Running the Report Manually and Using ACFRPTS

Running the Resource Event Log (RV) › Running the Report Manually and Using ACFRPTS

Running the Report Manually and Using ACFRPTS

This report uses the standard SYSPRINT, SYSIN, and RECxxxxx files. See the Common Files section in the “The Report” chapter for information about these files.

See the Running the Reports section in the “The Report” chapter for information about running the Resource Event Log manually.

Follow the instructions listed in the Running the CA ACF2 for z/VM Report Using the ACFRPTS EXEC section in the “The Report” chapter to use the ACFRPTS utility to run the Resource Event Log. Select the RV option.

Manual and ACFRPTS Parameters

Listed below are the parameters and their defaults used to generate the RV report manually and using ACFPRTS.

ALL|VIOLATIO|LOGGING|TRACE

These parameters specify which type of SMF record you want to process. You can specify one or more of these parameterss. If you do not specify any parameter, the default is ALL. These parameters act in an inclusive OR fashion. For example, if you specify VIOLATIO and TRACE, the report includes all violation and trace records.

ALL

Requests processing of all types of journal information.

VIOLATIO

Requests all accesses that violated resource rules.

LOGGING

Requests processing of records produced for accesses that were allowed, but the resource rule specified LOG. Loggings also occur when a security officer (SECURITY), non‑cancelable (NON‑CNCL), or read‑only (READALL) logonid issues a request that would normally be prevented.

TRACE

Requests processing of records produced as a result of the TRACE attribute in the logonid record. If the access was logged or was a violation, TRACE requests can have more than one SMF record written.

CLASS(R|class)

Specifies the one‑character storage class code of the infostorage record to process. The default is R (for resource rule sets). The storage class code for CA ACF2 for z/VM Security Option for DB2 rule sets is D. Class D processes CA ACF2 for z/VM Security Option for DB2 resource event SMF records from an OS/390 system. CA ACF2 for z/VM does not support DB2. See the Administrator Guide for more information.

EDATE(169365|cyyddd)

This parameter specifies the Julian date you are using as an ending point for selecting information.

0 to indicate the 20th century

to indicate the 21st century

The year

ddd

The day of the year

When combined with the SDATE parameter, this parameter creates a window for report content. The defaults for SDATE and EDATE causes the report generator to process all available records. The default is 169365, December 31, 2069.

ETIME(2359|hhmm)

This parameter specifies the end of the time interval for selecting SMF records. This time is based on a 24‑hour clock. Any SMF records generated after the specified time of day are ignored. The default is 2359.

HEX

This parameter prints selected SMF records in hexadecimal dump format. This option is provided primarily for diagnostic purposes. If a report generates a hex dump of an SMF record, the dumped record shows a four‑byte RDW (two bytes for the record length, followed by two bytes of binary zeros). This is true even when the input file does not have a RDW. This is the internal format of every SMF record that matches the SMF mapping macros. It provides a consistent format for the dump. This information applies to records dumped due to an error in the SMF record and when you specify HEX.

ID(—|idmask)

This parameter specifies the mask (up to 40 characters) to select records with a resource name that matches the mask. The default is dash (—), implying all resource names match.

JOBMASK(********|jobmask,...,jobmask)

This parameter specifies the job name to limit records appearing on this report to those pertaining to the job or jobs indicated by the job name or job name mask. You must use commas or blanks to separate multiple job names. The default is all jobs. In VM, this is equal to the virtual machine user ID.

LINECNT(60|nnn)

This parameter specifies the number of output lines printed on a page. CA ACF2 for z/VM report generators that issue multiple line reports check whether a complete report item will fit on a page to prevent splitting the information. Only the physical constraints of the output media you are using limits the maximum number of output lines per page. The default is 60.

MASK(—|lidmask)

This parameter specifies a logonid mask to select records with logonids that match the mask. The default is all logonids.

SDATE(000000|cyyddd)

This parameter specifies the Julian date you are using as a starting point for selecting information.

c: 0 to indicate the 20th century
1: to indicate the 21st century
yy: The year
ddd: The day of the year

The report generator ignores any input SMF records generated before the SDATE value. The default is 000000.

