Using CA Audit Events › CA Audit Events Generation

CA Audit Events Generation

To turn events in CA Auditor on or off, use the EVENTS command:

EVENTS {ON|OFF}

To generate CA Audit events for specific functions, bracket the functions with the EVENTS ON and EVENTS OFF commands to generate batch scripts.

To ensure that the EVENTS ON command is generated into a script, enter SCRIPT ON (or its equivalent option, 0.4.2) before entering the EVENTS ON command.

For options that display tables, CA Audit events are generated for each row flagged with an asterisk.

Example: TSO APF commands analysis results

-- CA Auditor - APF-AUTHORIZED TSO TABLE ENTRIES --- Row 1 to 14 of 113
  Enter S beside a line for a library Search for that module.  Enter D to
  update description.
  Entries recommended for review are marked "*"
       NAME          DESCRIPTION           TABLE             REMARKS
 -   -------- --------------------------- -------- -----------------------------
     ALG      Change group profile        APFCTABL RACF default TSO entry
     ALTDSD   Change dataset profile      APFCTABL RACF default TSO entry
     ALTGROUP Change group profile        APFCTABL RACF default TSO entry
     ALTUSER  Change user profile         APFCTABL RACF default TSO entry
     ALU      Change user profile         APFCTABL RACF default TSO entry
   * APTALLOC Unrecognized program        APFTTABL Recommended for review
     AU       Define new users            APFCTABL RACF default TSO entry
     BLKUPD   Connect to group            APFCTABL RACF default TSO entry

Example: record output in CA Audit

06/21/2005 03:00:56 PM Examine USI269ME LOCAL REDDE02 EXAMINE/TSU06028 Examine event 2605

After selecting an entry, the following data is displayed:

OS              : z/OS 1.7
LocationIP      : 141.202.204.69
Category        : Examine event
Log             : Examine
Function        : TSO APF Commands (2.2.3)
Log Name        : Examine
Element         : APTALLOC
Message         : Examine has flagged this element for review