The AM.3 screens in ISPF shows based on the AM data when the last time a permission was used.      Looking at the data dictionary it seems the RESOURCE name is a field for that record type.

We are running some of the TRUSTED reports and noticed some of the TRUSTED datasets are using for example the "SYS1.**" profile.    Using AM.3 I see permissions for "SYS1.**" are being used.     I was curious if I could copy the Carla from AM.3 and list the actual resource that was being authorized to "SYS1. **"      I want to see what dataset is hitting the "SYS1.**" profile along with the permission in the profile it is using.

Or is there a better way of doing this?

Thanks

------------------------------
Linnea Sullivan
------------------------------

The RESOURCE in AM.3 is not really useful. For that SYS1.** profile, it might be a long repeated list of all matching resources. But in fact, the resource field is almost always empty :-(    I did not check what we document for that field, and I don't immediately remember what the design was.

It's probably easier to use the ACCESS newlist, as used for AM.1. I played a bit with the summary statement, and applied a select on SIM_VIA (ID_USER or ID_GROUP). The profile shown (ACCESS_PROFILE) is the historic profile, but you could also replace by SIM_PROFILE to get the one in the current database.

newlist type=access nodetailinherit required                              define tot_count("Occurrence",10,udec$abbr) sum(access_count_big)        define avg_reclen avg(record_length)                                     define first_tod_sum(,"First occurrence") min(last_datetime)             define last_tod_sum(,"Last occurrence") max(last_datetime)               define poesep(1,":",hdr$blank) boolean    where exists(utoken_poeclass) select sim_via=(ID_USER, ID_GROUP), REQ_STATUS_ACCESS=NO,                                            resource=SYS1.LINKLIB                                              dsummary   class(nd)  tot_count class,                                             first_tod_sum last_tod_sum,                                            * access_profile(nd) tot_count(noprop),                                    access_profile(246),                                                   * resource(nd) tot_count(noprop) resource(246),                          * intent_raw(nd) rectype(nd) access_result(nd),                            tot_count(noprop) intent(8),                                             rectype,                                                                 req_status_access(6,hb),                                                 access_result(5,"AccRC",dec),                                          * tot_count(noprop,nosortlist),                                            userid userid:name jobname,                                            * tot_count(noprop,nosortlist) sim_via,                                  * tot_count(noprop,nosortlist) sim_via_groups                   

Which gives me at the detail level report:

An alternative selection might be:

select sim_via=(ID_USER, ID_GROUP), req_status_access=no,   
       access_profile='SYS1.**'                             

Hope this helps.

------------------------------
Guus Bonnes

Original Message:
Sent: Tue August 08, 2023 12:45 PM
From: Linnea Sullivan
Subject: Access Monitor - Permission Usage

The AM.3 screens in ISPF shows based on the AM data when the last time a permission was used.      Looking at the data dictionary it seems the RESOURCE name is a field for that record type.

We are running some of the TRUSTED reports and noticed some of the TRUSTED datasets are using for example the "SYS1.**" profile.    Using AM.3 I see permissions for "SYS1.**" are being used.     I was curious if I could copy the Carla from AM.3 and list the actual resource that was being authorized to "SYS1. **"      I want to see what dataset is hitting the "SYS1.**" profile along with the permission in the profile it is using.

Or is there a better way of doing this?

Thanks

------------------------------
Linnea Sullivan
------------------------------

The RESOURCE in AM.3 is not really useful. For that SYS1.** profile, it might be a long repeated list of all matching resources. But in fact, the resource field is almost always empty :-(    I did not check what we document for that field, and I don't immediately remember what the design was.

It's probably easier to use the ACCESS newlist, as used for AM.1. I played a bit with the summary statement, and applied a select on SIM_VIA (ID_USER or ID_GROUP). The profile shown (ACCESS_PROFILE) is the historic profile, but you could also replace by SIM_PROFILE to get the one in the current database.

newlist type=access nodetailinherit required                              define tot_count("Occurrence",10,udec$abbr) sum(access_count_big)        define avg_reclen avg(record_length)                                     define first_tod_sum(,"First occurrence") min(last_datetime)             define last_tod_sum(,"Last occurrence") max(last_datetime)               define poesep(1,":",hdr$blank) boolean    where exists(utoken_poeclass) select sim_via=(ID_USER, ID_GROUP), REQ_STATUS_ACCESS=NO,                                            resource=SYS1.LINKLIB                                              dsummary   class(nd)  tot_count class,                                             first_tod_sum last_tod_sum,                                            * access_profile(nd) tot_count(noprop),                                    access_profile(246),                                                   * resource(nd) tot_count(noprop) resource(246),                          * intent_raw(nd) rectype(nd) access_result(nd),                            tot_count(noprop) intent(8),                                             rectype,                                                                 req_status_access(6,hb),                                                 access_result(5,"AccRC",dec),                                          * tot_count(noprop,nosortlist),                                            userid userid:name jobname,                                            * tot_count(noprop,nosortlist) sim_via,                                  * tot_count(noprop,nosortlist) sim_via_groups                   

