The filter created for message CPF9898 with a compare value stopped working. (NETIQKB41287)

fact
VigilEnt Security Agent for PSDetect 7.5

fact
VigilEnt Security Agent for iSeries PSDetect

symptom
The filter created for message CPF9898 with a compare value stopped working.

cause
It is possible the format for the the message has changed. 

fix

A possible solution would be to create a new message to use.  The example below presumes you were sending a CPF9898 message to QSYSOPR with a value of 105.  PSDetect would then have an alert filter with Compare Data to send an alert if value 105 is detected.

At a command entry line, run the following two commands:

• CRTMSGF MSGF(QGPL/USRMSG) TEXT('User messages') AUT(*USE)
• ADDMSGD MSGID(USR9898) MSGF(QGPL/USRMSG) MSG('&1.') FMT((*CHAR 10))

Change your existing  program that sends CPF9898 with '105' to QSYSOPR to use msgid USR9898 from message file QGPL/USRMSG.

Change the PSDetect filter for the QSYSOPR queue to monitor for USR9898 from message file QGPL/USRMSG. Use the same Compare Data Variable values (Variable &1 Equal To Compare Data 105).

Note the maximum length is 10 bytes for the substitution variable value &1 in msgid USR9898.

Formerly known as NETIQKB41287