IBM Security Z Security

 View Only
Expand all | Collapse all

zos module usage count using CARLA

  • 1.  zos module usage count using CARLA

    Posted Thu July 18, 2024 12:15 PM

    Hi All

    i have a request to find count for fetching load module in the system and last access date  ..

    can any one help to find this using CARLA code for SMF ?

    Thanks

    Mohammed Ibrahem



    ------------------------------
    Mohammed Ibrahem
    ------------------------------


  • 2.  RE: zos module usage count using CARLA

    Posted Fri July 19, 2024 05:16 AM
    Edited by Rob van Hoboken Fri July 19, 2024 05:18 AM

    Writing CARLa programs assumes there is data to report on (in SMF).  Lets see if there is any.

    You want to see if a load module is fetched.  Program manager does not log program fetch directly.  However, if there is a profile in RACF, in class PROGRAM with the name of the load module as profile key (or a filter that matches the program name) and the library stored in the member list of the profile, RACF will write ACCESS events for the program name.  The command to activate this logging would be

    RDEFINE PROGRAM yourmodule UACC(READ) AUDIT(ALL(READ)) ADDMEM('user.program.library.load')

    Note: Your security team may have concerns with adding security controls to arbitrary load module names.

    A CARLa report would look like:

    newlist type=smf
     select event=access class=program resource=yourmodule
     sortlist date(bw) time(bw) user
     summary date(max) count

    If the load module is only used in JCL as the a jobstep program, like so:

    //STEP EXEC PGM=yourmodule

    then the program name can be found in SMF type 30, subtype 3.  This could be found with

    newlist type=smf
     select type=30(5) program=yourmodule
     sortlist date(bw) time(bw) user jobname
     summary date(max) count

    This will NOT show use of your loadmodule in TSO or as dynamic subroutine of the jobstep.

    ------------------------------
    Rob van Hoboken
    ------------------------------