Initialization Best Practices › Creating Audit Tracking Files

Creating Audit Tracking Files

The audit tracking file is not required to initialize CA Top Secret; however, we strongly recommend you create and implement this file. We also recommend that you place the audit tracking file on the following volumes:

• On a volume that other systems do not use heavily
• On a volume that is not subject to extensive I/O
• On a volume separate from the primary security file

Business Value:

The audit tracking file provides administrators and auditors with a current, online record of system security activity from all CPUs.

Using the audit tracking file instead of System Management Facility (SMF) offers the following benefits:

• SMF recording and reporting can be cumbersome.
• SMF does not provide online display capabilities.
• SMF must be merged from many CPUs for complete reports.

The IBM Health Checker confirms that a conflict does not exist with the placement of the CA Top Secret audit tracking file and the security file, which reduces the number of support issues resulting from performance degradation when these two files share a DASD volume.

Additional Considerations:

The audit tracking file is an online file that records security incidents in place of, or in addition to, SMF.

More Information:

For details about how the IBM Health Checker integrates with CA Top Secret, see the Installation Guide.