Previous Topic: Using CA Auditor to Detect File Changes

Next Topic: Key Data Set Security Analysis

Freezing Files

You can freeze sequential files, PDS and PDSE members, and libraries. You can also freeze subsystems such as JES2, JES3, or CICS to detect core zaps or changes in IPL parameters. If you change the name or location of a file after you freeze it, you can change the information in the freezer database to reflect this. This way, you can continue to monitor changes to a file when its name or location changes.

When a file is frozen, it is categorized by type and relevant information to that type is collected. For example, the information that is collected for a subsystem differs from what it collects for a library. This process lets CA Auditor provide a more detailed explanation of what caused the change to the file. Rather than informing you only that a change occurred, CA Auditor tells you that the library has new members or that the size of the subsystem changed. Because multiple changes to a file can make it difficult to pinpoint the exact origin of the change, CA Auditor gives you its “best guess” of what happened to cause the change.

CA Auditor can store the results of up to ten changes to a file. This capability lets you monitor a file over time and obtain a history for the file. Using this information, you can gain a good picture of how efficiently your data center operates and how well your change control procedures are working. You can also gather data about possible security exposures and violations. Using this detailed information, you can investigate further and discover how a file was changed, who changed it, and why it was changed.

If you have the storage space to keep a secure copy of each file, you can watch changes even more closely. Particularly sensitive files, such as payroll master files, can merit such attention, but other files can be overlooked. The File Freezer facility provides a quick way to learn which files you need to compare, eliminating the headache of trying to run comparisons on everything.