in OS agent environment files
4.0 Parameters in property file
5.0 Examples of property file
6.0 Examples of private situations
7.0 Custom Scripts and Custom Scripts Runtime workspaces
8.0 Known problems and limitations
9.0 Troubleshooting
10.0 Quick Start Scenario

1. Introduction
===============

This feature allows users to define scripts to run at Tivoli Monitoring OS agents sites at a defined frequency.

The feature is enabled by default. The administrator can enable/disable it by setting a new environment variable
KXX_FCP_SCRIPT=true/false (default true)in the agent configuration file, where XX can be:

- LZ for Linux OS agent
- UX for Unix OS agent
- NT for Windows OS agent

This is an overview of the scripting feature; details will be provided in the following sections.

The OS agent loops, at a configurable interval, looking for script definition property files (*.properties) in a configurable directory path.
The property files are parsed and OS Monitoring Agent spawns a new process named “fcp_daemon” if at least one valid script definition is found. This new daemon is responsible for scheduling the script executions and gathering all information regarding running scripts.

According to another configurable interval, the OS agent loops getting the execution script results from the fcp_daemon.
The OS Agent is able to parse the script standard output, splitting each row in up to 16 attributes.
An event is sent for each standard output row of the script and these events can be caught by pure event situations.

1.1 Quick Start
================
The feature is enabled with default values as soon as the OS agent is started. The only action to start using the feature is the following:
- create a property file under default directory (on Linux/UNIX is $CANDLEHOME/localconfig/<product code>/scripts_definitions, on Windows is %CANDLE_HOME%\localconfig\nt\scripts_definitions) using as an example the provided template script_property.txt.

Only two properties are required:
ATTRIBUTE_NAME=Any name used to uniquely identify the script definition inside the property file.
SCRIPT_PATH_WITH_PARMS=The fully qualified path of the script with arguments.

Not only shell scripts but also perl and other types of scripts can be used. You just need to specify the full command to execute in the SCRIPT_PATH_WITH_PARMS property.
For example, "perl C:\IBM\scripts\ITM_Custom_Scripts\date.pl". In this example you need to make sure that the location of "perl" can be resolved by the agent through the PATH variable in its environment. Specify the full path where "perl" is installed otherwise.

Further properties and details can be found in this document and in the template script_property.txt under $CANDLEHOME/localconfig/lz/scripts_definitions.

2. New Attribute groups
=======================

Two new attribute groups have been added for this feature as detailed below. Statistic and execution data of all the scripts are stored in these two tables. The name of the property file (Property_File) and the attribute name defined in the property file (Attribute_Name) are the 2 key fields of these two tables. These two keys must be used in situation conditions to filter rows related to a specific script.

Attribute group: KXX_Custom_Scripts (multiple rows), table: KXXSCRPTS (sampled).
Description: Configuration and statistic data gathered using custom scripts. It contains a row for each defined script, information on the fcp_daemon and on property files:

Attribute Size Description
=========================== ===== =========================
System_Name 32 This is the managed system name of the agent.
Timestamp 16 This is the local time when the data was collected.
Property_File 256 The name of the property file.
Attribute_Name 96 The attribute name that is defined in the properties file. The attribute is used for metric identification.
Script_Name 512 The name of the script.
Script_Path 512 The fully qualified path name of the script with arguments.
Custom_Name 96 The custom name that is defined in the properties file. It is used for custom reporting.
Standard_Output_Type 4 Standard output type of the script.
Status_Code 4 The status of the script. It includes general errors, configuration errors, the status or the execution code returned by the
Script Provider.
Execution_Start 16 The time when the last execution of this script started.
Execution_Duration 4 The duration of the last execution of this script, in seconds. When timing out, the value of the configured timeout is returnd.
Average_Execution_Duration 4 The average duration, in seconds, of all the execution of the script.
Refresh_Interval 4 The interval, in seconds, that the agent attempts to start this script.
Number_of_Collections 4 The count of execution attempts of this script since agent started.
Intervals_Skipped 4 The count of occurrences where an execution of this script is skipped because the previous execution is still running.
Property_Group 64 The name of the property group.
Return_Code 4 Integer value returned by the Script.
Cust_Label_Str1 16 Label for custom string attribute #1
Cust_Label_Str2 16 Label for custom string attribute #2
Cust_Label_Str3 16 Label for custom string attribute #3
Cust_Label_Str4 16 Label for custom string attribute #4
Cust_Label_Str5 16 Label for custom string attribute #5
Cust_Label_Int1 16 Label for custom integer attribute #1
Cust_Label_Int2 16 Label for custom integer attribute #2
Cust_Label_Int3 16 Label for custom integer attribute #3
Cust_Label_Int4 16 Label for custom integer attribute #4
Cust_Label_Int5 16 Label for custom integer attribute #5
Cust_Label_Float1 16 Label for custom floating point attribute #1
Cust_Label_Float2 16 Label for custom floating point attribute #2
Cust_Label_Float3 16 Label for custom floating point attribute #3
Cust_Label_Float4 16 Label for custom floating point attribute #4
Cust_Label_Float5 16 Label for custom floating point attribute #5
Standard_Error 2048 Script Standard Error in a unique row

In addition to script definitions, the table may report rows to return errors found on property files and they are identified by @ANY@ as Attribute_Name. Moreover, a row is always used to report the status of fcp_daemon and it is identified by @ANY@ as Property_File and @ANY@ as Attribute_Name.

Attribute group: KXX_Custom_Scripts_Runtime (multiple rows), table: KXXSCRRTM (pure).
Description: Data gathered using custom scripts. It contains the output rows of the scripts currently running:

Attribute Size Description
======================= ==== =========================
System_Name 32 This is the managed system name of the agent.
Timestamp 16 This is the local time when the data was collected.
Property_File 256 The name of the property file.
Attribute_Name 96 The attribute name that is defined in the properties file. The attribute is used for metric identification.
Script_Path 512 The fully qualified path of the script.
Custom_Name 96 The custom name that is defined in the properties file. It is used for custom reporting.
Return_Code 4 Integer value returned by the Script.
Row_Number 4 Output row number.
Standard_Output_Type 4 Standard output type of the script.
Standard_Output_String 2048 Script Standard Output in String Format.
Standard_Output_Integer 8 Script Output in Integer Format
Standard_Output_Float 8 Script Output in Floating Point Format (2 decimals).
Cust_Attr_Str1 64 Custom string attribute #1
Cust_Attr_Str2 64 Custom string attribute #2
Cust_Attr_Str3 64 Custom string attribute #3
Cust_Attr_Str4 64 Custom string attribute #4
Cust_Attr_Str5 64 Custom string attribute #5
Cust_Attr_Int1 8 Custom integer attribute #1
Cust_Attr_Int2 8 Custom integer attribute #2
Cust_Attr_Int3 8 Custom integer attribute #3
Cust_Attr_Int4 8 Custom integer attribute #4
Cust_Attr_Int5 8 Custom integer attribute #5
Cust_Attr_Float1 8 Custom floating point (2 decimals) attribute #1
Cust_Attr_Float2 8 Custom floating point (2 decimals) attribute #2
Cust_Attr_Float3 8 Custom floating point (2 decimals) attribute #3
Cust_Attr_Float4 8 Custom floating point (2 decimals) attribute #4
Cust_Attr_Float5 8 Custom floating point (2 decimals) attribute #5

Note: different status conditions can be monitored using the Status_Code field in the statistic table KXX_Custom_Scripts.
The following detailed list provides different values for the Status_Code field:

Initial general statuses
UNKNOWN_ERROR (status code=0) --> Error
NO_ERROR (status code=1) --> Informational

General daemon statuses
FEATURE_NOT_ENABLED (status code=40) --> Informational
DAEMON_STARTING (status code=2) --> Informational
DAEMON_STARTED (status code=3) --> Informational
DAEMON_STOPPING (status code=4) --> Informational
DAEMON_STOPPED (status code=5) --> Informational
DAEMON_STOPPING_AT_AGENT_STOP (status code=6) --> Informational
DAEMON_STOPPED_AT_AGENT_STOP (status code=7) --> Informational
DAEMON_ERROR (status code=8) --> Error
DAEMON_ERROR_NO_RESTART (status code=9)-> Fatal Error

General directory statuses
ERROR_OPENING_PROP_DIRECTORY (status code=10) --> Error
PROP_DIRECTORY_NOT_FOUND (status code=11) --> Error
NO_SCRIPT_DEFINED (status code=12)--> Warning

Property file statuses
PROP_FILE_NOT_FOUND (status code=13) --> Error
ERROR_OPENING_PROP_FILE (status code=14) --> Error

Script definition statuses
SCRIPT_ADDED (status code=15) --> Informational
SCRIPT_CHANGED (status code=16) --> Informational
SCRIPT_REMOVED (status code=17) --> Informational
SCRIPT_INACTIVE (status code=18) --> Informational
NO_SCRIPT_PATH (status code=21)--> Error
SCRIPT_PATH_INVALID (status code=22)--> Error

