IBM Security Z Security

 View Only

 zSecure CKQRADAR

Kayhan Tanriverir's profile image
Kayhan Tanriverir posted 01/10/25 12:56 AM

Hi,

We use IBM Security zSecure CKQRADAR started task to make z/OS event data available for SIEM application SPLUNK.

We are using the SMF Exit Collection method (the zSecure SMF collector (CKQEXSMF)).

How can I find out if sending data from z/OS to SIEM without logging into SIEM?

I used to "f CKQEXSMF,display" command but there is no information about sending data to SIEM. 

Regards,

Kayhan Tanrıverir

Rob van Hoboken's profile image
Rob van Hoboken

The DEBUG BUFFER command (see here) shows how many SMF records were collected by CKQEXSMF.

The actual syslog messages are generated by the CKQRADAR task, this task also provides a CARLa log in a data set.

Kayhan Tanriverir's profile image
Kayhan Tanriverir
Hi Rob,
Thank you for your response. 
I issued the following command.
S CKQEXSMF,,,DEBUG BUFFER,DETAIL   
I expected to see a message like "... SMF messages are sent to the SIEM" 
But issued messages are also satisfied.
I got the following messages from the console and CKQEXSMF in 300 sec. as follows:
 CKQ0300I Data capture timer loop                      
 CKQ0306I Health Check completed                        
 CKQ0333I Buffer stats for buffer 07                    
 CKQ0325I Buffer stats: SMF(cnt,len)  00000003-00000954         

16.36.01 STC01049 ---- FRIDAY,    10 JAN 2025 ----                                                 

16.36.01 STC01049  IEF403I CKQEXSMF - STARTED - TIME=16.36.01                                      

16.36.01 STC01049  CKQ0103I Start option DEBUG specified                                           

16.36.01 STC01049  CKQ0701I Base ptr:  27700F80                                                    

16.36.01 STC01049  CKQ0702I 0F80: C3D2D8C5 E7E2D4C6 0000007E 00000001 *CKQEXSMF   =    *           

16.36.01 STC01049  CKQ0702I 0F90: 00120000 2CD5272E 7058C1E4 C4C9E3D9 *     N    AUDITR*           

.

.

.

16.36.01 STC01049  CKQ0154I Previous execution detected                                            

16.36.01 STC01049  CKQ0155I Reuse C2PC area at    25756000                                         

16.36.01 STC01049  CKQ0222I Start of cleanup previous execution                                    

16.36.01 STC01049  CKQ0206I Removed PC-Routine Address                                              

16.36.01 STC01049  CKQ0207I Made task swappable again                                               

16.36.01 STC01049  CKQ0226I End of cleanup previous execution                                       

16.36.01 STC01049  CKQ0701I Base ptr:  25756000                                                     

16.36.01 STC01049  CKQ0702I 6000: C3F2D7C3 F0F1F0F0 00000B64 00890000 *C2PC0100     i  *            

16.36.01 STC01049  CKQ0702I 6010: 00003F00 00000000 00000000 00000000 *                *            

.

.

.

