IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Processing zSecure Command Verifier Audit Trail

    Posted Thu January 23, 2020 08:51 AM
    Hello,

    I'm looking to see what tools (if any) are out there to process the Command Verifier audit trail, in CARLa or otherwise. I'd like to have a report/utility to visualize this data more easily.

    There is the "C4RCATMN" command but that seems to require the exact class and profile.

    CARLa like below can extract UserIDs with relevant userdata, but it seems like I'd need to translate / post-process it:

    newlist type=RACF retain pl=0 nopage
    select class=user USRNM<>CNG*
    sortlist key(8,"!User") userdata​

    As I get records like below:

    ADAM $C4RAROA 00 A,20022/1352,ADAM,00;D,20022/1353,ADAM,00​

    Appreciate any guidance here!

    ------------------------------
    Adam Klinger
    ------------------------------


  • 2.  RE: Processing zSecure Command Verifier Audit Trail

    Posted Thu January 23, 2020 11:39 AM
    Edited by Rob van Hoboken Fri January 24, 2020 09:09 AM
    Hi Adam
    You could run a CARLa like this
    newlist type=RACF nopage dd=ckrcmd
      select class=user USRNM=$C4R*
      sortlist "C4RCATMN LIST CLASS(" | class(0) | ") PROFILE(" | key(0) | ")"
    and run the resulting commands.
    The USR data you printed is not intended as a formal interface to the CAT information.
    You might want to open an RFE, stating exact requirements for the reporting you have in mind.  Defining what you could do with CAT entries in CARLa has been an ongoing discussion since 2005, your input is valuable.

    ------------------------------
    Rob van Hoboken
    ------------------------------


  • 3.  RE: Processing zSecure Command Verifier Audit Trail

    Posted Thu January 23, 2020 03:56 PM
    Edited by Adam Klinger Thu January 23, 2020 03:56 PM
    Thanks Rob, the above certainly helps to get the detailed information in a programmatic fashion.

    I opened related RFE 139660 on this. Being able to use CARLa to locate these fields and report on existing data in a concise fashion such as Date/Time Modified, Modifying UserID, and Attribute Modified would be very useful.

    ------------------------------
    Adam Klinger
    ------------------------------