Execution statuses from the fcp_daemon
FACTORY_UNKNOWN_ERROR (status code=23) --> Error
FACTORY_NO_ERROR (status code=24)--> Informational
GENERAL_ERROR (status code=25)--> Error
OBJECT_NOT_FOUND (status code=26)--> Error
OBJECT_CURRENTLY_UNAVAILABLE (status code=27)--> Error
NO_INSTANCES_RETURNED (status code=28)--> Error
NO_RESPONSE_RECEIVED (status code=29)--> Error
AUTHENTICATION_FAILED (status code=30)--> Error
ACCESS_DENIED (status code=31)--> Error
TIMEOUT (status code=32)--> Error
NOT_IMPLEMENTED (status code=33)--> Error
RESPONSE_TOO_BIG (status code=34) --> Error
GENERAL_RESPONSE_ERROR (status code=35)--> Error
SCRIPT_NONZERO_RETURN (status code=36)--> Error
SCRIPT_NOT_FOUND (status code=37)--> Error
SCRIPT_LAUNCH_ERROR (status code=38)--> Error
INVALID_TOKEN_TYPES(status code=39) --> Error

3. Parameters in OS agent environment files
===========================================

It is possible to customize the feature setting parameters in the OS agent environment files:
- $CANDLEHOME/config/lz.ini file for the Linux OS agent
- $CANDLEHOME/config/ux.ini for the UNIX OS agent
- %CANDLE_HOME%\TMAITM6_x64\KNTENV for Windows 64bit OS agent
- %CANDLE_HOME%\TMAITM6\KNTENV for Windows 32bit OS agent

The scripting feature is enabled by default. To disable it set:
- KXX_FCP_SCRIPT=false

Other parameters can be defined inside the agent environment files based on specific needs:

- KXX_FCP_SCRIPT_DEFINITIONS (default location on Linux/UNIX is $CANDLEHOME/localconfig/<product code>/scripts_definitions, on Windows it is %CANDLE_HOME%\localconfig\nt\scripts_definitions)
The location where property files are stored.

- KXX_FCP_SCRIPT_INTERVAL (default 60 sec)
OS agent uses the value of this variable as loop interval in seconds to check execution of running scripts and it sends events if the filter condition is satisfied. The minimum value is 30 seconds, the maximum value is 300 seconds. Invalid values will be reset to the default.
Note: this parameter is ignored if KXX_FCP_SCRIPT_SYNC_INTERVALS is set to USE_SCRIPT (see definition below).

- KXX_FCP_SCRIPT_SYNC_INTERVALS (USE_AGENT|USE_SCRIPT|NO - default USE_AGENT)
If the agent looping interval defined by KXX_FCP_SCRIPT_INTERVAL is bigger than the script execution frequency, it can happen that data produced by some of the script execution loops is lost.
To avoid this behaviour the script execution frequency can be synchronized with the agent looping interval setting the KXX_FCP_SCRIPT_SYNC_INTERVALS to:
- USE_AGENT; the value of each script execution frequency is forced to be the maximum between KXX_FCP_SCRIPT_INTERVAL and EXECUTION_FREQUENCY defined in its property file.
- USE_SCRIPT; the agent looping interval is dynamically set to the minimum frequency value (EXECUTION_FREQUENCY in property file) between all of the defined scripts . The value set by KXX_FCP_SCRIPT_INTERVAL is ignored. The frequency of the scripts remain the ones defined in the property files. When using USE_SCRIPT, the agent looping interval may change every time a script definition is added, changed or removed. In any case, it cannot be lower than the value set by KXX_FCP_OVERRIDE_MIN_FREQUENCY_LIMIT or bigger than 300 seconds.
- NO; no synchronization is performed and some execution results could be lost.

- KXX_FCP_SCRIPT_DEFINITIONS_CHECK_INTERVAL (default 300 sec)
At startup and at every interval defined by this variable, the OS agent checks for any changes in scripts or property files.
Note that if KXX_FCP_SCRIPT_DEFINITIONS_CHECK_INTERVAL is less than the agent looping interval it will be reset to the agent looping interval. The maximum allowed value is the default, 300 seconds.

- KXX_FCP_USER (default OS agent user)
This parameter is valid only on linux and unix platforms. It defines the user used to spawn fcp_deamon process if different from OS agent process user; all the scripts are executed by this user. Note that the user owner of the OS agent must have correct permission to spawn the fcp_daemon process. On windows a different user must be defined as login of the service "Monitoring Agent for Windows OS - FCProvider". The user must have "Full Control" permission to CANDLE_HOME and scripts repository directories. For more information please refer to official IBM Monitoring documentation:
http://www-01.ibm.com/support/knowledgecenter/SSTFXA_6.3.0.2/com.ibm.itm.doc_6.3fp2/oswin/running_as_a_non-admin_user.htm [http://www-01.ibm.com/support/knowledgecenter/SSTFXA_6.3.0.2/com.ibm.itm.doc_6.3fp2/oswin/running_as_a_non-admin_user.htm]

- KXX_FCP_MAX_CDP_DP_THREAD_POOL_SIZE (default 10)
It defines the maximum concurrent number of scripts to be executed. Maximum value is 32.

- KXX_FCP_MAX_DAEMON_RESTARTS (default 4)
The OS agent watches the fcp_daemon: if an abnormal exit of process occurs, the OS agent restarts it. This is done for the KXX_FCP_MAX_DAEMON_RESTARTS (times at a day).
The value 0 must be used to avoid the restart; if -1 is set, the OS agent retries to restart fcp_daemon forever. The restart counter is reset at OS agent restart.

- KXX_FCP_SEND_SCRIPT_RUNTIME_EVENTS (default: true)
If set to false, the OS agent stops sending events for each row of script standard output. In this case script outputs are visible on TEP console workspaces but no situations will be displayed and no historical collection data will be collected.

- KXX_FCP_OVERRIDE_MIN_FREQUENCY_LIMIT (default: 5 seconds)
It is used when KXX_FCP_SCRIPT_SYNC_INTERVALS is set to USE_SCRIPT. In this condition, it sets the minimum value of the OS agent looping interval.
Using low values for the the OS agent looping interval (less than 5 seconds) is highly invasive and can impact OS agent performances. If a frequent data collection is needed (e.g. every second), it is strongly suggested to customize a script that caches data at the needed frequency and returns the collected data to the OS agent at an higher interval (e.g. every 60 seconds).

The following Agent Builder (CDP) variables can also be used to control the behavior of the fcp_daemon:

- CDP_DP_REFRESH_INTERVAL (default 60 sec) Global script scheduled start time. Used if the frequency is not passed in the script property file.

- CDP_DP_SCRIPT_TIMEOUT (default 30 sec) Global script execution maximum time. When the execution time of a script exceeds this limit, its Status_Code is set to TIMEOUT

- CDP_DP_KILL_ORPHAN_SCRIPTS (Y|N - default N) Global behaviour used by fcp_daemon process for timing out scripts. When set to 'Y', the scripts are killed, otherwise they are abandoned. This value is ignored for a specific script if the KILL_AFTER_TIMEOUT key is set in the script property file

- CDP_MAXIMUM_ROW_COUNT_FOR_CPCI_DATA_RESPONSES (default 1000) Global value added for performance reasons to limit the maximum number of output rows returned by the scripts. Additional rows after this limit are ignored. Allowed values are positive integer. Invalid values means no limit.

The fcp_daemon also supports the other environment variables used to control Agent Builder agents. For a complete list see the official Agent Builder documentation here:
http://publib.boulder.ibm.com/infocenter/tivihelp/v61r1/topic/com.ibm.itm.doc_6.3/agentbuilder63_user.pdf [http://publib.boulder.ibm.com/infocenter/tivihelp/v61r1/topic/com.ibm.itm.doc_6.3/agentbuilder63_user.pdf]

4. Parameters in property files
===============================

The KXX_FCP_SCRIPT_DEFINITIONS directory contains a list of *.properties files. Each property file contains a list of
scripts to run with respective properties in the form of key=value. The properties that can be defined (case in-sensitive) are:

- ATTRIBUTE_NAME (Required - string max 256 characters).
It is a name of your choice that defines a specific script and its attributes. The characters that can be used for the
ATTRIBUTE NAME name can be alphabetical, numeric and only the underscore can be used as a special character. If other special characters (even a blank is considered this way) are used they get converted into underscore (_).
When multiple scripts are listed inside the same property file, more different ATTRIBUTE_NAME must be defined (one for each script). It must be the first value specified for each defined script and delimits the start of the properties set for the specific script until the next ATTRIBUTE_NAME.

- SCRIPT_PATH_WITH_PARMS (Required - string max 512 characters).
It defines the full path to the script with parameters, separated by a blank. No special characters can be used in the script path name.
Values containing blanks must be enclosed in single (') or double quotes (").
Environment variables can be passed, but only enclosed in ${...} for all the platforms. Environment variables must be available in the OS agent process context.

- EXECUTION_FREQUENCY (Optional - default 60 sec).
It indicates the script execution frequency.

- CUSTOM_NAME (Optional - string max 256 characters)
The user can fill it with a description of the script.

- IS_ACTIVE (true|false - Optional - default true).
It activates the script. If false, the script is not executed.

- DISABLE_USE_AGENT_SYNC (true|false - Optional - default false). If true, the EXECUTION_FREQUENCY of the script is respected also if the global variable KXX_FCP_SCRIPT_SYNC_INTERVALS is set to USE_AGENT.

- KILL_AFTER_TIMEOUT (true|false - Optional - default value defined by the CDP_DP_KILL_ORPHAN_SCRIPTS variable).
When true the script is killed after timeout (a timeout occurs when script execution is greater than the value specified by CDP_DP_SCRIPT_TIMEOUT parameter in OS agent configuration file) otherwise it is ignored. In both cases no data is collected. Note that when KILL_AFTER_TIMEOUT is set, only the script defined in property file is killed and not child processes (if any) spawned by the script. This feature is not supported by Solaris and Windows 32 bit OS agents and any timing out scripts are abandoned.

