IBM Security Z Security

Hello - I need to define my own value and substr into eventdesc to show only the 'invalid password' and it is not working. I do not want the whole eventdesc. For example: Racinit (Failure:Invalid password)  

Substr recorddesc works but due to the variable length of a userID, i can not get to "invalid password" that way. 

Am i doing something wrong with SUBSTR / eventdesc ?  Or, maybe better, is there a way to equate qual 1 to "invalid password" and so on for any other qualifier with carla code ?

thanks !

------------------------------
Joseph Sumi
------------------------------

The EVENTQUAL field contains the numerical event qualifier, but it is only available for output processing, so not for SELECT.

I suppose you could print this value and replace it with your favorite text string in another (post-processing) jobstep.

You could split up the SMF record processing in as many separate newlists as you want different event qualifier strings, using the EVENT field for selection:

newlist type=smf name=r80_1_1
  select event=RACINIT(1)
  sortlist ........ "Invalid password"
newlist type=smf name=r80_1_2
  select event=RACINIT(2)
  sortlist ........ "not in group"
newlist type=smf name=r80_1_rest
  select event=RACINIT
  exclude likelist=R80_1_1 or R80_1_2
  sortlist .... eventdesc

Even write MERGELIST/ENDMERGE around these separate newlists to get the output in sorted order.

You may experiment with using a deftype lookup based on EVENTQUAL, though be mindful that this is a binary field, so the key part of your external file also needs the binary representation of the eventqual number.

You can also experiment with (not at all sure it would be allowed):

define qual_explained as parse(eventdesc,":")  

------------------------------
Rob van Hoboken
------------------------------

Hi Joe, Rob,

First of all, I want to point out that we document for EVENTDESC that the contents is subject to change, so I am not fond of recommending parsing of the contents.
The solution where you select on EVENT(EVENTQUAL) and then use your own string and MERGELIST, seems better to me.

The DEFINE .. PARSE in TYPE=SMF results in a CKR0467 syntax error, that this is not allowed with the EventDesc format.
So if you want to do that, you need to do it in a post-processing pass where you read it in as a string (ASIS) from a DEFTYPE file.

But indeed, something like WORD(PARSE(eventdesc,':'),')') might extract the part you want.

Internally EVENTQUAL is a binary field, but if you put the field on SORTLIST, you get a decimal number rendered in EBCDIC, not a binary one, on output.

Regards,

------------------------------
Jeroen Tiggelman
IBM - Software Development Manager IBM Security zSecure Suite
Delft
------------------------------

Original Message:
Sent: Fri June 07, 2024 02:58 AM
From: Rob van Hoboken
Subject: substr - eventdesc not working

The EVENTQUAL field contains the numerical event qualifier, but it is only available for output processing, so not for SELECT.

I suppose you could print this value and replace it with your favorite text string in another (post-processing) jobstep.

You could split up the SMF record processing in as many separate newlists as you want different event qualifier strings, using the EVENT field for selection:

newlist type=smf name=r80_1_1
  select event=RACINIT(1)
  sortlist ........ "Invalid password"
newlist type=smf name=r80_1_2
  select event=RACINIT(2)
  sortlist ........ "not in group"
newlist type=smf name=r80_1_rest
  select event=RACINIT
  exclude likelist=R80_1_1 or R80_1_2
  sortlist .... eventdesc

Even write MERGELIST/ENDMERGE around these separate newlists to get the output in sorted order.

You may experiment with using a deftype lookup based on EVENTQUAL, though be mindful that this is a binary field, so the key part of your external file also needs the binary representation of the eventqual number.

You can also experiment with (not at all sure it would be allowed):

define qual_explained as parse(eventdesc,":")  

------------------------------
Rob van Hoboken
------------------------------

If you want to do a lookup based on the EVENTQUAL, you cannot use the EBCDIC value, can you?  So how would you construct a

sortlist .... eventqual:$mapfile.$qual.$desc 

most efficiently?  Wasn't there some kind of specification to do a lookup with a non-printable  base value?

------------------------------
Rob van Hoboken
------------------------------

I don't recommend doing a lookup from anything other than a character field, although you might get it to work here.

I would do a lookup from, say, " 8" in a DEFTYPE input file to another file that would map that to a description.

Regards,

------------------------------
Jeroen Tiggelman
IBM - Software Development Manager IBM Security zSecure Suite
Delft
------------------------------

Original Message:
Sent: Fri June 07, 2024 04:16 AM
From: Rob van Hoboken
Subject: substr - eventdesc not working

You may experiment with using a deftype lookup based on EVENTQUAL, though be mindful that this is a binary field, so the key part of your external file also needs the binary representation of the eventqual number.

Internally EVENTQUAL is a binary field, but if you put the field on SORTLIST, you get a decimal number rendered in EBCDIC, not a binary one, on output.

If you want to do a lookup based on the EVENTQUAL, you cannot use the EBCDIC value, can you?  So how would you construct a

sortlist .... eventqual:$mapfile.$qual.$desc 

most efficiently?  Wasn't there some kind of specification to do a lookup with a non-printable  base value?

------------------------------
Rob van Hoboken
------------------------------