IBM Security Z Security

 View Only
  • 1.  SMF record type 102 with subtype / IFCid 22

    Posted Tue March 29, 2022 04:07 AM
      |   view attached
    Good Morning,

    I received a question regarding trace output of a DB2 .
    Output shows a record with IFCid 22 . (see attachment)
    Is there any opportunity to read the output field "database" marked with a red frame into a Carla field / variable ?
    Do we find it in an SMF record 102(22) at all ? 

    Best Regards
    Rüdiger


    ------------------------------
    Ruediger Lukas
    ------------------------------

    Attachment(s)



  • 2.  RE: SMF record type 102 with subtype / IFCid 22

    Posted Tue March 29, 2022 04:42 AM
    Edited by Tom Zeehandelaar Tue March 29, 2022 04:43 AM

    Hi Ruediger,

    Did you check out the paragraph that is named: Fields found only in Db2 records (SMF record types 100, 101, and 102) for newlist SMF (SMF records) in the CARLa Command Reference?
    Perhaps the supported SMF fields DB2_OBJECT and DB2_OBJECT_TYPE provide what you are looking for.

    Regards,



    ------------------------------
    Tom Zeehandelaar
    z/OS Security Enablement Specialist - zSecure developer
    IBM
    Delft
    +31643351728
    ------------------------------



  • 3.  RE: SMF record type 102 with subtype / IFCid 22

    Posted Tue March 29, 2022 04:48 AM
    Hi Tom,

    I think that for IFCid 22 the DB2_OBJECT should contain collection.package (where both can be found) and the _TYPE should be K (for "package").
    (And PROGRAM should contain the value of QW0022PG.)

    Regards,

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------



  • 4.  RE: SMF record type 102 with subtype / IFCid 22

    Posted Tue March 29, 2022 05:25 AM
    Hello Tom, Hello Jeroen,

    yes, I did .
    I inserted the field "program" in my short Carla code considering Jeroen's tip  .

    I got the following output :

    ...
    ORGOPER = CICSSTC
    PLAN = PD127
    Program = PD668
    OBject = DSNDYNAMICSQLCACHE.PD668
    OBject-typ = package
    REC Descr = DB2 DB92 CICSSTC Optimize DSNDYNAMICSQLCACHE.PD668 version 2021-01-19-13.26.27.637897 plan PD127 CORSUB
    ...

    So I'm not quite sure if PD668 is the value I'm looking for . 

    Best Regards
    Rüdiger


    ------------------------------
    Ruediger Lukas
    ------------------------------



  • 5.  RE: SMF record type 102 with subtype / IFCid 22

    IBM Champion
    Posted Tue March 29, 2022 05:29 AM
    Edited by Rob van Hoboken Tue March 29, 2022 05:32 AM
    If you have the SMF dump data set selected in ISPF, using option SE.1, you can view the CARLa fields that zSecure populates using option IN.D (information.data).  Next, select Information format 2 (Fields from selected input sets), Newlist type SMF, and in the Select field you enter type=102(22) or a combination of selections like type=102(22) record=:EC001D

    ------------------------------
    Rob van Hoboken
    ------------------------------


  • 6.  RE: SMF record type 102 with subtype / IFCid 22

    Posted Tue March 29, 2022 07:02 AM
    Hi Rob,

    thanks for the hint.
    I adjusted my program by scanning the record-string as suggested .
    I found the "EC001D" in the DB2_CONNECTION field . 
    So I can proceed now .

    Thx again, as well to Tom and Jeroen 

    Best Regards
    Rüdiger

    ------------------------------
    Ruediger Lukas
    ------------------------------