zSecure Audit Reporting Invalid Dates from CICS SMF110 Records
While reporting on CICS SMF110 records using zSecure Audit, the dates reported are varied and not current (years earlier or later than present time), and data reported looks a bit off. The data is recognizable in many cases, but clearly not correct.
Data is recognizable, but not correct.
CICS monitor records (SMF110) come in two formats, compressed and uncompressed. The format is controlled by an option within CICS. The compression is a simple run length encoding (RLE) which is why the records still look normal and "almost correct".
CICS with the compression of monitor SMF records enabled.
Resolving the problem
You will need to change the CICS SMF compression parameter and request that the records be written without compression.
NOTE: Support for compressed records has been added in zSecure beginning with version 2.1.1. This enables the use of compressed CICS monitor records for zSecure versions 2.1.1 and higher. The requirement to use uncompressed CICS SMF records applies to versions of zSecure prior to 2.1.1.
More support for:
IBM Security zSecure Audit for RACF
Software version: 1.13.0, 1.13.1, 2.1
Operating system(s): z/OS
Software edition: Enterprise
Reference #: 1512412
Modified date: 19 December 2015