IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Wed December 18, 2024 06:57 AM

    Hi there,

    I've coded below Carla program in zAlert for generating a report on all the commands issued by an ID as below.

    n type=smf nopage                               
    alloc dsn='DATASET.LIBRARY.DAILY(0)' type=smf
    SELECT RACFCMD=(ADDUSER,ALTUSER,DELUSER) USER=GENERICID system=X*OS 
    sortlist,                                                         
       USERID(ND) DATETIME(ND) SYSTEM(ND) SMFDD(ND) RECNO(ND),        
       DATETIME SYSTEM JOBNAME,                                       
       RACFCMD(WORDWRAP,HOR)        

    It does gives me all the commands issued by that ID yesterday if run just Carla code but when I use the same code in z-Alert, sometimes the alert email does not generate the data for yesterday instead it gives me data for (-1).

    And sometimes it does generate email with yesterday data which is correct.

    I'm struggling to find the root cause for this. 

    Any help from anyone would be much appreciated.
                                    



    ------------------------------
    Raju
    ------------------------------


  • 2.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Wed December 18, 2024 08:10 AM

    Hi raju,

    Looks like you only want to show the RACF commands that were issued in the reporting interval in your alert. Alert will have SMF records stored in its buffers over a much larger time frame so to limit the input on just this one reporting interval specify something like this.

    SELECT RACFCMD=(ADDUSER,ALTUSER,DELUSER) USER=GENERICID system=X*OS  likelist=recent

    that your CARLa above shows all commands of the previous day looks normal to me as i guess this GDG is used to offload/store SMF records for an entire day. Alert on the other hand only has the records available that are in its buffers. 

    hope this helps.

    cheers,

    rene



    ------------------------------
    RENE van TIL
    ------------------------------

    Original Message


  • 3.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Wed December 18, 2024 11:25 AM

    Hi Raju

    Like Rene indicated, Alert is designed to collect SMF records for a a number of minutes and then generate alerts for the records that were generated in the last reporting interval.  Alert is not specifically designed to allow input from another SMF input data set, in other words, you are not supposed to add an ALLOC command in the zSecure Alert skeleton.  Alert is also not intended to report on "yesterday" or even "all events from today."

    If you are only using zSecure Alert (as opposed to zSecure Audit) because you want to distribute the report as an email, there are ways to specify the email parameters in a normal CARLa program.  See for example this answer from Tom.



    ------------------------------
    Rob van Hoboken
    ------------------------------

    Original Message


  • 4.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Thu December 19, 2024 09:37 AM
    Edited by kanakaraju seeramsetti Thu December 19, 2024 09:39 AM

    Thanks Rene and Rob for responding.

    I did tried using likelist=recent and could see no results popped up. I'm thinking likelist=recent and ALLOC ( for yesterday's data) members are mutually exclusive, so that might be the reason no results came up. 

    Does datetime=today-1 will work here ? just want to check.

    As advised by Rob, we shouldn't be using the z-Secure alert for reporting, however I'm having a requirement to send a report on daily basis and I don't want to use batch jobs. So, thought of using zAlert to facilitate that.

    I would also assume we still need to code the batch job to run on daily basis if we use email parameters in a normal CARLA program. Please correct me if this is not right.

    Thanks again for your help.

    Raju



    ------------------------------
    kanakaraju seeramsetti
    ------------------------------

    Original Message


  • 5.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Thu December 19, 2024 09:57 AM

    Hi raju

    if it is report you want, that is created in batch, and then sent via mail. a good way to start is for instance EV.U to get a sample

      Menu         Options       Info    Commands     Setup                        
    -------------------------------------------------------------------------------
    CKRP3EU@         zSecure Suite - Events - User Selection     Job not submitted 
    Command ===>                                                        start panel
                                                                                   
    Show records that fit all of the following criteria:                           
    Userid/logonid/ACID *            (ESM id or EGN mask)                          
    Owned by  . . . . .              (group or userid, or EGN mask)                
    System  . . . . . .              (system name or EGN mask)                     
    Name  . . . . . . .                             (name/part of name, no filter) 
    Installation data .                             (scan of data, no filter)      
    Jobname . . . . . .              (job name or EGN mask)                        
    Terminal/source . .              (Terminal/source id or EGN mask)              
    Advanced selection criteria                                                    
       User actions               User attributes            Date and time         
       Data set selection         Unix selection             Resource selection    
       DB2 selection              CICS selection             Omegamon selection    
       IP selection                                                                
                                                                                   
    Output/run options                                                             
    /  Include detail             Summarize                  Specify scope         
    /  Output in print format     Customize title         /  Send as e-mail        
      /  Run in background        Sort differently                                 

    select both "run in background" and "send" as e-mail". A job will created to does this. You can change the CARLa in that job to whatever you need and save it somewhere in a dataset of your own. 

    cheers

    rene



    ------------------------------
    RENE van TIL
    ------------------------------

    Original Message


  • 6.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Thu December 19, 2024 09:58 AM

    Hi Raju,

    Yes, I can confirm that for the purpose of generating a daily report with the RACF commands that a certain user executed that coding a batch job that reports the commands is definitely the best solution for this requirement. zSecure Alert is a (near) real-time alerting tool that is not designed to be used for daily reporting purposes. 

    Just code a regular batch job with the appropriate CARLa script that produces the daily RACF commands overview for your requestor needs and handover that job to your job scheduling product to run it on a daily basis. 



    ------------------------------
    Tom Zeehandelaar
    z/OS Security Enablement Specialist - zSecure developer
    IBM
    ------------------------------

    Original Message


  • 7.  RE: Issue regarding z-Alert coding to generate all SMF events for a specific system ID

    Posted Thu December 19, 2024 12:07 PM

    Thanks Rene and Tom ,

    Much appreciated 

    Raju



    ------------------------------
    kanakaraju seeramsetti
    ------------------------------

    Original Message


Related Content