IBM Support

zSecure Audit Reporting Invalid Dates from CICS SMF110 Records

Troubleshooting


Problem

While reporting on CICS SMF110 records using zSecure Audit, the dates reported are varied and not current (years earlier or later than present time), and data reported looks a bit off. The data is recognizable in many cases, but clearly not correct.

Symptom

Data is recognizable, but not correct.

Cause

CICS monitor records (SMF110) come in two formats, compressed and uncompressed. The format is controlled by an option within CICS. The compression is a simple run length encoding (RLE) which is why the records still look normal and "almost correct".

Environment

CICS with the compression of monitor SMF records enabled.

Resolving The Problem

You will need to change the CICS SMF compression parameter and request that the records be written without compression.

NOTE: Support for compressed records has been added in zSecure beginning with version 2.1.1. This enables the use of compressed CICS monitor records for zSecure versions 2.1.1 and higher. The requirement to use uncompressed CICS SMF records applies to versions of zSecure prior to 2.1.1.

[{"Product":{"code":"SSRQ8D","label":"IBM Security zSecure Audit for RACF"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"PF035","label":"z\/OS"}],"Version":"2.1","Edition":"Enterprise","Line of Business":{"code":"","label":""}}]

Document Information

Modified date:
16 June 2018

UID

swg21512412