IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Access Monitor yearly consolidation

    Posted Wed January 04, 2023 08:19 AM
    Hi,

    Although yearly consolidation does complete, it also generates RC=8 in the CKRCARLA step (CONYEAR).
    This only occurs on subset of monthly files from the yearly scope (here only M2207).

    CKR2450 08 No CKFREEZE file found for system SYSE in file CKR@AM05 SYS923 SYSx.CONSUL.SYSPLEXA.M2207

    What would be the best approach to solve the issue here?
    Thanks.

    Bruno

    ------------------------------
    Bruno Charon
    ------------------------------


  • 2.  RE: Access Monitor yearly consolidation

    Posted Thu January 05, 2023 01:00 AM
    Hi Bruno,

    The explanation for the message is here: https://www.ibm.com/docs/en/szs/2.5.0?topic=2499-ckr2450

    If that is not helpful, can you tell me why not?

    Regards,

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------

    Original Message


  • 3.  RE: Access Monitor yearly consolidation

    Posted Thu January 05, 2023 01:35 AM
    Hi Jeroen,

    Yes, I've seen that explanation. As the manual does not mention using CKFREEZE for the consolidation process, I was wondering if the best way forward would be to include CKREEZE card into the consolidation CKRCARLA (CONVYEAR) step or not.
    I'm also wondering why it only returns that code for a subset of monthly consolidated files.
    Thanks.

    ------------------------------
    Bruno Charon
    ------------------------------

    Original Message


  • 4.  RE: Access Monitor yearly consolidation

    Posted Thu January 05, 2023 04:23 AM
    Hi Bruno,
    When the C2PJCONM sample job is executed you will see this message:

    CKR2374 00 Adding ALLOC TYPE=CKFREEZE ACTIVE

    If the job executes on the same LPAR that the access event records originated then the active CKFREEZE information (gathered from the system itself) is enough to allow processing those access event records without seeing CKR2450.

    However, if the montly/yearly consolidation process is run on a different LPAR from where the access event records originated then you have to follow the user response for message CKR2450 and either:
    1) Add an explicit allocation for a CKFREEZE from the LPAR where the access event records originated, or
    2) Code SIMULATE ACCESS_FALLBACK_DEFAULT statement to use settings from the default (current) system, if appropriate.

    The fact that you only see CKR2450 for some of the monthly files and not others could suggest that you have inadvertently consolidated access event records from SYSE into monthly consolidation files for a different LPAR.
    Regards, Mike

    ------------------------------
    Mike Riches
    ------------------------------

    Original Message


  • 5.  RE: Access Monitor yearly consolidation

    Posted Thu January 05, 2023 05:15 PM
    Thanks Mike, Jeroen and Rob for the solution but also the detailed explanations.
    I've added SIMULATE ACCESS_FALLBACK_DEFAULT in the &CPREFIX..SCKRCARL(C2PAMCON) and now got RC=0 with below message:
    CKR2451 00 Simulating system SYSE with default SYSD because no CKFREEZE file matching CKR@AM05 SYS923 SYSX.CONSUL.STGPLEXA.M2207
    Regards.

    Bruno

    ------------------------------
    Bruno Charon
    ------------------------------

    Original Message


  • 6.  RE: Access Monitor yearly consolidation

    Posted Thu January 05, 2023 04:38 AM
    Access monitor needs the CKFREEZE file to understand if the CLASS for the ACCESS event is active on the system that matches the SMF ID (in your case, SYSE), if it is part of a grouping class, and some more class details.  If there is no matching CKFREEZE, the ACCESS record is skipped (not included in the consolidation file).

    As Mike pointed out, the easiest approach is to add a SIMULATE ACCESS_FALLBACK_DEFAULT statement at the beginning of your CARLa, that will use the local class options for any system that is not explicitly specified with a CKFREEZE.

    ------------------------------
    Rob van Hoboken
    ------------------------------

    Original Message


Related Content