SUMMARY|DETAIL

Specifies the format of the ACFRPTRV report. The SUMMARY parameter produces information about each resource access request that results in a logging, violation, or trace record. All users should specify SUMMARY except those who want to see additional lines of information related to CA ACF2 for z/VM Security Option for DB2. The DETAIL parameter provides original, primary, and secondary authorization IDs for DB2 users. You should set the CLASS parameter to D. The SUMMARY|DETAIL parameters are provided for processing SMF records from an OS/390 system. CA ACF2 for z/VM does not support DB2.

See the Administrator Guide for more information.

SELECT(smfval|nnn,...,nnn)|NOSELECT

This parameter defines the SMF record number CA ACF2 for z/VM uses. Generally, this parameter is not necessary because the default SMF numbers are usually correct. The SMF record numbers required for a report are the combined SMF record number for every system that produced the SMF data and the precombined SMF record numbers for the CA ACF2 for z/VM SMF record type the report generator processes. Do not specify precombined SMF record numbers for CA ACF2 for z/VM SMF record types that this report does not process.

If this parameter enters any SMF record number, the report generator only processes those SMF records. It does not use the defaults.

Default SMF numbers are determined in the following manner:

If CA ACF2 for z/VM is active or if this is a NOAUTO IPL and you are the NOAUTO UPDATE user, it uses the SMF record numbers specified by the @SMF macro in the ACFFDR. If a precombined SMF record number is specified as zero, then the report generator uses the precombined default. The ACF2 parameter of the @SMF macro in the ACFFDR defines the combined format SMF record number.
If this is a NOAUTO IPL and you are not the NOAUTO UPDATE user, it uses the combined SMF number default of 230. For precombined SMF records, it uses the precombined SMF number default. See the @SMF macro of the ACFFDR in the Installation Guide for these values.

If you are processing OS/390 SMF data and use the default SMF record numbers for other types of SMF records on the OS/390 system, you must specify the correct SMF number in this parameter.

When processing CA ACF2 for z/VM SMF data on VM, you must specify this parameter if you are running reports during a NOAUTO IPL and you are not the NOAUTO UPDATE user and the SMF record numbers are not the same as the defaults. You also need to specify this parameter if the @SMF macro in the ACFFDR specifies incorrect SMF record numbers.

STIME(0000|hhmm)

This parameter specifies the beginning of the time interval for selecting SMF records. This time is based on a 24‑hour clock. Any SMF records generated before the specified time of day are ignored. The record selection begins at the STIME specified for each date in the SDATE/EDATE range and ends on each date at the ETIME you specified. The default is 0000.

SYSID(********|sysid)

This parameter specifies the CA ACF2 for z/VM system ID that was active on the system when the SMF records were generated. You can specify a single system ID or a system ID mask. You cannot specify multiple masks or a series of IDs. The default is all systems.

TERMINAL|PRINTER

The TERMINAL parameter (the default) is designed to fit a limited width display terminal. PRINTER produces a second format, designed for output to a 133‑column line printer.

TITLE(cmdparm|string)

This parameter specifies a character string that is added to the other title information at the top of the report. This character string can be up to 35 characters long. If you do not specify this parameter, the report generator uses the first 35 characters in the command parameters. If this character string is longer than 35 characters, it uses the first 35 characters. If you use ACFRPTS or the full‑screen feature, you cannot specify command parameters.

TYPE(—|typemask)

This parameter specifies a mask to select records for resources stored under the matching type code. Below is a list of predefined resource types. You can also define resource types locally.

ACT

For account resource rules

ALG

For resource rules that control the AUTOLOG command

DIA

For resource rules that control the DIAL command

GRP

For resource rules that control logging onto group machines

IUC: For resource rules that control the Inter User Communications Vehicle (IUCV)

VMC

For resource rules that control the Virtual Machine Communications Facility (VMCF).

UID(—|uidmask)

This parameter specifies the UID mask the report pertains to. Dash (—) is the default, reporting on all UIDs.