Creating reports for a specific day in the "RACF exception report" (ev;1;1) if SMF data sets are archived on a daily basis
Resolving the problem
It is possible, but not by the zSecure ISPF interface.
You can accomplish this by:
Allocating only the SMF data set of the day that you want to generate a report for, if daily SMF files are available.
If not, adjust the CARLa code of the Exceptions report by:
1. Running the EV.1.1 report, to produce the applicable exception reports;
2. Leave the output using F3 and enter command "result" in the command line and press <enter>;
This brings up the zSecure Results panel. Work data set COMMANDS should be highlighted, and contain the CARLa code that produces all exception reports;
3. Specify 'E' (for Edit file) on the COMMANDS work data set,
4. Enter the desired date you want to report about as e.g. "date=18apr2012" on all SELECT statements. Please note that the bottom 12 Newlists are only applicable for ACF2 systems and can therefore be removed (unless ACF2 reports are desired)..
5. Tailor the input SMF data set(s) selection by going to SETUP FILES (SE.1) to select those relevant to the date(s) desired.
6. When finished adding the desired date in the applicable select statements, you can run the adjusted reports by entering "go" or "run" in the command line. The reports should now only contain events from 18apr2012!
7. If you want to submit this as a batch job enter "sub" or "submit" to run it in the background.
8. If you want to use this adjusted version of the exception report in the future, you may save the CARLa code in your own CARLa library. If you have allocated your own CARLa sample library in option Commands > Libraries (CO.1) enter the command CREATE followed by the desired member name eg CREATE EXCEPTNS with the desired program lines marked with the block copy (CC) line commands to save the CARLa code as the member EXCEPTNS in your CARLa sample library. For subsequent executions you only need to change the reporting date before running it. Keep in mind that the appropriate SMF input data set must be selected for input (either via the CARLa ALLOC statements or JCL).
Also, note that you can use the special date keywords to select relative dates without editing the date selection SELECTs, for example: TODAY, TODAY-7, etc. This can be especially useful on regularly scheduled, periodic reports. Depending upon your SMF archival scheme, this also lends itself well to the use of relative GDG numbers on the data set names.
|Security||IBM Security zSecure Audit for ACF2||z/OS||1.13.0, 1.13.1, 1.12, 2.1, 1.11||Enterprise|