IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Z/OS Record Empty Sessions

    Posted 01/28/21 05:15 PM
    Good afternoon,
    I have a problem recording sessions on Guardium for Z/OS.
    Costumer want to capture sessions that are not associated with an SQL on DB2.

    I configure the inspection engines checking the "record empty session" box, what should solve the problem. But it still not working, when they use "db2 connect" to stablish the communication and then "db2 connection reset" to logout, the event is not recorded by the STAP.
    Is there a way to record this kind of sessions?

    Thank you, Regards


    ------------------------------
    Daniel Moreno Gonzalez1
    ------------------------------


  • 2.  RE: Z/OS Record Empty Sessions

    Posted 01/29/21 11:15 AM
    Hi Daniel,

    Which report(s) are you checking? Have you checked the 'Sessions List', 'Detailed Sessions List' reports? These would be the session records captured regardless of the policy rules... 

    I hope that helps.

    Thanks again!
    -Felipe

    ------------------------------
    Felipe Boff
    ------------------------------



  • 3.  RE: Z/OS Record Empty Sessions

    Posted 02/03/21 01:56 PM
    Hi Daniel,

    Empty DB2 z/OS sessions are also recorded by Guardium collector, you need to make sure that the Z/OS AUDIT action rule in the installed policy is being triggered by the db session you're opening/closing in db. You might need to check the conditions to trigger the rule. And this can be seen in "Detailed Sessions" report as stated previously by Felipe Boff

    ------------------------------
    Helio Yuji Shimojo
    ------------------------------