TSSUTIL Verbs

Begin a control statement with a verb that indicates whether to create reports or extract data for archival. Control statements can span multiple lines.

If a control statement spans multiple lines, you can specify +,-, or * characters between options, which allows you to embed in-line comments or provide a visual indication of places where JCL statements occupy more than one line. TSSUTIL ignores any content from the specified character through the end of a current line.

Important! You cannot specify the characters in the middle of parameter lists that span multiple lines.

You can specify the following TSSUTIL verbs:

REPORT option,option,…

Produces a formatted report of security incidents based on specified selection criteria options (one line per event or two lines per event if you specify LONG).

EXTRACT option,option,…

Selects records (based on specified selection criteria options) and archives the records to the SMFOUT file, the XTROUT file, or both for later processing.

A report of selected records is also produced (if the LIST control option has been specified). Any audit record that exceeds LRECL=465 is truncated (triggering an RC=04).

If you extract to both SMFOUT and XTROUT files, long records are truncated in the SMFOUT file but are written in their entirety in the XTROUT file.

END

Separates multiple reports by indicating the end of a selection request. Additional REPORT or EXTRACT requests might follow.

Important! You cannot specify a +, -, or * character (or any comments) after the END verb.

Note: If both REPORT and EXTRACT are omitted, REPORT is assumed.

Example: Embed Comments Between Control Statement Options

This example shows how to use the - character to include comments between control statement options:

REPORT DATE(TODAY) - Report only today’s events
       EVENT(VIOL) - Report only violations
       LONG - Report is to be produced in long format
END

The comments enable the administrator to provide notes about reporting activity. TSSUTIL ignores the content from the specified character (-) through the end of each line.

Example: Include a Visual Indication of a Multiple-Line JCL Statement

This example specifies the following REPORT statement:

REPORT EVENT(VIOL) DATE(-14,-00) TIME(080000,160000)       -
DEPARTMENT(DEPT1,DEPT2,DEPT3) RES(‘SAMPRES’) LONG END
REPORT EVENT(ACCESS) DATE(-14,-00) RES(‘SAMPRES’) END

The specified statement produces reports about the following activity:

All security violations against SAMPRES that occurred during the last 14 days, between 8 a.m. and 4 p.m., by all users in departments DEPT1, DEPT2, and DEPT3.
All access attempts against SAMPRES in the last 14 days.

The first line of the statement uses a character (-) as a visual indicator that the statement spans multiple lines.

More information:

TSSUTIL Report Selection Criteria