Sample Report

Running Customized Reports › Sample Report

Sample Report

CA ACF2 for z/VM SECURITY - ACFRPTPP - SMF RECORD PREPROCESSOR - PAGE 1 DATE 09/09/98 (98.253) TIME 11.39 *-- RECORD SELECTION SUMMARY - BY DDNAME --* DDNAME DESCRIPTION COUNT SELECTION SMFAR RULES DB LOG 01 223-R,230-* SMFCR COMMAND TRACE 00 225-T,230-* SMFDR1 DATA SET LOGS 3,597 221-D,230-* SMFDR2 DATA SET VIOS 165 221-D,230-* SMFDR3 DATA SET TRACE 442 221-D,230-* SMFDR4 PGMNAME LOG/VIO 59 221-D,230-* SMFER INFO-STG DB LOG 07 226-E,230-* SMFJR LOGONID DB LOG 609 222-L,230-* SMFNR ACF2 ENVIRONMENT 227 A,G,00,07,230-* SMFPR SYSTEM ENTRY VIO 26 220-P,230-* SMFTR RESTRICTED LIDS 13 224-J,230-* SMFVR RESOURCE LOG/VIO 32 227-V,230-* SMFGF GF FILE OPTION 3,631 221-D,220-P,227-V,230-* SMFFLT SMF FLAT FILE 4,911 221-D,220-P,227-V,223-R,222-L,23 * - INDICATES + ACF2 COMBINED SMF NUMBER --- TOTAL RECORDS PROCESSED --- READ=59,683 SELECTED=5,138 WRITTEN=13,700

 CA ACF2 for z/VM SECURITY - ACFRPTPP - SMF RECORD PREPROCESSOR - PAGE 2
 DATE 09/09/98 (98.253) TIME 11.39
 
                 *-- SMF RECORDS INPUT SUMMARY - BY DDNAME --*
 
          [---------- STARTING ----------] [----------- ENDING -----------]
 
 
 DDNAME   [---PHYSICAL---]&lb.---LOGICAL----][---PHYSICAL---][---LOGICAL---]
 
 
             DATE    TIME    DATE    TIME      DATE    TIME    DATE TIME       COUNT
 
 RECMAN1   09/08/98 22.49  09/08/98 22.49    09/09/98 22.43  09/09/98 22.43      59,683

CA ACF2 for z/VM SECURITY - ACFRPTPP - SMF RECORD PREPROCESSOR - PAGE 3 DATE 09/09/98 (98.253) TIME 11.39 *-- SMF RECORDS INPUT SUMMARY - BY TYPE --* --0-- --1-- --2-- --3-- --4-- --5-- --6-- --7-- --8-- --9-- 0- 6 0 4 4 1940 826 324 0 6 7 10- 6 8 0 0 15527 10348 0 991 7 247 20- 1160 68 6 58 0 0 1408 0 0 0 30- 4316 0 192 0 194 194 0 0 0 0 40- 12115 0 0 6 0 2 0 27 15 0 50- 0 0 0 0 0 5 0 114 3 0 60- 120 25 0 0 0 0 0 0 0 0 70- 171 171 1710 171 225 1368 0 171 0 0 80- 0 0 0 0 0 0 0 0 0 0 90- 15 0 0 0 0 0 0 0 0 0 100- 0 0 0 0 0 0 0 0 0 0 110- 0 0 0 0 0 0 0 0 0 0 120- 0 0 0 0 0 0 0 0 0 0 130- 0 0 0 0 0 0 0 0 0 0 140- 0 0 0 0 0 0 0 0 0 0 150- 0 0 0 0 0 0 0 0 0 0 160- 0 0 0 0 0 0 0 0 0 0 170- 0 0 0 0 0 0 0 0 0 0 180- 0 0 0 0 0 0 0 0 0 0 190- 0 0 0 0 0 0 0 0 0 0 200- 0 0 0 0 0 0 0 0 0 0 210- 270 0 0 0 0 0 0 0 0 0 220- 0 0 0 0 0 0 0 0 0 0 230- 5132 0 0 0 0 0 0 0 0 0 240- 0 0 0 0 0 0 0 0 0 0 250- 0 0 0 0 0 0 --0-- --1-- --2-- --3-- --4-- --5-- --6-- --7-- --8-- --9--