Output rows returned by a script are parsed. The script returns a standard output (called hereafter as first token). When the script returns more values in the output row they are added as additional tokens for a maximum of 5 strings, 5 integers and 5 floats following a predefined syntax as described below:

- OUTPUT_TYPE (STRING|INTEGER|FLOAT - Optional - default string). It defines the type of the first token returned by each row of the script;
OUTPUT_TYPE can be:
1. STRING (default): strings up to 2048 characters. When used, the "Standard_Output_String" attribute of KXX_Custom_Scripts_Runtime is filled in by the first token.
2. INTEGER: allows getting numeric values between -9223372036854775806 and 9223372036854775806. When used, the "Standard_Output_Integer" attribute of KXX_Custom_Scripts_Runtime is filled in by the first token.
3. FLOAT: allows getting numeric values between -92233720368547758.06 and 92233720368547758.06,(with 2 decimal
precision). When used, the "Standard_Output_Float" attribute of KXX_Custom_Scripts_Runtime is filled in by the first token.

- TOKEN_TYPES (STRING|INTEGER|FLOAT - Optional).
It defines the output type of additional tokens after the first one. The user can define a maximum of 5 strings, 5 integers and 5 floats. It is a list of types separated by commas:
<token_type>,<token_type>,…
token_type can be empty or one from (case insensitive):
- STRING or S
- INTEGER or I
- FLOAT or F
If <token_type> is empty, the corresponding token is skipped.
Examples of the same valid layouts:
- TOKEN_TYPES=S,I,S,,,F,,F,F
- TOKEN_TYPES=String,integer,S,,,Float,,f,FLOAT

- TOKEN_LABELS (STRING - maximum 16 characters each label - Optional).
It defines the labels of the tokens defined in TOKEN_TYPES. This value is a list of token labels separated
by commas, and must correspond to the tokens defined by TOKEN_TYPES.
e.g.:
- TOKEN_TYPES=S,I,S,,,F,,F,F
- TOKEN_LABELS=Cpu Name,Cpu number,Description,,,value 1,,value 2,value 3
It is ignored if TOKEN_TYPES is not set.

- TOKEN_SEPARATOR (Optional - default semicolon ";").
It sets the string to be used as separator to split the output row in tokens. It is ignored if TOKEN_TYPES is not set. Empty value (blank) is accepted as separator and multiple consecutive blanks in output rows are considered as a single one.

The following two parameters allow you to filter the rows output of a script; they are applied by the OS agent only to the first token and they must be used together:

- FILTER_VALUE (Optional).
The value used for comparison. It is required if FILTER_OPERATOR is defined.
If the OUTPUT_TYPE is a string, the filter value must reflect exactly the string value returned by the script that is intended to be filtered, without any additional quotes (no wildcards allowed).
- FILTER_OPERATOR (Optional).
The operator used for the comparison. It is required if FILTER_VALUE is defined. Accepted FILTER_OPERATOR values include:
= (equal to)
!= (different from)
> (bigger than) only for numeric type
>= (not lower than) only for numeric type
< (lower than) only for numeric type
<= (not bigger than) only for numeric type

5. Examples of property file
============================

#First script definition: script ex_script1.sh is launched every 150 seconds, it returns float values and only the output rows equal to 0.5 will be considered by the agent.

ATTRIBUTE_NAME=sample1
SCRIPT_PATH_WITH_PARMS=/opt/ibm/itmd4255a/localconfig/lz/scripts_definitions/ex_script1.sh
EXECUTION_FREQUENCY=150
OUTPUT_TYPE=FLOAT
FILTER_VALUE=0.5
FILTER_OPERATOR==

#Second script definition: script ex_script2 is launched every 60 seconds, it returns integer values and only the rows different from 0 will be considered by the agent.

ATTRIBUTE_NAME=ex_script2
SCRIPT_PATH_WITH_PARMS=${CANDLE_HOME}/tmp/check_out.sh
EXECUTION_FREQUENCY=60
OUTPUT_TYPE=INTEGER
FILTER_VALUE=0
FILTER_OPERATOR=!=

#Third script definition: script ex_script3.sh is launched every 120 seconds with 3 input parameters (the first input parameter is an integer, the second and third are string). It's killed if it hangs or if the execution time is greater than the timeout value.

ATTRIBUTE_NAME=ex_script3
SCRIPT_PATH_WITH_PARMS=/opt/scripts/ex_script3.sh 1 "second input parameter" "third input parameter"
EXECUTION_FREQUENCY=120
OUTPUT_TYPE=STRING
KILL_AFTER_TIMEOUT=TRUE

#Fourth script definition: script cpu_mem_percentage.sh is launched every 50 seconds and returns the cpuid as standard output string and 2 float for Idle and Used CPU percentage and 2 integers for Memory and Virtual Memory usage. The pipe is used as separator to parse the output. An example of row that must be returned by the script is:
cpu2|35,5|65,5|3443|123800

ATTRIBUTE_NAME=cpu and mem Usage
SCRIPT_PATH_WITH_PARMS=${SCRIPT_HOME}/cpu_mem_percentage.sh
OUTPUT_TYPE=STRING
TOKEN_TYPES=F,F,I,I
TOKEN_LABELS= Idle CPU %, Used CPU %, Virt MEM used MB, MEM used MB
TOKEN_SEPARATOR=|
EXECUTION_FREQUENCY=50

6. Examples of private situations
==================================

The private situations definitions can be inserted into the xx_situations.xml under $CANDLEHOME/localconfig/lz for linux or $CANDLEHOME/localconfig/ux for unix or %CANDLE_HOME%\localconfig\nt for Windows to monitor scripts execution.
Examples below are for the Linux OS agent:

<PRIVATESIT>
<!-- Sends an alert if the script defined by attribute name "demo" in property file "demo.properties" returns a row equal to "demo.log" -->
<SITUATION>FCP_CheckLOGFileExists_pr</SITUATION>
<criteria>
<![CDATA[*VALUE KLZ_Custom_Scripts_Runtime.Property_File *EQ 'demo.properties' *AND *VALUE KLZ_Custom_Scripts_Runtime.Attribute_Name *EQ 'demo' *AND *VALUE KLZ_Custom_Scripts_Runtime.Standard_Output_String *EQ 'demo.log']]>
</CRITERIA>
</PRIVATESIT>

<PRIVATESIT>
<!-- Sends an alert if a script exits with a return code different from zero -->
<SITUATION>FCP_ScriptRetCode_pr</SITUATION>
<CRITERIA>
<![CDATA[*IF *VALUE KLZ_Custom_Scripts.Return_Code *NE 0]]>
</CRITERIA>
</PRIVATESIT>

<privatesit>
<!-- Sends an alert when script path is not defined in a property file -->
<SITUATION NAME="FCP_NOPTAH" INTERVAL="000030" ></SITUATION>
<criteria>
<![CDATA[*VALUE KLZ_Custom_Scripts.Status_Code *EQ NO_SCRIPT_PATH]]>
</criteria>
</privatesit>

<privatesit>
<!-- Sends an alert when a script cannot be launched -->
<SITUATION NAME="FCP_ScriptLaunchErr" INTERVAL="000060" ></SITUATION>
<criteria>
<![CDATA[*VALUE KLZ_Custom_Scripts.Status_Code *EQ SCRIPT_LAUNCH_ERROR]]>
</criteria>
</privatesit>

7. Custom Scripts and Custom Scripts Runtime Workspaces
=======================================================

A new OS agent navigation item has been added in the TEP console. It contains two workspaces: "Custom Scripts" and "Custom Scripts Runtime".

"Custom Scripts" workspace contains the following views:
- "Factory Daemon Status" table view showing informational/warning/error events related to the fcp_daemon process.
- "Properties Files error" table view showing problems related to property files.
- "Number of execution per script" bar chart view summarizing the executions of defined scripts
- "Defined Scripts" table view showing detailed information of defined scripts.

"Custom Scripts Runtime" workspace is called clicking on the anchor of a specific script and provides information on script execution. The views provided by default on the TEP console are to be intended as example workspaces with all available custom attributes. Users can duplicate and customize workspaces to filter out fields that are not needed according to the output returned by their scripts.

8. Known problems and limitations
===================================

- The Scripting Feature is not supported on Windows 2003 64-bit systems.
- Kill after timeout does not work on Solaris and Windows 32 bit OS agents.
- The fcp_daemon may stop executing scripts in Windows 32 bit If some scripts do not complete within the time out period and the user has turned on intensive tracing. If this happens the data reported on the TEP will reflect the last time the script was actually run. It is also possible that the OS agent will stop returning data. Terminating the fcp_daemon process will allow the agent to resume proper operation.
- SCRIPT_NONZERO_RETURN is returned instead of SCRIPT_NOT_FOUND or SCRIPT_LAUNCH_ERROR on Solaris.
- The scripting feature does not provide full Native Language Support; some issues may be found using Nationalized characters in property files or script outputs.
- On windows OS agent there is no possibility of executing scripts residing on a mapped network drive.

9. Troubleshooting
===================

Standard KBB_RAS1 variable will apply to the OS agent and to the fcp_daemon processes.
To apply a specific trace setting to fcp_daemon only, use the KXX_FCP_KBB_RAS1 variable; when KXX_FCP_KBB_RAS1 is set, the value specified by KBB_RAS1 is ignored by fcp_daemon.

