IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Order of event processing in zSecure Alert

    Posted Thu January 30, 2025 05:05 AM

    I have observed that events are not necessarily processed by zSecure Alert in the order in which they occur.  Is this expected behaviour?

    Thanks

    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------


  • 2.  RE: Order of event processing in zSecure Alert

    Posted Thu January 30, 2025 10:32 AM

    Hi lennie,

    yes that is correct. For each individual alert/destination there is a small CARLa query. These are generated in the order of the alert number into the REPORT member. So at the end of an interval all SMF records/WTO's etc are procesed in that order. So you might get for example a 1102 from a later moment before a 1103 that happened earlier.

    hope this helps

    cheers

    rene

     



    ------------------------------
    RENE van TIL
    ------------------------------



  • 3.  RE: Order of event processing in zSecure Alert

    Posted Fri January 31, 2025 03:05 AM

    Technically speaking, the SMF records are processed in the order they have in the RECENT buffer, WTO records in the order they have in the corresponding buffer. These buffers are desinged to be time-ordered.

    Output is generated in the order of the CARLa NEWLIST blocks, with SMF records within each CARLa block hopefully in time order.  Provided, of course, that the SORTLIST command includes the DATETIME value at the beginning of the fields list and not preceded by another field like USERID.



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 4.  RE: Order of event processing in zSecure Alert

    Posted Mon February 03, 2025 05:59 AM

    Many thanks Rene and Rob.

    Lennie



    ------------------------------
    Lennie Dymoke-Bradshaw
    ------------------------------