IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  CARLA Report CKADFD81 is not produce a report in zSecure

    Posted Thu June 15, 2023 08:13 AM

    Hi,

    We run CKADFD81 report from zSecure CARLA(CO.5). Job ended with RC=08 because there was VSAM or VVDS inconsistencies in our system. This error mustn't affect the result (Job's purpose is "Display SETROPTS from RACF SMF records") .  We could not produce a report from this job. We checked PARMLIB member of SMFPRM00 there is no problem Our system collect SMF type=81


    ACTIVE                          /* ACTIVE SMF RECORDING             */
    LSNAME(IFASMF.MVS.&SYSNAME..T30,TYPE(30))
    LSNAME(IFASMF.MVS.&SYSNAME..T70T79,TYPE(70:79))
    LSNAME(IFASMF.MVS.&SYSNAME..T89,TYPE(89))
    LSNAME(IFASMF.MVS.&SYSNAME..T98,TYPE(98))
    LSNAME(IFASMF.CICS.&SYSNAME..T110,TYPE(110))
    LSNAME(IFASMF.CICS.&SYSNAME..T111,TYPE(111))
    LSNAME(IFASMF.MQ.&SYSNAME..T115,TYPE(115))
    LSNAME(IFASMF.MQ.&SYSNAME..T116,TYPE(116))
    LSNAME(IFASMF.DB2.&SYSNAME..T100,TYPE(100))
    LSNAME(IFASMF.DB2.&SYSNAME..T101,TYPE(101))
    LSNAME(IFASMF.DB2.&SYSNAME..T102,TYPE(102))
    DEFAULTLSNAME(IFASMF.MVS.&SYSNAME..TALLOTH)

    .

    .

    .

    SYS(NOTYPE(4,5,20,34,35,40,99(1:13),255),
    EXITS(IEFU83,IEFU84,IEFU85,IEFU86,IEFACTRT,IEFUJV,IEFUSI,IEFUJI,
          IEFU29,IEFUTL),
          INTERVAL(SMF,SYNC),NODETAIL)
    SUBSYS(STC,EXITS(IEFU29,IEFU83,IEFU84,IEFU85,IEFU86,IEFUJP,IEFUSO,
                     IEFUSI))
    SUBSYS(TSO,EXITS(IEFU29,IEFU83,IEFU84,IEFU85,IEFU86,IEFUJP,IEFUSO,
                     IEFUSI,IEFUTL))

    The following screen shows that SMF records in zSecure Set of Input Files (SE.1).

    .    Menu         Options       Info    Commands     Setup                         .
    .  ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ .
    .                           zSecure Admin+Audit for RACF               Row 1 of 4  .
    .  Command ===>                                                  Scroll ===> CSR   .
    .                                                                                  .
    .  Description . . . . SMF Loglar`                                                 .
    .  Complex . . . . . .            Version  . . . .                                 .
    .                                                                                  .
    .  Enter data set names and types.         Type END or press F3 when complete.     .
    .  Enter dsname with .* to get a list      Type SAVE to save set, CANCEL to quit.  .
    .  Valid line commands: E L I R D          Type REFRESH to submit unload  job.     .
    .                                                                                  .
    .     Data set name or DSNPREF=, or Unix file name            Type or ?   NJE node .
    .     IFASMF.MVS.SX71.TALLOTH                                 SMF.LOGSTR           .
    .     IFASMF.MVS.SX71.T30                                     SMF.LOGSTR           .
    .     IFASMF.MVS.SX71.T70T79                                  SMF.LOGSTR           .
    .     IFASMF.MVS.SX71.T89                                     SMF.LOGSTR           .
    .  ******************************* Bottom of data ******************************** .

    Regards,

    Baybars Fatih Suleymanoglu



    ------------------------------
    Baybars Fatih Suleymanoglu
    ------------------------------


  • 2.  RE: CARLA Report CKADFD81 is not produce a report in zSecure

    Posted Thu June 15, 2023 09:21 AM

    Hi Baybars,

    That report CKADFD81 uses a pre-selection "SMFSEL" and as such cannot be run by itself from CO. You should however have received the following RC12 message:

    CKR0403 12 LIKELIST must refer to a previously defined NEWLIST type=smf NAME= parameter

    This can only be solved by adding a newlist before this CARLa. When there should be no preselection, a dummy newlist with name SMFSEL can be found in member CKALFSEL.

    Easiest solution could be to create a new CARLa member containing the two statements
    IMBED M=CKALFSEL
    IMBED M=CKADFD81



    ------------------------------
    Sander De Graaf
    ------------------------------



  • 3.  RE: CARLA Report CKADFD81 is not produce a report in zSecure

    Posted Thu June 15, 2023 11:46 AM

    When you check member CKADFD81, look for the SELECT command.  I think it contains a SELECT TYPE=81 or something similar.  That means you only have to allocate the logstream that contains the required SMF types.  In your case that would be TALLOTH. Also, zSecure does not look at RMF records, so no need to allocate T70T79, ever.

    You might also want to check the LIST variant of this member, esp. if you have problems with the line length of the reports: CKALFR81.

    By the way message CKR0403 can be suppressed, so instead of using the IMBED M=CKALFSEL command, you could also use SUPPRESS MSG=0403 as your first command.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 4.  RE: CARLA Report CKADFD81 is not produce a report in zSecure

    Posted Thu June 15, 2023 06:22 PM

    Affirmative. The SELECT is on line 53 in the most recent edition.

     VIEW       CRMA.D.GKR250.$TEST.SCKRCARL(CKADFD81) - 1       CHARS 'EndM' found 
     Command ===> ________________________________________________ Scroll ===> CSR  
     000047  * 220620 2.5.0 EPL J0010255: Support Phraseint                         
     000048  *****************************************************EndModule*******/ 
     000049  newlist type=smf    detail header=prefix name=RACFSETR,                
     000050           noaction nomodify,                                /*ER80328*/ 
     000051           detailhelppanel=ckatdis2,                                     
     000052   title='RACF system initialization general SETROPTS settings'          
     000053   s likelist=smfsel type=81                                             
     000054   i m=CKAS0081                                                          

    Creating an SMFSEL NEWLIST to refer to is explained here in the User Reference Manual: https://www.ibm.com/docs/en/szs/2.5.0?topic=scripts-using-record-display-interactive-reporting

    LIKELIST and SUP MSG=403 are explained here in the CARLa Command Reference: https://www.ibm.com/docs/en/szs/2.5.0?topic=SS2RWS_2.5.0/com.ibm.zsecure.doc_2.5.0/admin_audit/carla_cmnd_lang_select_sel_likelist.htm#carla_cmnd_lang_select_sel_likelist



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 5.  RE: CARLA Report CKADFD81 is not produce a report in zSecure

    Posted Thu July 20, 2023 04:11 AM

    Hi,

    Thank you for your suggestions. My problem is solved.

    Regards.



    ------------------------------
    Baybars Fatih Suleymanoglu
    ------------------------------