To trace the operations logged by the OS agent core threads of the feature:
KBB_RAS1=ERROR (UNIT:factory ALL)

To trace scripting queries from the ITM server and events sent to the server, add the entries:
(UNIT:klz34 ALL) (UNIT:klz35 ALL) on Linux OS agent
(UNIT:kux48 ALL) (UNIT:kux49 ALL) on Unix OS agent
(UNIT:knt84 ALL) (UNIT:knt85 ALL) on Windows OS agent

To view tema traces to verify private situation execution, add the entries:
(UNIT:kraavp all) (UNIT:kraapv all)

To see the execution of the scripts and how the data from the scripts is being parsed set:
KXX_FCP_KBB_RAS1=Error (UNIT:command ALL)

To troubleshoot problems in the communication between the os agent and fcp_daemon add this trace level to both KBB_RAS1 and KXX_FCP_KBB_RAS1:
(UNIT:cps_socket FLOW) (UNIT:cpci FLOW)

To see the interaction between the OS agent process and the fcp_daemon in detail add to both KBB_RAS1 and KXX_FCP_KBB_RAS1:
(UNIT:cps_socket ALL) (UNIT:cpci ALL)

10. Quick Start Scenario
=========================

The following section describes the minimum steps needed to configure a linux OS agent to run 2 custom scripts.

Custom Scripts descriptions
===========================
Let's suppose the user has 2 scripts under a directory /scripts_repo:

- checkDIRsize.sh that checks the size of a specified directory passed as input parameter. Its output is an integer like the following:

4594740

- cpu_mem_usage.sh that checks the used CPU percentages and used Swap Memory megabytes. Its output is returned in the following form:

cpu1|96,5|23800

where the first token is the CPU id, the second token is the used CPU percentage, the third token is the used swap memory in megabyte.

Customization needed to have the linux OS agent run above scripts
==============================================================
The feature is enabled with default values as soon as the OS agent is started:

- you could create one or two property files (<Any Name>.properties)under the default directory $CANDLEHOME/localconfig/lz/scripts_definitions. In this example let's create 2 property files one for each script called checkDIRsize.properties and cpu_mem_usage.properties:

#CheckDIRsize.properties
ATTRIBUTE_NAME=OPT_DIR_SIZE
SCRIPT_PATH_WITH_PARMS=/scripts_repo/checkDIRsize.sh /opt
EXECUTION_FREQUENCY=20
OUTPUT_TYPE=INTEGER

#cpu_mem_usage.properties
ATTRIBUTE_NAME=cpu_mem_usage
SCRIPT_PATH_WITH_PARMS=/scripts_repo/cpu_mem_percentage.sh
OUTPUT_TYPE=string
TOKEN_TYPES=F,I
TOKEN_LABELS= Used CPU %, Swap MEM used MB
TOKEN_SEPARATOR=|
EXECUTION_FREQUENCY=10

- There is no need to restart the OS agent after adding (or changing) the 2 property files above: the OS agent checks script definition directory with a specified time interval (default value 300 seconds). Open the TEP console and under the "Custom Scripts" workspace the scripts details and results are shown.

Change History:
----------------------
2017-01-09: Added new item under "8. Known problems and limitations" that the Scripting Feature is not supported on Windows 2003 64-bit systems.

Question: Must the TOKEN_SEPARATOR value be enclosed in quotes for the custom scripting feature? Must the TOKEN_SEPARATOR value be enclosed in quotes for the custom scripting feature?

Answer:
TOKEN_SEPARATOR (Optional - default semicolon ";").
It sets the string to be used as separator to split the output row in tokens. It is ignored if TOKEN_TYPES is not set. Empty value (blank) is accepted as separator and multiple consecutive blanks in output rows are considered as a single one.


IBM HTTP Session time-out settings and overwrite precedence rules - United States WebSphere http session management time-out wasrun precedence overwrite TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 It is possible to set the HTTP Session time-out in various places on the IBM® WebSphere® Application Server Administrative Console. It is also possible to set HTTP Session time-out for the application packaging process.

Since Session time-out can be set in multiple places, it is necessary to understand how the ultimate Session time-out for an application is determined.

CAUSE
Application needs HTTP session time-out set.

RESOLVING THE PROBLEM
The HTTP Session time-out can be set in the following places:

 * From the Administrative Console at the server, Enterprise application, and Web application levels
 * At the time when the application is packaged
 * In the application code

Setting the HTTP Session time-out from the Administrative Console
1. To set the HTTP Session time-out at the server level, navigate to Servers > Application Servers > Your Server > Web Container > Session Management.

In the Session time-out section of this window, you can select No time-out or Set time-out by clicking the appropriate radio button. If you choose to set the time-out, type the desired value in minutes in the box.

2. To set the HTTP Session time-out at the Enterprise Application level, navigate to Applications > Enterprise Applications > Your Application > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the application session to overwrite those values set at the parent, which in this case is the Server level.

3. To set the HTTP Session time-out at the Web Application level, navigate to Applications > Enterprise Applications > Your Application > Web Module > Your Web App.war > Session Management.

Check Override in the Override Session Management section, then select to set the time-out and the time-out value. This sets the Application Session to overwrite those values set at the parent levels, which in this case is the Server or Enterprise Application level.

After modifying these settings, save the master configuration.

Setting HTTP Session time-out when application is packaged

The application developer can also select to set the HTTP Session time-out parameter when the application is packaged. This value is stored in the web.xml file for the Web application.

This setting overrides any session time-outs defined from the Administrative Console. Alter this setting by repackaging the application with a new value, or by modifying the web.xml file. The entry in the web.xml will be as follows:
          <session-config>
      *          <session-timeout>60</session-timeout>
 *
 *       </session-config>

Where the "session-timeout" is an integer value for the desired session time-out in minutes.
Setting HTTP Session time-out from the application code

Finally, the HTTP Session time-out can be set in the application code. The programmer can invoke the setMaxInactiveInterval() method on HttpSession object to set the time-out value as desired. This setting overrides any time-out defined in the application package or made from the Administrative Console.

HTTP Session time-out Override Precedence Summary

The list below shows the precedence from which the final HTTP Session time-out is derived.

1. Server Level [/support/docview.wss?uid=swg21163875&aid=1] Lowest level 2. Enterprise Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server Level if Override is selected 3. Web Application [/support/docview.wss?uid=swg21163875&aid=1] Overrides the Server and Enterprise Application settings if Override is selected 4. Application Level (web.xml) [/support/docview.wss?uid=swg21163875&aid=1] Overrides Server, Enterprise Application, and Web Application settings 5. Application Code [/support/docview.wss?uid=swg21163875&aid=1] Overrides all other settings RELATED INFORMATION
 A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21659740]

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question: How to increase the HTTP Session time-out value for Workplace application on WebSphere Application Server? We would like to increase the HTTP Session time-out value for our Workplace application. Where are all the locations that this value is set and what are their precedence?

Answer:
The HTTP Session time-out can be set in the following places:

    From the Administrative Console at the server, Enterprise application, and Web application levels
    At the time when the application is packaged
    In the application code


IBM EventReader stops reading events, StateChange value too high - United States netcool; impact; netcool/impact; nci; event; reader; eventreader; omnibus; omni; omnibuseventreader; state; change; statechange; date; time; datetime; value; future; high; stamp; timestamp; advanced; advance; forward; ahead; before; after; current; jrexec; jrexecaction; jrexecserver; jrexecaction()' server; action; function; command; line; interface; cli; commandlineinterface TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 How to deal with an EventReader that is using an inadvertently future dated StateChange value.

SYMPTOM
The EventReader stops acquiring events that are pertinent for processing because it is using a StateChange value that is too high.

CAUSE
An event has had its StateChange value artificially increased by some unknown component (Probe, Trigger, etc) to reflect a future date. The EventReader captures the event and then uses the highest captured StateChange value in its outgoing SQL to capture pertinent events.

DIAGNOSING THE PROBLEM
Pertinent events are not being processed. Looking in the EventReader log file the number of events being captured in each Read is 0. Testing the SQL being used in an nco_sql session produces a 0 result too. Testing the SQL again in an nco_sql session without the "and StateChange >= 1234567890" clause returns all the unprocessed rows.

RESOLVING THE PROBLEM
Something has "future dated" the StateChange value of an event in the ObjectServer, the EventReader captured the event and, since the EventReader will use the highest StateChange value captured in the previous poll in the SQL of its next poll, this then future dated the value used in the EventReader. The EventReader will persist with this value (and will increment it by 1 every other poll) until such a time as it captures an event with a higher StateChange value.

The simplest solution is to manually reset the EventReader StateChange value via the GUI. Stop the EventReader, open it for edit, click the "Clear State" button, exit the editor and restart the EventReader.

An alternate solution is to perform this operation via the Command Line Interface:

 * telnet [Hostname] [Port]

where [Hostname] is the resolvable hostname of the ImpactServer host and [Port] is the CLI port number (2000, by default). You will need to supply a suitable username (admin, for example) and password. Then at the READY prompt enter the series of commands:

 * Update Service set Running=false where Name='[EventReaderName]';
 *
 * Update Service set ClearState=true where Name='[EventReaderName]';
 *
 * Update Service set Running=true where Name='[EventReaderName]';

where [EventReaderName] is the name of the EventReader that requires this restart process.