RECORD SELECTION SUMMARY-BY DDNAME

Lists each file by ddname that is provided for ACFRPTPP output (that is, those ddnames that begin with SMF). For each file, the report provides a description, the number of records written into the file, and the corresponding SMF record number or CA ACF2 for z/VM subtype of records requested for the file.

TOTAL RECORDS PROCESSED

Shows the total number of records that were

Read from all of the SMF input files (ddname formats of RECxxxxx)
Selected from the input records for output
Written to all of the output intermediate files.

SMF RECORDS INPUT SUMMARY-BY DDNAME

Shows the ddname, as specified in a FILEDEF command, of each SMF input file ACFRPTPP processed. For each file, this section shows the physical starting and ending date and time (the date and time that the first and last records were written). This section also shows the logical starting and ending date and time (the date and time from the earliest and latest records in the file).

SMF RECORDS INPUT SUMMARY-BY TYPE

Shows the number of records read for each SMF record type. SMF record numbers (IBM record type field of the record) identify the types. To interpret which record number corresponds with each total shown on the table, add the number to the left of the row (where the total appears) to the number at the top of the column where the total appears.

Preprocessor Sample Exit (ACFFLTXT)

The ACFRPTPP utility calls the preprocessor exit when a record is written to the ACFFLT (flat) file. The preprocessor sample exit shows you how you can append your own data to the CA ACF2 for z/VM SMF records. The sample exit uses the SRF facility to get the name and UID value for a user from the Logonid database.

Through the preprocessor exit, you can put up to 512 bytes of your own data in the SMF records. Experience has shown that there is significant value to appending the data directly to the SMF record. Consider the following before making a decision on whether to implement the exit.

Centralizes logic to add information for reports in one program. Thus, the logic in the report writer programs is simpler.
Maintains current data. This exit adds extended user data to the SMF record in a timely fashion. If you add data to a report at report writing time, you run the risk of not having current data. For example, at report writing time, your report writer might want to add the user's name to a detail line. If you run the report soon after the preprocessor, there would not be any problems.
But suppose you want to process the SMF on a monthly or quarterly basis to see trends in violations. If all your data was in the SMF record, you would not have any problems. But, if at report writing time, you had to obtain the data, you could have problems. The user might leave the company or change names through marriage. The point is, if you use the exit, the data you need to report with is current with the SMF record.

The ACFFLT macro describes the assembler flat file record format. The area for user information is the ACFLTUSER field, which is 512-bytes long. The preprocessor sample exit is shipped in the ACFFLTXT ASSEMBLE file. It processes five types of SMF records.

D: Data set access journal record
L: Logonid modification journal record
P: Invalid password and authority journal record
R: Rule database update journal record
V: Resource access journal record.

The value in the ACFLTTYP field of the ACFFLT record identify these types.

The CA Earl™ record definition for the flat file records are in the copy books residing in the EARLLIB MACLIB. Some of these books are:

HDRECORD: Common header fields.
DRECORD: Type D fields.
LRECORD1: Type L summary fields.
LRECORD2: Type L detail fields.
PRECORD: Type P fields.
RRECORD: Type R fields.
VRECORD: Type V fields.

To assemble the preprocessor sample exit, use the VMFASM (or VMFHASM) EXEC with your CA ACF2 for z/VM-modified CMS control file (for example, VMFASM ACFFLTXT DMSSP). You do not need to generate a module file. The preprocessor does an OS LOAD of the text desk. Therefore, be sure that your text deck has a filetype of TEXT. After you assemble the exit and test it, put it on a disk that is accessible when you run the preprocessor.