IBM Security Z Security

Hi Joe,

Alert 1115 uses the averaging interval to calculate the number of alerts for each user; if the number of access failures in the current interval plus the averaging interval exceeds the threshold, you get an alert for the violations it collected so far.  If subsequent violations happen, while the averaging buffer still holds more than the threshold, no new alert is issued.  This was designed to prevent several alerts for one user that has a longer streak of violations occurring, and potentially printing the (older) SMF records twice.  We felt that one alert indicating the excessive number was enough.

In a very busy system, you might not see an alert from the averaging functionality when the number of buffers is insufficient to hold all selected SMF records for the length of the averaging interval.  When there are not enough buffers for the current interval, the collection task will overwrite (older) averaging buffers to use as current buffer.  This was designed to process recent SMF records in preference over averaging functionality.  When this occurs, you need to increase the number of buffers.

Hi Joseph, 

that way that I understand the working of Alert 1115 is that it is equipped with a configurable threshold that you can use to instruct Alert how many violations your installation considers "too many". Once, you have configured this threshold, Alert 1115 is only triggered once when a user exceeds this customized threshold within the configured "Average setting" for your alert set. By default, average is set to 5 minutes (300 seconds). You can use action command B, for browse on your active Alert set to verify the 'Average' settings on your implementation. 
The goal of this alert is to trigger the 1115 alert everytime a user exceeds the configured violation threshold in 5 minutes . 

The result that you describe tells me that the involved user exceeded the configured violation threshold 22 times. Did you expect the get an alert for each of the 1000+ violations instead?

I hope this helps.