In cases where the likelihood of StateChange being inappropriately incremented in this fashion is quite high, one might wish to automate this process and have a Policy hunt for such occurrences. Please find following an example of a "hunter" Policy to capture any reoccurrence of this issue:

 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 * ANN="AcquireStateChange";
   Log(2,ID+ANN);
   Script="/opt/IBM/netcool/impact/bin/CheckState.sh";
   Parameter="password";
   JRExecAction(Script, Parameter, false, 30);
   NumExecOutput=Length(ExecOutput);
   Log(3,ID+ANN+": NumExecOutput: "+NumExecOutput);

   If(NumExecOutput >= 1)
   {  *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    *
    * Log(ID+ANN+": CurrentStateChange: "+HumanStateChange+" is greater than CurrentTime: "+HumanCurrentTime);
      Log(ID+ANN+": !!! Clearing EventReader State !!!");
      Script="/opt/IBM/netcool/impact/bin/ClearState.sh";
      Parameter="password";
      JRExecAction(Script, Parameter, false, 30);
    *
    *
    *
    *
    *
    * Log(1,ID+ANN+": CurrentStateChange: "+HumanStateChange+" is less than CurrentTime: "+HumanCurrentTime);
    *
    *
    *
    *
    *
    * Log(ID+ANN+": !!! There is some freaky stuff happening here !!! - CurrentStateChange: "+HumanStateChange+" and CurrentTime: "+HumanCurrentTime+" !!! ");
    *

   }
   Else
   {  *

   }
 *
 *
 *
 *
 *
 * Log(3,ID+ANN+": No UnprocessedEvents");
 *
 *
 *
 *
 *
 *

As you can see this is designed to be run by a PolicyActivator and checks for events that have been around in the ObjectServer for a while (a minute) and are pertinent for processing by Impact (ImpactFlag = 1), but have not. If it finds any it then acquires the StateChange value from the .state file via JRExecServer using the example script referred to in the above example Policy as CheckState.sh:

 *
 *
 *
 *
 *
 *
 *

If the Policy finds the string it extracts the StateChange value and compares it against the current time and, if StateChange exceeds the current time, it undertakes the stop, clear and restart of the EventReader to bring StateChange back into line.

This examples a simple script to use the Command Line Interface to stop the EventReader, clear the StateChange value and restart the EventReader and is referred to in the above exampled Policy as ClearState.sh:

 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *

Please note that the ClearState.sh script should not contain any spaces or special characters otherwise calling EOF will throw errors. Also, in latter versions of Impact, the username and password should be those of the tipadmin. Additionally, rather than have the password sitting clear case in a script one can pass it as a JRExecAction Parameter from the Policy - still clear case but the relevance of the variable can be made less obvious.

Both of these scripts are called by the JRExecAction() function in the example Policy and this in turn requires the JRExecServer to be running on the ImpactServer host(s *).

* - The JRExecServer will be used by the current Primary ImpactServer only, as all EventReaders and PolicyActivators are run on the current Primary only but, if and when failover occurs and the Secondary ImpactServer becomes Primary, this new Primary will require access to a running, local JRExecServer. So, JRExecServer has to be running on both Primary and Secondary ImpactServer hosts to ensure availability in case of failover. Some additional information about the JRExecAction() function is available from the TechNote "JRExecAction() function usage" [Link Below]
RELATED INFORMATION
 JRExecAction() function usage [http://www-01.ibm.com/support/docview.wss?uid=swg21515756]

Question: Netcool/Impact 7.1.0: The StateChange value being used by the OMNIbusEventReader is too high  The value being used is a date and time in the future and as such is preventing the EventReader from capturing the current events.

Answer: The simplest solution is to manually reset the EventReader StateChange value via the GUI. Stop the EventReader, open it for edit, click the "Clear State" button, exit the editor and restart the EventReader.


IBM Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Configuration Manager  (CVE-2015-7450) - United States ITNCM; Security Bulletin; CVE-2015-7450; websphere SECURITY BULLETIN

SUMMARY
 IBM WebSphere Application Server is shipped as a component of IBM Tivoli Netcool Configuration Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin.

VULNERABILITY DETAILS
Please consult the security bulletin Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450) [http://www-01.ibm.com/support/docview.wss?uid=swg21970575] for vulnerability details and information about fixes.
CVEID: CVE-2015-7450 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7450]
DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107918 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107918] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

AFFECTED PRODUCTS AND VERSIONS

Principal Product and Version(s) Affected Supporting Product and Version ITNCM version 6.4.1.3
ITNCM version 6.3.0.6 Embedded IBM WebSphere Application Server eWAS 7.0 REMEDIATION/FIXES

<Product VRMF APAR Remediation/First Fix ITNCM 6.4.1.3 IF001 none http://www-933.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Tivoli+Netcool+Configuration+Manager&release=6.4.1.3&platform=All&function=fixId&fixids=ITNCM_6.4.1.3_IF001&includeRequisites=1&includeSupersedes=0&downloadMethod=http [http://www-933.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Tivoli+Netcool+Configuration+Manager&release=6.4.1.3&platform=All&function=fixId&fixids=ITNCM_6.4.1.3_IF001&includeRequisites=1&includeSupersedes=0&downloadMethod=http] ITNCM 6.3.0.6 IF004 none http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/Tivoli+Netcool+Configuration+Manager&release=6.3.0.6&platform=All&function=all [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7ETivoli&product=ibm/Tivoli/Tivoli+Netcool+Configuration+Manager&release=6.3.0.6&platform=All&function=all]
For ITNCM 6.2.x IBM recommends upgrading to a fixed, supported version/release/platform of the product.
GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]
RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/PSIRT] *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Is there a security vulnerability in the IBM WebSphere Application Server shipped with IBM Tivoli Netcool Configuration Manager? Is there a security vulnerability in the IBM WebSphere Application Server shipped with IBM Tivoli Netcool Configuration Manager?

Answer: Please consult the security bulletin Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450) [http://www-01.ibm.com/support/docview.wss?uid=swg21970575] for vulnerability details and information about fixes.


IBM When to enable Conversation Sharing in DataPower MQ Queue Manager (mq-qm) object - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When to enable Sharing Conversations in DataPower MQ Queue Manager (mq-qm) object along with SHARECNV attribute of the MQ SVRCONN channel?

RESOLVING THE PROBLEM
IBM WebSphere MQ server version 7.0 and later releases provide sharing conversations (SHARECNV) attribute on SVRCONN channel that specifies the maximum number of conversations that can share each TCP/IP channel instance. This feature can be configured in DataPower as it uses client connection with queue manager SVRCONN channel.
The default setting of sharing conversations (SHARECNV) value is zero in DataPower mq-qm object. The same default value for MQ SVRCONN channel is 10. The sharing conversations value is
negotiated between MQ server and DataPower and the lower value takes effect. However, in current versions of the DataPower firmware, the sharing conversations setting of 1 is treated as 0 when negotiating with MQ server.

There are three use cases to configure Sharing Conversations in DataPower mq-qm object:

Case #1 : The negotiated sharing conversations value is 0 - The channel runs in a mode similar to WebSphere MQ V6 and does not uses features such as

· Administrator stop-quiesce
· Heartbeating
· Read ahead
· Client asynchronous consume

Set a value of 0 or 1 on the Sharing Conversations attribute of the mq-qm object in DataPower to disable sharing conversations regardless of the IBM WebSphere MQ SVRCONN setting.

Case #2: The negotiated sharing conversations value is 1 - The channel supports IBM WebSphere MQ V7 and later release features as outlined in case #1, but each TCP/IP channel instance has a single conversation.

Set a value of 1 on the Sharing Conversations attribute and select "on" in Share Single Conversation attribute of the mq-qm object in DataPower as shown in the following picture and a value of 1 on IBM WebSphere MQ SVRCONN setting.

The Share Single Conversation attribute is only visible when "Sharing Conversations" is configured with value of "1" and then <RETURN> key is entered. For values greater than 1, the "Share Single Conversation" attribute is hidden in the mq-qm object.
[/support/docview.wss?uid=swg21647231&aid=1] [/support/docview.wss?uid=swg21647231&aid=1]

Case #3: The negotiated sharing conversations value is 2 or more - The channel supports IBM WebSphere MQ 7 and later release features and each TCP/IP channel instance supports 2 or more conversations.

Set a value of 2 or more on the Sharing Conversations attribute of the mq-qm object in DataPower and on the MQ SVRCONN channel.

On average, processing of messages from client applications is 15 percent slower when using SHARECNV(10) as compared to SHARECNV(0). Please refer to Performance Implications of Sharing [http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.0.1/com.ibm.mq.csqzaf.doc/mi12240_.htm]
Conversations on Client-connection Channels. [http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.0.1/com.ibm.mq.csqzaf.doc/mi12240_.htm].

Since DataPower uses a connection pool in processing MQ messages, there are no additional benefits of using sharing conversations with the mq-qm object. However, in situations when mixed message sizes are used by the same mq-qm object, using case #2 will benefit mq-qm object as it will use new buffer management feature of IBM WebSphere MQ Version 7 when making MQGET API call.

When using a negotiated shared conversations value of 0 as in case #1, mq-qm object uses maximum message size as the buffer pool for the MQGET API call. However, when mixed message sizes are processed by the same MQ Front Side Handler (FSH), it requests buffer pool based on maximum message size configured in the mq-qm object. The use of fixed buffer pool for small and large messages can deplete MQ server's allocated buffer and contribute to unexpected termination of MQ SVRCONN channel instance and may terminate the queue manager. In such a situation, using a negotiated sharing conversations value of 1 as in case #2 will benefit DataPower mq-qm object as it will use IBM WebSphere MQ Version 7 Read Ahead feature and the new buffer management feature for MQGET API call. IBM WebSphere MQ V8 release provides enhanced performance for case #2, when the negotiated sharing conversations value is 1.

