Using Reports › Understanding the ACFRPTRV Report › Why Do You Need this Information? › Violation Records

Violation Records

ACFRPTRV automatically reports all SMF records for access attempts that violate a rule or where no rule exists. It lets you identify unauthorized users to determine whether they should have access and to take corrective action if needed. For example, it creates an SMF record when a user attempts to use a resource that he is not authorized to use.

Note: CA ACF2 Option for DB2 validates accesses whenever DB2 validates them. In some cases, DB2 processing causes CA ACF2 Option for DB2 to report some unusual violations, such as:

• For some commands (START DDF, CANCEL DDF THREAD, and STOP DDF), DB2 requires the user to hold only the SYSADM or SYSOPR authority to use the command. CA ACF2 Option for DB2 uses the SYSADM and SYSOPR rule sets to perform the validation. If a violation occurs, CA ACF2 Option for DB2 creates the SMF record against the SYSOPR rule set. See the Logging Records section for other information applicable to violation records.
• During view creation, CA ACF2 Option for DB2 checks whether the view creator can change the view rule set through %CHANGE, %RCHANGE, SECURITY, or scoped SECURITY privileges. If any of these privileges are granted on the view but not on the base tables or views, CA ACF2 Option for DB2 generates an ADM violation against the table and prevents the view’s creation. This validation ensures that a user who creates a view of a table does not have more authority over the view than he has over the table.

  If the creator’s view privileges are not greater than his table privileges, CA ACF2 Option for DB2 performs additional checks. These checks determine whether the view creator’s primary and secondary IDs can insert, update, or delete from the view and the table on which the view is being created. If any of the IDs can insert, update, or delete from the view but not from the base table, CA ACF2 Option for DB2 logs a violation against the table for each of the privileges not possessed and prevents the view’s creation.

See the next section, Logging Records for other information applicable to violation records.