Which gives me at the detail level report:

An alternative selection might be:

select sim_via=(ID_USER, ID_GROUP), req_status_access=no,   
       access_profile='SYS1.**'                             

Hope this helps.

------------------------------
Guus Bonnes

Original Message:
Sent: Tue August 08, 2023 12:45 PM
From: Linnea Sullivan
Subject: Access Monitor - Permission Usage

The AM.3 screens in ISPF shows based on the AM data when the last time a permission was used.      Looking at the data dictionary it seems the RESOURCE name is a field for that record type.

We are running some of the TRUSTED reports and noticed some of the TRUSTED datasets are using for example the "SYS1.**" profile.    Using AM.3 I see permissions for "SYS1.**" are being used.     I was curious if I could copy the Carla from AM.3 and list the actual resource that was being authorized to "SYS1. **"      I want to see what dataset is hitting the "SYS1.**" profile along with the permission in the profile it is using.

Or is there a better way of doing this?

Thanks

------------------------------
Linnea Sullivan
------------------------------

Guus, this is something I could use, but need to load it into Excel.   Is there a way to keep the counts but keep all the data on a single row/record for each access?

One other question:  What does the statement "REQ_STATUS_ACCESS=NO" do for it.

Thank you!

Brent Brimacomb

The RESOURCE in AM.3 is not really useful. For that SYS1.** profile, it might be a long repeated list of all matching resources. But in fact, the resource field is almost always empty :-(    I did not check what we document for that field, and I don't immediately remember what the design was.

It's probably easier to use the ACCESS newlist, as used for AM.1. I played a bit with the summary statement, and applied a select on SIM_VIA (ID_USER or ID_GROUP). The profile shown (ACCESS_PROFILE) is the historic profile, but you could also replace by SIM_PROFILE to get the one in the current database.

newlist type=access nodetailinherit required                              define tot_count("Occurrence",10,udec$abbr) sum(access_count_big)        define avg_reclen avg(record_length)                                     define first_tod_sum(,"First occurrence") min(last_datetime)             define last_tod_sum(,"Last occurrence") max(last_datetime)               define poesep(1,":",hdr$blank) boolean    where exists(utoken_poeclass) select sim_via=(ID_USER, ID_GROUP), REQ_STATUS_ACCESS=NO,                                            resource=SYS1.LINKLIB                                              dsummary   class(nd)  tot_count class,                                             first_tod_sum last_tod_sum,                                            * access_profile(nd) tot_count(noprop),                                    access_profile(246),                                                   * resource(nd) tot_count(noprop) resource(246),                          * intent_raw(nd) rectype(nd) access_result(nd),                            tot_count(noprop) intent(8),                                             rectype,                                                                 req_status_access(6,hb),                                                 access_result(5,"AccRC",dec),                                          * tot_count(noprop,nosortlist),                                            userid userid:name jobname,                                            * tot_count(noprop,nosortlist) sim_via,                                  * tot_count(noprop,nosortlist) sim_via_groups                   

Which gives me at the detail level report:

An alternative selection might be:

select sim_via=(ID_USER, ID_GROUP), req_status_access=no,   
       access_profile='SYS1.**'                             

Hope this helps.

------------------------------
Guus Bonnes

Original Message:
Sent: Tue August 08, 2023 12:45 PM
From: Linnea Sullivan
Subject: Access Monitor - Permission Usage

The AM.3 screens in ISPF shows based on the AM data when the last time a permission was used.      Looking at the data dictionary it seems the RESOURCE name is a field for that record type.

We are running some of the TRUSTED reports and noticed some of the TRUSTED datasets are using for example the "SYS1.**" profile.    Using AM.3 I see permissions for "SYS1.**" are being used.     I was curious if I could copy the Carla from AM.3 and list the actual resource that was being authorized to "SYS1. **"      I want to see what dataset is hitting the "SYS1.**" profile along with the permission in the profile it is using.

Or is there a better way of doing this?

Thanks

------------------------------
Linnea Sullivan
------------------------------