For DataPower firmware releases 7.0.0.x, 7.1.0.x, 7.2.0.x and earlier, one should follow case #1 and use a negotiated sharing conversations value of 0. If you configure these firmware versions with case #2 or case #3, DataPower device may reload or hang due to connection instability and generate many MQ errors with Reason Code - 2009 and 2059.

Cases #2 and #3 can be used in firmware releases 7.5.0.x, 7.5.1.x and later. We suggest to use a value of 10 or less in Sharing Conversations attribute of the mq-qm object and verify the configuration empirically to make sure that IBM WebSphere MQ server can sustain load from DataPower with the negotiated Sharing Conversations of 10.

Note: In order to use sharing conversations, make sure you have applied APAR IV24821 [http://www.ibm.com/support/docview.wss?uid=swg1IV24821] ("Client C application process hangs after cancelling thread") to the IBM WebSphere MQ server. IV24821 is included in IBM WebSphere MQ V7.0.1.10 and later, IBM WebSphere MQ V7.1.0.3 and later, IBM WebSphere MQ V7.5.0.1 and later, and IBM WebSphere MQ V8.

In order to identify the negotiated Sharing Conversations status, the following MQ commands are used in the distributed platform.

runmqsc <qmgr>
display chs(CHANNEL3) maxshcnv curshcnv

display chs(CHANNEL3) maxshcnv curshcnv
1 : display chs(CHANNEL3) maxshcnv curshcnv
AMQ8417: Display Channel Status details.
CHANNEL(CHANNEL3) CHLTYPE(SVRCONN)
CONNAME(9.x1.x2.x3) CURRENT
STATUS(RUNNING) SUBSTATE(RECEIVE)
CURSHCNV(1) MAXSHCNV(1) <---- Negotiated Sharing Conversations value of 1
AMQ8417: Display Channel Status details.
CHANNEL(CHANNEL3) CHLTYPE(SVRCONN)
CONNAME(9.y1.y2.y31) CURRENT
STATUS(RUNNING) SUBSTATE(RECEIVE)
CURSHCNV(0) MAXSHCNV(0) <---- Negotiated Sharing Conversations value of 0

end
--------------------------------------------------------------------------------------------------------------------------------------------
In order to identify the negotiated Sharing Conversations status, the following MQ commands are used in the z/OS System.

connect to <qmgr>
On z/OS system, options for issuing the commands are described at http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.ref.adm.doc/q085120_.htm [http://www-01.ibm.com/support/knowledgecenter/SSFKSJ_8.0.0/com.ibm.mq.ref.adm.doc/q085120_.htm].
/+RTP8 DIS CHSTATUS(channel_name) MAXSHCNV CURSHCNV
where "+RTP8" is the command prefix.

Question: When should I use conversation sharing in DataPower MQ queue managers? MQ version 7.0 introduced a new feature, conversation sharing.  Are there any special values on DataPower when configuring conversation sharing?

Answer:
The default setting of sharing conversations (SHARECNV) value is zero in DataPower mq-qm object. The same default value for MQ SVRCONN channel is 10. The sharing conversations value is
negotiated between MQ server and DataPower and the lower value takes effect. However, in current versions of the DataPower firmware, the sharing conversations setting of 1 is treated as 0 when negotiating with MQ server.


IBM Recreate all the Oracle Text indexes - United States  TECHNOTE (FAQ)

QUESTION
 How do I recreate all the Oracle Text indexes for the Atlas database

ANSWER
There are situations where the Oracle Text indexes used by the application may need to be recreated. For example, after importing data from a production database to a test database, the Oracle Text indexes will not be transferred. This will require you to recreate them in order for certain functions in Atlas to work properly.

If you have access to the Atlas release files from the version you are currently using you can follow these instructions. You will need the ability to access the Atlas database using the Oracle SQL Plus tool.

 1. Shutdown the application server running the Atlas applications.
 2. Locate the script drop_ctxsys_indexes.sql to drop the Oracle Text indexes from the following folder in the Atlas release:
    Atlas\Schema\Deploy\smf\db\etc\oracle
 3. Open up a command window to that directory and execute the script using SQL Plus:
    sqlplus <user>/<password>@<database> @drop_ctxsys_indexes.sql
 4. Locate the scripts, setup_ctxsys_objects.sql and create_ctxsys_indexes.sql, used to create the Oracle Text preferences and indexes from the following folder in the Atlas release. The <version> folder will differ depending on which version you are currently running.
    Atlas\Schema\Deploy\smf\db\release\<version>\oracle\create\schema
 5. Open up a command window to that directory and execute the scripts using SQL Plus.
    sqlplus <user>/<password>@<database> @setup_ctxsys_objects.sql
    sqlplus <user>/<password>@<database> @create_ctxsys_indexes.sql
 6. Start the application server running the Atlas applications.

[attachment "recreate_oracle_text_3.0.2.x.zip" deleted by Nicholas Tsang/San Jose/IBM] [attachment "recreate_oracle_text_3.1.x.zip" deleted by Nicholas Tsang/San Jose/IBM] [attachment "recreate_oracle_text_4.x.zip" deleted by Nicholas Tsang/San Jose/IBM] [attachment "recreate_oracle_text_5.x.zip" deleted by Nicholas Tsang/San Jose/IBM]

HISTORICAL NUMBER
 1075

Question: How do I recreate all the Oracle Text indexes for the Atlas database How do I recreate all the Oracle Text indexes for the Atlas database ?

Answer:
Shutdown the application server running the Atlas applications.
 2. Locate the script drop_ctxsys_indexes.sql to drop the Oracle Text indexes from the following folder in the Atlas release:
    Atlas\Schema\Deploy\smf\db\etc\oracle
 3. Open up a command window to that directory and execute the script using SQL Plus:
    sqlplus <user>/<password>@<database> @drop_ctxsys_indexes.sql
 4. Locate the scripts, setup_ctxsys_objects.sql and create_ctxsys_indexes.sql, used to create the Oracle Text preferences and indexes from the following folder in the Atlas release. The <version> folder will differ depending on which version you are currently running.
    Atlas\Schema\Deploy\smf\db\release\<version>\oracle\create\schema
 5. Open up a command window to that directory and execute the scripts using SQL Plus.
    sqlplus <user>/<password>@<database> @setup_ctxsys_objects.sql
    sqlplus <user>/<password>@<database> @create_ctxsys_indexes.sql
 6. Start the application server running the Atlas applications.


IBM PI34677: MBEANSTARTER LOADEXTENSIONS FAILED TO LOAD EXTENSION - United States   A FIX IS AVAILABLE
Fixes integrated in WebSphere Portal 8.5.0.0 Combined Cumulative Fixes [http://www-01.ibm.com/support/docview.wss?uid=swg24037786]

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  During Portal Start-Up following error is shown:
   --------------------
   0000005e MBeanStarter  E com.ibm.wps.

   scripting.server.MBeanStarter loadExtensions failed to load
   extension:
   key: ServerExt.applications / value:
   com.ibm.wps.scripting.server.
   ApplicationServerExtensions

LOCAL FIX
 *  1) open the WAS admin console
   2) navigate to Resources > Resource environment providers > WP
   ScriptingService > Custom properties
   3) you should see an entry with the name
   "ServerExt.applications" and value
   "com.ibm.wps.scripting.server.ApplicationServerExtensions"
   4) delete this entry, save and restart the server.

PROBLEM SUMMARY
 *  A code fix for this issue is integrated into the WebSphere
   Portal & WCM Combined Cumulative Fix 05 (PI31198 [http://www-01.ibm.com/support/docview.wss?uid=swg1PI31198]) for Portal
   8.5.0.0 available from Fix Central:

   http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent
   =ibm/WebSphere&product=ibm/WebSphere/WebSphere+Portal&release=Al [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm/WebSphere&product=ibm/WebSphere/WebSphere+Portal&release=Al]
   l&platform=All&function=aparId&apars=PI31198

PROBLEM CONCLUSION
 *  Added a task to remove the outdate resource environment
   provider entry.

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PI34677

 * REPORTED COMPONENT NAME
   WEBSPHERE PORTA

 * REPORTED COMPONENT ID
   5724E7600

 * REPORTED RELEASE
   850

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt

 * SUBMITTED DATE
   2015-02-10

 * CLOSED DATE
   2015-03-10

 * LAST MODIFIED DATE
   2015-03-10

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:

FIX INFORMATION
 * FIXED COMPONENT NAME
   WEBSPHERE PORTA

 * FIXED COMPONENT ID
   5724E7600

APPLICABLE COMPONENT LEVELS
 * R850 PSY
   UP

Question:
Error: "MBEANSTARTER LOADEXTENSIONS FAILED TO LOAD EXTENSION" occurs at portal startup We are using Portal Server 8.5 and when starting the Portal server we see following error:

0000005e MBeanStarter E com.ibm.wps.scripting.server.MBeanStarter loadExtensions failed to load extension: key: ServerExt.applications / value: com.ibm.wps.scripting.server.ApplicationServerExtensions

How can we resolve this error?

