4. Operation › 4.3 Operations Reference › 4.3.13 CA MICS Audit and History Archive Tapes › 4.3.13.1 The CA MICS Audit Archive Tape
4.3.13.1 The CA MICS Audit Archive Tape
The audit archive tape contains data from selected database
unit files that contain a user identification field in the
file key. CA MICS automatically selects these files during
the WEEKLY job or the stand-alone AUDIT job based on your
JCLDEF specifications.
File selection is based upon the components that you have
installed in each database unit and the status of the file
(i.e., active or inactive). Section 6.2.3, Tailoring Archive
Files, in the System Modification Guide explains how to add
and delete audit archive files.
ESTABLISHING AUDIT ARCHIVING
Audit archiving is controlled by several CA MICS statements
and parameters. The COMPJOB and FILE statements in
sharedprefix.MICS.GENLIB(cccGENIN), where "ccc" is the three-
character product identifier, determine if audit archives can
be created. The COMPJOB statement has an indicator that
shows whether the product is eligible to create audit
archives. And the FILE statement determines whether a
product file is eligible for audit archiving. In addition,
the FILE statement in prefix.MICS.PARMS(DBMODEL) determines
whether a file is created. The ADM information area files
are not supported for audit archiving. You must specify the
following parameters in prefix.MICS.PARMS(JCLDEF) to complete
the establishment of audit archiving:
o The ARCHIVE AUDIT YES parameter specifies that audit
archiving is to take place
- If you specify ARCHIVE AUDIT YES JOB, audit archiving
occurs in the stand-alone AUDIT operational job.
o If ARCHIVE AUDIT YES JOB is specified and the AUDIT
job is run more than once a week, the following must
be added to prefix.MICS.PARMS(EXECDEF)
USERDEF AUDITCWK YES
This parameter overrides the default audit archive
processing so that data for the current week is
retained and copied to the new audit archive tape
cycle.
- If you specify ARCHIVE AUDIT YES JOB AUTOSUBMIT, the
WEEK300 step of the WEEKLY job automatically submits
the AUDIT operational job to perform audit archiving.
- If you specify ARCHIVE AUDIT YES STEP or take the
default (i.e., ARCHIVE AUDIT YES), audit archiving
takes place in the WEEK300 step of the WEEKLY job.
o The TAPEPREFIX parameter specifies the high-level
qualifier of the data set names on the audit archive tape.
o The AUDITGDG parameter specifies the maximum number of
generation data group (GDG) entries that CA MICS should
establish for the audit tape. Since audit archiving is
done on a weekly basis, this number is equal to the number
of weeks that each audit tape is retained.
Section 6.2.3 of the CA MICS System Modification Guide
explains how to add and delete audit archive files.
HOW THE AUDIT ARCHIVE TAPE IS CREATED
During the stand-alone AUDIT job or the WEEK300 step of the
WEEKLY job, CA MICS obtains your setting for AUDITCYC which
is specified in prefix.MICS.PARMS and defines the number of
CA MICS file cycles you want written to the audit archive
file. If not specified, CA MICS searches the database unit
for the last ten (10) DETAIL cycles of each of the files in
the audit archive selection list. If the DETAIL time-span
has no active cycles, then cycles from the DAYS level are
used. If both time-spans are active, the DETAIL level is
used. The FILE statement in prefix.MICS.PARMS(DBMODEL) can
restrict audit archive to either the DETAIL or DAYS
time-span. If fewer than the number of requested (or the
default value of 10) cycles exist, all available DETAIL or
DAYS cycles are used. The observations from the available
cycles, excluding the current week's observations, are then
concatenated into one SAS file on tape. Usually, all of the
SAS files can be accommodated on one physical tape reel.
Note that the files are not summarized during this process
and that duplicate observations may be present in the
different generation files (see AUDIT ARCHIVE RETRIEVAL
CONSIDERATIONS below).
Each file on the audit tape is entered in the OS catalog as:
tapeprefix.MICS.AUDIT.iiifff.GggggV00
where "tapeprefix" is the high-level qualifier specified in
the TAPEPREFIX parameter of prefix.MICS.PARMS(JCLDEF),
"iiifff" is the information area and filename, and "gggg" is
the absolute number of a generation data group (GDG).
RETRIEVING DATA FROM THE AUDIT ARCHIVE TAPE
The audit tapes may be accessed through a MICF inquiry or a
batch job. Refer to Section 4.3.13.3, Using CA MICS Archive
Tapes With MICF, for more details about accessing the archive
tapes in MICF inquiries.
