File Information › File History Search

File History Search

SMF records can be collected on the activity of all files that are processed on the system. You can use this data to determine the user or job that performed some action on a file. By reviewing the activity history of production files, you can determine if data center procedures are followed or if any malicious changes to files were made.

The File History Search option lets you select files for display by date and time. CA Auditor shows you the type of activity that occurred. By analyzing the SMF records, CA Auditor produces a history of files activity. CA Auditor examines SMF record numbers 14, 15, 17, 18, 30, 60, 61, 62, 63, 64, 65, 67, and 68. However, your computer must be recording these SMF record types for this CA Auditor function to work properly.

To search the SMF history records

1. From the Primary menu, select option 6.

   The File Information Menu is displayed.

2. Select option 5.

   The File History Search screen is displayed.

3. Enter the names of the files you want to see SMF history for. You can enter a specific date or date range, or leave the date fields blank so that the current date used by default.

   The File History screen is displayed. For information on the fields on this screen, press F1 (Help)

You can run a batch SMF file history search regularly (daily, weekly, and monthly, for example) by using symbolic date parameters in the date fields. For information, see the chapter “User Profile Information”.