IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Access Monitor Started Task Parms C2PAMJOB and C2PAMRCL

  • 1.  Access Monitor Started Task Parms C2PAMJOB and C2PAMRCL

    Posted Thu November 30, 2023 11:05 AM

    Reviewing some of my parm members we have been using the last 2 years to ensure they are set up correctly because we are about to configure a new environment to gather Access Monitor Data.

    From reading the documentation C2PAMJOB supposedly used to specify a User ID or User ID prefix in which you want jobname information recorded.   However, in my environment they listed the User ID owners instead of specifying all the IDs that is owned by that group.    Can you use a group that owns the UserIDs in C2PAMJOB?

    C2PAMRCL we have listed DATASET YES.   We have no other classes listed in the member.    However, AM is recording activity from every class we have defined/active in the CDT.    So, I don't understand why only the DATASET class is listed in this member, and should we add other classes to the list.



    ------------------------------
    Linnea Sullivan
    ------------------------------


  • 2.  RE: Access Monitor Started Task Parms C2PAMJOB and C2PAMRCL

    Posted Fri December 01, 2023 03:34 AM
    Edited by Rob van Hoboken Fri December 01, 2023 03:34 AM

    Hi Linnea

    C2PAMJOB only allows user IDs and prefix values.  There is no support to specify RACF owner information.  If you need this, you could write an easy CARLa program that selects all user IDs owned by some groups, and overwrites C2PAMJOB with the prescribed layout on a daily basis.

    C2PAMRCL controls the contents of ACCESS records, not the selection.  If the ACCESS record describes an event for a class listed in C2PAMRCL and the origin class of the event is listed in member C2PAMPCL, for example a CONSOLE or a TERMINAL, then the point of origin info (POE) is stored in the ACCESS record.  This is helpful, for example, if you need to find the CONSOLE id for OPERCMDS access events.  If C2PAMPCL is empty, your DATASET entry in C2PAMRCL is void.  No, you do not HAVE to add (all) classes in C2PAMRCL, in fact, you shouldn't.  Adding fields into ACCESS records (be it jobnames or POE  info) increases the number of summarized ACCESS records and consequently the size of the ACCESS data sets.

    See the manual for details.

    ------------------------------
    Rob van Hoboken
    ------------------------------