Would like to get your thoughts on the Command Logger data.     Currently Command Logger is writing its data to a log stream.   But as the log stream fills up the data is over written.    In our current sandbox environment that is fine, but as we rollout to other environments I need to save the data.

What are your suggestions about off loading that log stream data?   What utility do you use to offload the data? Can the Command Logger STC, off load the previous day's data?  What type of file?    Do you suggest daily, or weekly?    Anything else we should consider?

Thanks

------------------------------
Linnea Sullivan
------------------------------

I don't believe we use "command logger" in and of itself.  What we do is we keep everything in SMF records/logs, and we make sure that all of the various Audit options are turned on so all (or nearly all) RACF commands get logged there.  All the SMF records are backed up to (virtual/real) Tape daily and weekly (at least), we keep "yesterday's" data on disk (for quick reference), and records are also offloaded to QRadar periodically (I think at least hourly).  SMF records can be queried by zSecure and reported on there as Events.  We also maintain a lot of Access Manager data history.

------------------------------
Scott Tietjen CISSP
------------------------------

The Installation and Deployment manual does not mention it, but the User Reference Manual describes sample job SCKRSAMP(C2RJXUNL) to unload (or dump) CKXLOG logstreams.  I agree, that is a set-up task you would expect in the installation manual (or at the very least some mention).
The CARLa program in SCKRCARL(C2RLXUNL) copies records that are 1 day old into an output data set, for example a daily GDG, so an excellent part of your "end of day" processing.  The sample in the URM shows how you could use the ALLOC command to reduce the number of records processed.

------------------------------
Rob van Hoboken
------------------------------