Answer:
A code fix for this issue is integrated into the WebSphere
   Portal & WCM Combined Cumulative Fix 05 (PI31198 [http://www-01.ibm.com/support/docview.wss?uid=swg1PI31198]) for Portal
   8.5.0.0 available from Fix Central:


IBM Deploying IBM Datacap Taskmaster Capture on a WAN - United States WAN LAN architecture deployment TECHNOTE (FAQ)

QUESTION
 What are the best practices for deploying Datacap servers and clients on a wide area network (WAN)?

ANSWER
Remote users that access Datacap over a WAN can use Taskmaster Web-based "thin clients", or FastDoc Capture operating in offline mode. Datacap thick clients (DotScan, DotEdit) and utilities (NENU, Fingerprint Maintenance Tool) require LAN communication speeds and low latency for responsive performance.

Connect all Datacap Taskmaster Servers, Rulerunner Servers, Web Servers, file servers and databases to a single high performance LAN for best results. Network delays between Taskmaster Server, shared files and databases causes degraded performance of Job Monitor and data intensive operations.

Some customers successfully operate Datacap thick clients in remote sites using Citrix or other remote access technology. IBM has not tested or sought certification with Citrix, and does not provide support for Citrix. If you deploy Datacap clients on Citrix and encounter issues, IBM may require you to reproduce the issues outside of Citrix as part of the investigation.

Consult the IBM Redbooks titled "Implementing Imaging Solutions with IBM Production Imaging Edition and IBM Datacap Capture", section 2.5, for deployment recommendations and diagrams.

RELATED INFORMATION
 IBM Redbooks Production Imaging Edition [http://www.redbooks.ibm.com/abstracts/sg247969.html?Open]

Question:
Datacap on Citrix  Hi All,

Can we operate Datacap thin clients on citrix?

Answer: Remote users that access Datacap over a WAN can use Taskmaster Web-based "thin clients", or FastDoc Capture operating in offline mode.


IBM WebSphere Application Server Is Leap Year Compliant - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 We have had questions from clients planning for leap year years (containing February 29th) asking if WebSphere Application Server Leap Year Compliant, and if any problems are expected stemming from WebSphere Application Server or associated IBM products due to Leap Year.

There are no known or expected problems.
(Details below)

RESOLVING THE PROBLEM
WebSphere Application Server and the SDK are leap year compliant. IBM Java (SDK / JDK) has been doing leap year testing/verification since 1996, including the non-leap year 2000 without a problem. Basically leap years in Java are explicitly supported by the GregorianCalendar class - that is it's function - and this class is tested with every release of Java as it is part of Java's core functionality. So any Java code which uses the GregorianCalendar class will behave correctly.

WebSphere Application Server performs no specific leap year testing since it runs on top of the SDK which is compliant, and uses function from it. We are not aware of any issues in the past with WebSphere Application Server associated with leap year.

From a JDK perspective, Java applications which use the GregorianCalendar class will be leap-year compliant - see the spec at:

(Same info in the links for the various JDK's)

http://docs.oracle.com/javase/6/docs/api/java/util/GregorianCalendar.html [http://docs.oracle.com/javase/6/docs/api/java/util/GregorianCalendar.html]

http://docs.oracle.com/javase/7/docs/api/java/util/GregorianCalendar.html [http://docs.oracle.com/javase/7/docs/api/java/util/GregorianCalendar.html]

http://docs.oracle.com/javase/8/docs/api/java/util/GregorianCalendar.html [http://docs.oracle.com/javase/8/docs/api/java/util/GregorianCalendar.html]

Specifically:

"The only difference between the Gregorian and the Julian calendar is the leap year rule. The Julian calendar specifies leap years every four years, whereas the Gregorian calendar omits century years which are not divisible by 400." In other words the Gregorian Calendar follows modern leap years. The correct operation of the class is tested by the Java Compliance Kit (JCK) which is run against every release of the JVM. So Java applications would need to assert that they are using GregorianCalendars to claim leap-year compliance.

Question: Would like to know if WebSphere Extreme Scale  is leap year and leap second compliant. Is there any documentation that talks about this? Would like to know if WebSphere Extreme Scale is leap year  compliant. Is there any documentation that talks about this?

Answer: WebSphere Application Server and the SDK are leap year compliant.


Question: Would like to know if WebSphere Extreme Scale  is leap year and leap second compliant. Is there any documentation that talks about this? Would like to know if WebSphere Extreme Scale is leap second compliant. Is there any documentation that talks about this?

Answer: WebSphere Application Server and the SDK are leap year compliant.


IBM Security Bulletin: Vulnerabilities in OpenSSL affect WebSphere MQ 5.3 and MQ 8 for HPE NonStop Server (CVE-2017-3735) - United States  SECURITY BULLETIN

SUMMARY
 IBM WebSphere MQ 5.3 and IBM MQ 8 for HPE NonStop have addressed a vulnerability in which OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an IPAddressFamily extension in an X.509 certificate

VULNERABILITY DETAILS
CVEID: CVE-2017-3735 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3735]
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an IPAddressFamily extension in an X.509 certificate. An attacker could exploit this vulnerability to trigger an out-of-bounds read, resulting in an incorrect text display of the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/131047 [https://exchange.xforce.ibmcloud.com/vulnerabilities/131047] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
All versions of WebSphere MQ 5.3 and MQ 8 for HPE NonStop Server

REMEDIATION/FIXES
For MQ 5.3

 *
 *
 *
 *
 *
 *
 *
 *
 *
 * https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EWebSphere&product=ibm/WebSphere/WebSphere+MQ&release=5.3.1.14&platform=HP+NonStop&function=all
 *

For MQ 8
 *

 *
 * here
 *

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Vulnerabilities in OpenSSL affect WebSphere MQ 5.3 and MQ 8 for HPE NonStop Server (CVE-2017-3735) I need to understand details regarding Security Bulletin: Vulnerabilities in OpenSSL affect WebSphere MQ 5.3 and MQ 8 for HPE NonStop Server (CVE-2017-3735). Where can I find this information?

Answer:
CVEID: CVE-2017-3735 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3735]
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an IPAddressFamily extension in an X.509 certificate. An attacker could exploit this vulnerability to trigger an out-of-bounds read, resulting in an incorrect text display of the certificate.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/131047 [https://exchange.xforce.ibmcloud.com/vulnerabilities/131047] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)


IBM Security Bulletin: Security Vulnerability in IBM PureApplication System. (CVE-2015-1920) - United States  SECURITY BULLETIN

SUMMARY
 IBM PureApplication System contains IBM WebSphere Application Server, which has a security vulnerability that could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.

VULNERABILITY DETAILS
CVEID: CVE-2015-1920 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1920]
DESCRIPTION: WebSphere Application Server could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102404 [https://exchange.xforce.ibmcloud.com/vulnerabilities/102404] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Please consult the security bulletin: Security Vulnerability in IBM WebSphere Application Server [http://www-01.ibm.com/support/docview.wss?uid=swg21883573]for additional vulnerability details and information

AFFECTED PRODUCTS AND VERSIONS
IBM PureApplication Server bundles WebSphere Application Server in its Web Application Pattern.

IBM PureApplication System V2.1
IBM PureApplication System V2.0
IBM PureApplication System V1.1

REMEDIATION/FIXES
The solution is to apply an update to the Web Application pattern type included in IBM PureApplication System:

IBM PureApplication System V2.1
· Web Application Pattern Type V2.0.4.2
http://www.ibm.com/support/fixcentral/swg/quickorder?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=webapp-2.0.4.2-sys&includeSupersedes=0&source=fc [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=webapp-2.0.4.2-sys&includeSupersedes=0&source=fc]

· Web Application Pattern Type V1.0.4.2
http://www.ibm.com/support/fixcentral/swg/quickorder?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=webapp-1.0.4.2-sys&includeSupersedes=0&source=f [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=All&function=fixId&fixids=webapp-1.0.4.2-sys&includeSupersedes=0&source=f]

IBM PureApplication System V2.0
The solution is to upgrade to IBM PureApplication System V2.0.0.1 Interim Fix 5

IBM PureApplication System V1.1 and earlier:
Contact IBM customer support for upgrade options.

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
None

CHANGE HISTORY
 19 August 2015: Original Version Published
11 September 2015 Updated for IBM PureApplication System v2.0

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Security Vulnerability in IBM PureApplication System. (CVE-2015-1920) I need to understand details regarding "Security Bulletin: Security Vulnerability in IBM PureApplication System (CVE-2015-1920)". Where can I find this information?

Answer:
CVEID: CVE-2015-1920
DESCRIPTION: WebSphere Application Server could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions.
CVSS Base Score: 9.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102404 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C)


IBM Current Date function for DB2, SQL Server and Oracle - United States TPAEMSSQL; TPAEDB2; getdate; TPAEDATABASE; TPAEORACLE TECHNOTE (FAQ)

QUESTION
 What would be the equivalent of MSSQL getdate() function for Maximo running on DB2 or Oracle?

ANSWER
The getdate() MSSQL function can be replaced by value from DB2 CURRENT DATE special register. On Oracle, sysdate is used to retrieve the current date.

EXAMPLE : MSSQL and transdate <= ( getdate() - 35)

 DB2 and transdate <= ( CURRENT DATE - 35 DAYS)

 Oracle and transdate <= ( sysdate - 35)

RELATED INFORMATION
 URL [http://publib.boulder.ibm.com/infocenter/db2luw/v9r7/index.jsp]

Question:
Get all data that\'s registred today Version:
MxLoader 4.7.4

Problem:
Is it possible to do something like this:
reportdate >= TODAY()?

