Audit Application Program Interface › Audit API

Audit API

This product lets a programmatic interface generate your own site-specific AUDIT events. To invoke this AUDIT API, issue the $NMAUAPI command in NCL or from a command prompt.

The AUDIT parameter group enables the auditing of AUDIT events. The parameter group can be accessed by entering /PARM and selecting U to update the AUDIT parameter group and set the desired values for the event types you want to enable.

Calls to $NMAUAPI deliver AUDIT events based on the settings you have set in the AUDIT /PARM group. You can enable the AUDIT /PARM group events types to be generated as follows:

• SMF generates only SMF AUDIT events for that event type.
• LOG generates only activity log messages for that event type.
• BOTH generates SMF and LOG events.
• NO disables that event type from being generated.

Note: For information about how to enable auditing, see the Administration Guide.

The following Event Types are available for this API:

• Access (security-based) events, such as logon access to regions and applications, and access to functions under your control
• Application activity based on programs and systems you have developed or are monitoring and want to raise AUDIT-based events for
• Configuration Record Auditable activity that relates to resources and interfaces you have developed that have definition changes
• Procedural events for user activities such as issuing of commands to applications you have developed
• Serviceability events such as state changes of the applications you have developed
• Utilization events for statistics, which are usually based on counters your Audit API can create and increment at any time. The processing of these counters generates AUDIT events that record the accumulated counter values at the intervals specified by the /PARM Group Utilization settings.

  Alternatively, you can generate immediate utilization events based on calculations you have already done by using the OPT=RAISE-EVENT.

Your Audit API generates audit events in the local region and SMF. You can also use the API to pass the events to a linked region at the same time as the API call is being executed in the local region using the RMTSYS= parameter in the AUDIT API call.

The API provides two types of options: RAISE-EVENT and counter.

• The RAISE-EVENT API option lets you generate events immediately based on the parameters you specify in the API.
• The utilization counter option is based on the Utilization event type. These events are generated at predetermined intervals controlled by the /PARM AUDIT settings. The counters can be created and maintained by calls from $NMAUAPI and the associated counters incremented at any time. After the specified Utilization time interval has elapsed, the values stored in ALL AUDIT Utilization event type counters are written to the destination specified by the Utilization event.

If you want to raise utilization events for statistics that you are not already collecting, you can use the REGISTER-COUNTER and ADJUST-COUNTER API options to create counters and update their values to gather those statistics. At preset intervals (based on the settings in the AUDIT parameter group), each counter generates an audit event using the accumulated value.

Samples of API calls are provided in the dsnpref.OPB9.CC2DSAMP($NMAUSP1) data set member.