16.36.01 STC01049  CKQ0702I 60F0: 00000000 00000000 00000000 00000000 *                *            

16.36.01 STC01049  CKQ0263I Command found is FILTER                                                 

16.36.01 STC01049  CKQ0281I Specified SMF Filter Rectype is 0                                       

16.36.01 STC01049  CKQ0505I Activated All SMF Subtypes                                     

16.36.01 STC01049  CKQ0263I Command found is FILTER                                        

16.36.01 STC01049  CKQ0281I Specified SMF Filter Rectype is 7                              

16.36.01 STC01049  CKQ0505I Activated All SMF Subtypes                                     

16.36.01 STC01049  CKQ0263I Command found is FILTER     

16.36.01 STC01049  CKQ0281I Specified SMF Filter Rectype is 9                              

16.36.01 STC01049  CKQ0505I Activated All SMF Subtypes                                     

16.36.01 STC01049  CKQ0263I Command found is FILTER                                        

16.36.01 STC01049  CKQ0281I Specified SMF Filter Rectype is 11                             

16.36.01 STC01049  CKQ0505I Activated All SMF Subtypes                                     

16.36.01 STC01049  CKQ0263I Command found is FILTER                                        

16.36.01 STC01049  CKQ0281I Specified SMF Filter Rectype is 14                             

16.36.01 STC01049  CKQ0505I Activated All SMF Subtypes                                     

16.36.01 STC01049  CKQ0263I Command found is FILTER   

16.36.01 STC01049  CKQ0279I Specified reporting interval is (sec) 0300      

16.36.01 STC01049  CKQ0267I No command found (? or /*)                      
16.36.01 STC01049  CKQ0267I No command found (? or /*)                      
16.36.01 STC01049  CKQ0267I No command found (? or /*)                       
16.36.01 STC01049  CKQ0701I Base ptr:  00890F00                                            
16.36.01 STC01049  CKQ0702I 0F00: C3F2D76D D7C36DC3 D7D6D6D3 40404040 *C2P_PC_CPOOL    *  
16.36.01 STC01049  CKQ0702I 0F10: 40404040 40404040 00000000 00890F28 *             i  *  
16.36.01 STC01049  CKQ0164I TRANSWAP done                                                  
16.36.01 STC01049  CKQ0167I Found existing LX                                              
16.36.01 STC01049  CKQ0168I LX was 3F00                                                    
16.36.01 STC01049  CKQ0169I Need a new ET                                                  
16.36.01 STC01049  CKQ0170I Obtained ET 7FF75050                                          
16.36.01 STC01049  CKQ0481I Identified ISP modules as BR14 at location 00041AAE            
16.36.01 STC01049  CKQ0176I Loaded CKRCARLA routine at location A770C030                  
16.36.01 STC01049  CKQ0119I Loaded C2PIORTN routine at location A7701000                  
16.36.01 STC01049  CKQ0470I Successful attach SMF Capture task                            
16.36.01 STC01049  CKQ0136I Successful attach data processing MGR                          
16.36.01 STC01049  CKQ0178I zSecure SMF collector 2.5.0 initialization successful          
16.36.01 STC01049  CKQ0901W zSecure SMF collector was inactive since 2025-01-10 16:34:49  
16.36.01 STC01049  CKQ0331I Successful attach data capture task                            
16.36.01 STC01049  CKQ0306I Health Check completed     
.
.
16.41.01 STC01049  CKQ0300I Data capture timer loop                        
16.41.01 STC01049  CKQ0306I Health Check completed                          
16.41.01 STC01049  CKQ0333I Buffer stats for buffer 01                      
16.41.01 STC01049  CKQ0325I Buffer stats: SMF(cnt,len)  00000043-00022077  
16.46.01 STC01049  CKQ0300I Data capture timer loop                        
16.46.01 STC01049  CKQ0306I Health Check completed                          
16.46.01 STC01049  CKQ0333I Buffer stats for buffer 02                      
16.46.01 STC01049  CKQ0325I Buffer stats: SMF(cnt,len)  00000080-00112827   
17.01.01 STC01049  CKQ0300I Data capture timer loop                                
17.01.01 STC01049  CKQ0306I Health Check completed                                  
17.01.01 STC01049  CKQ0333I Buffer stats for buffer 05                              
17.01.01 STC01049  CKQ0325I Buffer stats: SMF(cnt,len)  00000090-00115327                                                                                    
                                   

iyi çalışmalar, saygılar / Regards

________________________________________________

Kayhan TANRIVERİR
Senior Systems Programmer & Consultant

VBT Yazılım A.Ş

www.vbt.com.tr   
 
 

Rob van Hoboken's profile image
Rob van Hoboken

According to the documentation, the command would be DEBUG BUFFER(DETAIL), no commas.

You may want to check the FILTER commands in you configuration member, the ones you listed in the joblog seem to be pretty restrictive.

Did you find any messages in the CARLa log (SYSPRINT) data set from CKQRADAR?

Kayhan Tanriverir's profile image
Kayhan Tanriverir

Hi Rob,

I found the following messages in CKQRADAR. 

Yes, I expected messages were those messages. Thank you very much again.

Regards,

Kayhan Tanrıverir

CKR2103 00 Activity report interval ended at 13 Jan 2025 13:09:31.916211 cpu 0.669294     
           Processed 3,164 SMF records                                                    
           Sent 1,141,384 bytes in 3,089 messages to UDP port 514 of 10.11.87.70          
                                                                                          
CKR2103 00 Activity report interval ended at 13 Jan 2025 13:19:29.494531 cpu 0.126858     
           Processed 2,465 SMF records                                                    
           Sent 877,775 bytes in 2,399 messages to UDP port 514 of 10.11.87.70            
                                                                                          
CKR2103 00 Activity report interval ended at 13 Jan 2025 13:29:28.136733 cpu 0.236728     
           Processed 5,699 SMF records                                                    
           Sent 2,159,265 bytes in 5,658 messages to UDP port 514 of 10.11.87.70          
                                                                                          
CKR2103 00 Activity report interval ended at 13 Jan 2025 13:39:33.752405 cpu 0.201544     
           Processed 4,122 SMF records                                                    
           Sent 1,496,845 bytes in 3,999 messages to UDP port 514 of 10.11.87.70          
                                                                                          
CKR2103 00 Activity report interval ended at 13 Jan 2025 13:50:01.409345 cpu 0.206139     
           Processed 5,516 SMF records                                                    
           Sent 2,081,490 bytes in 5,447 messages to UDP port 514 of 10.11.87.70