The JCL specifications that are used to access the files on
the audit archive tape are different from those used to
access the files on the database unit. Database unit files
are referenced as:
//S01 EXEC MICSSHRx
//SYSIN DD *
DATA;
SET &iiit..BATJOBnn ;
where x is the database unit ID, "&iiit" is a CA MICS/SAS
macro variable representing the information area (iii),
time-span (t) of the file to be accessed, and nn is cycle.
Coding the macro variable as compared to a time-span ddname
eliminates the need to know if a particular file has been
defined to DETAIL, DETAIL2 or another split database file.
Refer to Section 2.3.3.3.2.4 for information about the
CA MICS Database Split Table.
Files on the audit archive tape are referenced as:
//S01 EXEC MICSNDBx
//ddname DD DSN=tapeprefix.MICS.AUDIT.iiifff<gdgnumber>,
// DISP=OLD
//SYSIN DD *
DATA;
SET ddname.iiifff;
where x is the database unit ID, "ddname" is a name that you
assign, "tapeprefix" is the high-level qualifier specified in
the TAPEPREFIX parameter, "iiifff" is the information area
and filename, and "<gdgnumber>" is either the absolute GDG
number or the relative GDG number. Note that the time-span
and cycle number are not used to access a file on the audit
archive tape. The tape contains DETAIL (and/or DAYS) files
by default, and observations from those files have been
concatenated into one SAS data set on tape.
Let's look at an example. If you specified twelve (12)
generations for the AUDITGDG parameter and "PRIMARY" for the
TAPEPREFIX parameter, you could retrieve the BATJOB file on
the most current audit archive tape by its absolute
generation number:
//RETRIEVE DD DSN=PRIMARY.MICS.AUDIT.BATJOB.G0012V00,
// DISP=OLD
or by its relative generation number:
//RETRIEVE DD DSN=PRIMARY.MICS.AUDIT.BATJOB(0),DISP=OLD
The relative generation number generally corresponds to the
age of the data on the audit archive tape. This
correspondence is in relation to the file currently on the
CA MICS database unit. For example, the BATJOB data for the
current week (i.e., the +1 generation) resides on the CA MICS
database unit. PRIMARY.MICS.AUDIT.BATJOB(0) contains the
data from last week, and PRIMARY.MICS.AUDIT.BATJOB(-12)
contains data from thirteen weeks ago.
AUDIT ARCHIVE RETRIEVAL CONSIDERATIONS
1. All of the CA MICS database files selected during the
AUDIT job or WEEK300 step reside on a single audit
archive tape. You can reference only one file on a tape
volume at a time in a SAS DATA step or procedure. If you
need more than one file from a physical tape reel, use
the SAS COPY procedure to copy the desired files to disk;
then use the disk files for your requirements.
2. Remember that observations from up to ten online cycles
were used to create each file on the audit archive tape.
These observations often represent more than one week's
worth of data; some of them overlap (duplicate) data
contained on the audit archive tape from the previous
week. The technique of overlapping data ensures that no
audit data will be lost if the WEEKLY job (and AUDIT job
if being used) is scheduled up to the second or third day
in the following week. These duplicate observations must
be deleted when more than one audit tape is used.
The duplicates can be deleted in the following manner:
o Use the SAS SET statement to concatenate the tape
files in a DATA Step.
o Use the CA MICS common data elements (e.g., ENDTS,
DAY, MONTH and YEAR) along with other data elements in
the selected file as data selection criteria to reduce
the data for your requirements.
o Use PROC SORT with the NODUPS option to sort the
output work file. Use the appropriate CA MICS
sort/sequence macro (% fffSEQ(TS=ssssssss), where
"fff" is the file identifier and "ssssssss" is the
time-span name (DETAIL, DAYS, etc.)
3. We mentioned above that the files on the audit archive
tape are not summarized. You should use the CA MICS
Summarization Facility to resummarize the data before
using it for your requirements. See the MICF Reference
Guide.
4. With the ARCHIVE AUDIT JOB option, you have the
additional capability to execute the AUDIT job more
frequently than the normal weekly. For example, if you
find that the DASD space requirements for keeping 10
cycles of DETAIL (or DAYS) level data in one of your unit
databases is too great, then you can reduce the number of
cycles retained online by running the AUDIT job more
frequently, say 3 times per week (which lets you reduce
the number of online cycles to 4 or 5 without risk of
losing data). If you implement this approach, be aware
that each audit archive tape will contain less data than
one might expect (e.g., 5 days of data vs. the default 10
days). Alternatively, you could adjust the value of
AUDITCYC in prefix.MICS.PARMS(SITE) in accordance with
the frequency at which you execute the AUDIT job, without
reducing the number of online cycles. This would avoid
writing redundant data. For example, if you execute the
AUDIT job every 3 days, you could specify AUDITCYC 3 to
only select 3 cycles of each file, but still retain 10
cycles online.
