IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

  • 1.  RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/01/26 01:15 PM
    Edited by Luis Tapia 09/01/26 01:18 PM

    Hi,

    Could anyone please explain why the IXGLOGR account does not display the LAST_CONNECT_DATE value in zSecure?

    Thank you in advance for your assistance.

    Best Regards

    Luis Tapia



    ------------------------------
    Luis Tapia
    ------------------------------



  • 2.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/01/26 02:30 PM

    Hi Luis,

    I am not sure about your installation or the role that particular user ID has there, but this is the general documentation for LAST_CONNECT_DATE:
    https://www.ibm.com/docs/en/szs/3.2.0?topic=profiles-racf-field-descriptions#select_list_fields_racf_field_descs__LAST_CONNECT_DATE

    Does that help? If not, can you tell me why the result is unexpected?

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development Manager IBM zSecure
    Delft
    ------------------------------



  • 3.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/01/26 07:26 PM
    Hello Jeroen,
     
    In our environment, this account is associated with the z/OS System Logger address space. Since it is a critical address space, we would expect it to be active on a daily basis. Therefore, shouldn't its LAST-CONNECT-DATE reflect the current date or at least show recent activity?

    Thank you in advance for your assistance.

    Best Regards

    Luis Tapia



    ------------------------------
    Luis Tapia
    ------------------------------



  • 4.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE
    Best Answer

    Posted 09/02/26 03:23 AM

    Hi Luis

    The system logger is a system task that gets started at IPL before RACF is around.  So it does not get a user ID assigned, unless somehow (ouch) you have to issue a manual restart later on in the game.  This is further illustrated when you go to SDSF DA display, the OWNER column (with the RACF user ID) is not filled in for those system tasks.

    So, no RACINIT, no update of last use date on the USER profile or its connect group.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 5.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/02/26 10:59 AM
    Hello Rob,
    Thank you for your response. Your explanation regarding the reason why these types of accounts do not produce RACINIT records and consequently do not show a last usage date was very clear.
    Best Regards


    ------------------------------
    Luis Tapia
    ------------------------------



  • 6.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/03/26 10:33 AM

    Hi Rob,

    In addition to reviewing the STARTED class profiles (which did not help me identify the IXGLOGR account), how can I obtain information about users that are assigned to z/OS operating system address spaces (similar to IXGLOGR)?

    Thank you in advance

    Best Regards



    ------------------------------
    Luis Tapia
    ------------------------------



  • 7.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/03/26 10:22 PM

    Hi Luis,

    I was thinking along the lines of what Rob wrote. Until I looked at the IXGLOGR userid across our 7 LPARs.

    The userid does have a last connect and a last use populated with the date and time within the IPL window for the LPAR, see below. I did find an SMF Type 30 record for IXGLOGR in the IPL window with a time of approximately 0.1 of a second after the last connect/use time. I noted the owner for IXGLOGR STC on the SDSF DA panel is blank.

     I suspect how / when IXGLOGR is started during the IPL window may have a bearing on the fields being populated or not. For the STARTED profile IXGLOGR.* the only fields are, the userid (IXGLOGR) and TRUSTED is YES.

    Regards

     



    ------------------------------
    Brian Mills
    ------------------------------



  • 8.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/04/26 09:59 AM

    Hi Brian, 

    Thanks for your comments. I confirmed what Rob mentioned and saw in the SDSF DA panel that the IXGLOGR job starts before RACF. On the other hand, in our installation, the IXGLOGR.* profile in the STARTED class has a different account associated with it in the STDATA.

    Best Regards



    ------------------------------
    Luis Tapia
    ------------------------------



  • 9.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/05/26 05:08 PM

    Hi Rob,

    Can I use zSecure Admin or zSecure Audit to identify which users are associated with these types of address spaces that are started before RACF?


    Best Regards



    ------------------------------
    Luis Tapia
    ------------------------------



  • 10.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/06/26 07:14 AM

    Hi Luis,

    Something like this?

    /* List address spaces with a last connect date before the last IPL date */
    newlist type=report_stc
     select userid:last_connect_date<<:system.ipldate
     sortlist procname(nd) complex :system.sysname,
              procname userid userid:last_connect_date :system.ipldate


    ------------------------------
    Ronald van der Laan
    ------------------------------



  • 11.  RE: RACF ACCOUNT NOT DISPLAY A LAST_CONNECT VALUE IN ZSECURE

    Posted 09/09/26 03:46 PM

    Hi Ronald,

    Thank you very much for your support. The information you shared helped me better understand the relationship between the procedures and the STARTED class profiles defined in RACF.
     
    However, I was also expecting to find information about the accounts associated with the started tasks that run during the IPL before RACF initialization.
     
    Thank you again for your time and collaboration.
    Best Regards



    ------------------------------
    Luis Tapia
    ------------------------------