I cant get it to work but i would like to get all the data that has been registred today today.

Answer:
The getdate() MSSQL function can be replaced by value from DB2 CURRENT DATE special register. On Oracle, sysdate is used to retrieve the current date.

EXAMPLE : MSSQL and transdate <= ( getdate() - 35)

 DB2 and transdate <= ( CURRENT DATE - 35 DAYS)

 Oracle and transdate <= ( sysdate - 35)


IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker - United States IIB; WMB SECURITY BULLETIN

SUMMARY
 There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.1.4.10 and IBM® Runtime Environment Java™ Versions 7.0.10.10 and 7.1.4.10 used by IBM Integration Bus and WebSphere Message Broker. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017.

VULNERABILITY DETAILS

If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to determine whether the complete list of vulnerabilities are applicable to your code. For a complete list of vulnerabilities please refer to the link for “IBM Java SDK Security Bulletin" located in the “References” section for more information.

CVEID:CVE-2017-10115 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10115]
DESCRIPTION:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/128876 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128876]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2017-10116 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10116]
DESCRIPTION:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Security component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/128877 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128877]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)

CVEID:CVE-2017-10108 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10108]
DESCRIPTION:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/128869 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128869]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2017-10109 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10109]
DESCRIPTION:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
CVSS Base Score: 5.3
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/128870 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128870]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

AFFECTED PRODUCTS AND VERSIONS
IBM Integration Bus V9.0.0.0 - V9.0.0.8 and V10.0.0.0 - V10.0.0.9

WebSphere Message Broker V8.0.0.0 - V8.0.0.9
WebSphere Message Broker V7.0.0.0 - V7.0.0.8

REMEDIATION/FIXES

Product VRMF APAR Remediation / Fix IBM Integration Bus V10.0.0.0 - V10.0.0.9 IT21764 The APAR is available in fix pack 10.0.0.10 [http://www-01.ibm.com/support/docview.wss?uid=swg24043943]
http://www-01.ibm.com/support/docview.wss?uid=swg24043943 [http://www-01.ibm.com/support/docview.wss?uid=swg24043943] IBM Integration Bus V9.0.0.0 - V9.0.0.8 IT21764 The APAR is available in fix pack 9.0.0.9
http://www-01.ibm.com/support/docview.wss?uid=swg24043947 [http://www-01.ibm.com/support/docview.wss?uid=swg24043947] WebSphere Message Broker V8.0.0.0 - V8.0.0.9 IT21764 Contact IBM support to request a fix for APAR IT21764 WebSphere Message Broker V7.0.0.0 - V7.0.0.8 IT21764 Contact IBM support to request a fix for APAR IT21764

Websphere Message Broker V7 and V8 are no longer in full support; IBM recommends upgrading to a fixed, supported version/release/platform of the product.

If you are a customer with extended support and require a fix, contact IBM support.

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

IMPORTANT NOTE
 IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site [http://www.ibm.com/systems/z/solutions/security_subintegrity.html]. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]
IBM Java SDK Security Bulletin [http://www.ibm.com/support/docview.wss?uid=swg22006695]
RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
None

CHANGE HISTORY
 15th November 2017 : Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

RELATED INFORMATION
#

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker AIX, HP-UX, Linux, Solaris, Windows 7.0, 8.0
PRODUCT ALIAS/SYNONYM
 IIB
WMB

Question:
Help with Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IIB and WMB

I need to understand details regarding "Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker" This is related to
CVE-2017-10115
CVE-2017-10116
CVE-2017-10109
CVE-2017-10108

Where can I find this information?

Answer:
CVEID:CVE-2017-10115 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10115]
DESCRIPTION:An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit JCE component could allow an unauthenticated attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: Seehttps://exchange.xforce.ibmcloud.com/vulnerabilities/128876 [https://exchange.xforce.ibmcloud.com/vulnerabilities/128876]for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)


IBM Support's Guide to the SNMP [MTTrapd] probe - United States nco_p_mttrapd; snmp; rules file; probe; snmpsend; snmptrap; test; testing; snmpv3 TECHNOTE (FAQ)

QUESTION
 MTTrapd probe : How can you troubleshoot configuration issues?

ANSWER
The MTTrapd (SNMP) probe is a Generic probe used to process SNMP traps.
It is a multi-threaded probe and supports both UDP and TCP traps/informs.

The attached Support's guide to the SNMP probe provides details on how best to configure the probe, troubleshoot issues and how to use third party products to test the probes behaviour.

The latest probe version is:
Release ID: 20.0.2
Or higher.

RELATED INFORMATION
 Where to locate the latest MTTrapd probe release 20.0.2 [https://developer.ibm.com/answers/questions/414820/where-do-you-download-the-mttrapd-probe-release-20/]

SNMP_MTTRAPDProbe_SupportsGuide_22.pdf [/support/docview.wss?uid=swg21607690&aid=2]SNMP_MTTRAPDProbe_SupportsGuide_22.pdf [/support/docview.wss?uid=swg21607690&aid=1]

Question: Is there a support's guide to the MTTrapd probe ? Where do you download the Support's guide to the MTTrapd [SNMP] probe ?

Answer: The attached Support's guide to the SNMP probe provides details on how best to configure the probe, troubleshoot issues and how to use third party products to test the probes behaviour.


IBM A CWSXM0100E error is received for WebSphere Enterprise Service Bus (WESB), WebSphere Process Server (WPS), or IBM Business Process Manager (BPM) Advanced - United States CWSXM0100E; multiple; replies; single; request TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 When a single request is sent to a Mediation Flow Component in WebSphere Enterprise Service Bus, WebSphere Process Server, or Business Process Manager Advanced, services can be invoked more than once.

SYMPTOM
The following error message can be observed in the SystemOut.log file:

CWSXM0100E: Multiple replies have been produced for a single request flow in module <module_name>

More than one invocation can occur from a single request.

CAUSE
This error occurs when a mediation primitive is wired more than once to the next mediation primitive. It might seem to be a single wire. However, upon closer inspection, more than one wire exists.

By mistake, primitives might be wired more than once when there is only one wire. See the following screen shot:
[/support/docview.wss?uid=swg21584783&aid=1]

If you move the primitives in question, however, you notice that there are more wires underneath:

[/support/docview.wss?uid=swg21584783&aid=2]

RESOLVING THE PROBLEM
To solve this problem, complete the following steps:

 1. Delete any redundant wires.

 2. Save the project.

 3. Redeploy the application to the server.

RELATED INFORMATION
#IC67220: OUTSTANDING PROCESSING OCCURS IN AN AGGREGATIO [http://www.ibm.com/support/docview.wss?uid=swg1IC67220]

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Advanced Mediation AIX, Linux, Solaris, Windows, z/OS 8.0, 7.5.1, 7.5.0.1, 7.5 Business Integration WebSphere Process Server Mediation AIX, HP-UX, Linux, Solaris, Windows, z/OS 7.0.0.4, 7.0.0.3, 7.0.0.2, 7.0.0.1, 7.0, 6.2.0.3, 6.2.0.2, 6.2.0.1, 6.2

Question: Why am I seeing "CWSXM0100E: Multiple replies have been produced for a single request flow in module" ? We are building a simple mediation module, consisting only of the request flow. The mediation module has one service invoke calling an external service through web service binding. Upon testing the process, we observe see that the service invoke is being called twice. There is no Fan-in or fan -out in the request flow. Below is the error: "Caused by: com.ibm.wsspi.sibx.mediation.flow.MediationRuntimeException: CWSXM1023E: Exception when calling flow action: CWSXM0100E: Multiple replies have been produced for a single request flow in module"

Answer:
This error occurs when a mediation primitive is wired more than once to the next mediation primitive. It might seem to be a single wire. However, upon closer inspection, more than one wire exists.

By mistake, primitives might be wired more than once when there is only one wire. See the following screen shot:
[/support/docview.wss?uid=swg21584783&aid=1]

If you move the primitives in question, however, you notice that there are more wires underneath:


IBM Silent Install - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Silent install of any of the Tivoli Monitoring components fails.

CAUSE
When the complete path to the silent response file is not specified as part of the command invoking the silent install, it fails with the following error message in the log file:

------------------------------------------------------------
08-16-2012 09:52:31: Silent install configuration file: silent_response.txt
08-16-2012 09:52:31:
08-16-2012 09:52:31: AgentDeployRunning=FALSE.
08-16-2012 09:52:31:
08-16-2012 09:52:31: SEVERE: You must agree to the License Agreement.
08-16-2012 09:52:31: SEVERE: Silent install config error.
08-16-2012 09:52:31: Silent install config error.
------------------------------------------------------------

RESOLVING THE PROBLEM
Specify the complete path to the silent response file while launching the silent install.

e.g.
setup /z"/sfE:\TEMP\silent_response.txt" /s /f2"C:\temp\itm6_agent_setup.log"

Question:
Silent uninstall of ITCAM for MQ agent fails Running silent uninstall of the ITCAM for MQ agent with this command: start /wait setup /z"/sfMQ_Silent_Uninstall.txt" /s /f2"C:\temp\silent_setup.log" fails with this message in the Abort_*.trc file: SEVERE: You must agree to the License Agreement.

The MQ_Silent_Uninstall.txt does contain this line: License Agreement=I agree to use the software only in accordance with the installed license.

Answer: Specify the complete path to the silent response file while launching the silent install.