Hello,

I am working with CKQEXSMF/CKQRADAR to send SMF data to QRadar. This is working for me in a test system, but I had my filtering enabled using the CKQXES member, but revisiting the manual I think I can do this more efficiently and with greater control of what I am sending.

My current goal is to send just RACF type 80 records so I believe I can code just the following (for the Filter statement) in the CKQEXSMF parmlib member:
filter addsmf(rectype(80))

I see that it is also possible to filter on event codes, so I think this could be coded (assuming I was only interested in ADDUSER):
filter addsmf(rectype(80)subtype(10)) - is this proper syntax, based on the manual it does not appear there is a comma or separator between these

But what I would really like to do is send all 80s with the exception of event code 2, qualifier 0. The successful accesses are generating a lot of volume, and we will not currently be using these in QRadar.

I did not see a documented way of accomplishing this, we are using v2.5.

1) Is there a way to filter on Event Qualifiers?
2) Is there a way to exclude subtypes or do I need to create includes for all the ones I want to capture?

Thanks in advance.

I just tried coding this statement in my CKQXES member:
exclude type=(80(2))

I am still receiving event code 2 records in QRadar. I'm assuming this most only work with "true" SMF subtypes?

You would have to write CKQXES as 

exclude type=80 event=2(0)

or

exclude type=80 event=access(success)

to get rid of your access events.

------------------------------
Rob van Hoboken
------------------------------

By the way, remember to also include 

filter addsmf(rectype(30) subtype(1))

in your CKQEXSMF if you want to track TSO logon (most auditors want to see TSO logon for privileged users).

------------------------------
Rob van Hoboken
------------------------------

Thanks Rob,

I'll code the exclude as you described. I'll also work with the SMF 30 capture.  We currently have a zSecure alert defined to track the logons of the set of users they want, but they also may want it in this log source as well so I'll have to ask.