Specific Control Options › VTHRESH—Access Violation Response

VTHRESH—Access Violation Response

Valid on z/OS and z/VM.

Use the VTHRESH control option to:

• Select an access violation threshold for online users, batch jobs, and started tasks
• Select the action that CA Top Secret takes when the threshold is reached

This control option uses all entry methods.

This control option has the following format:

VTHRESH(nn,[NOT],[CAN],[WARN]),[SUS],[CAN],[WARN]
        ,[RES]

nn

Sets the maximum number of resource access violations that a user may accumulate during an online session or job execution. This operand must be specified when changing any of the action operands. Specifying a value of 0, signifies that no violation threshold processing is performed.

Range: 0 to 254

Default: 5

NOT

(Default) CA Top Secret issues a message at the security console and the user's terminal to notify the security administrator of a security violation.

CAN

For TSO: CA Top Secret will O/S CANCEL the TSO session or batch job, and will issue this message:

TSS7191E JOB/SESSION CANCELLED EXCESSIVE VIOLATIONS

• For non‑TSO online sessions—CA Top Secret will prevent further access of any kind by locking the terminal. This forces the user to sign off. CA Top Secret will issue the message:
• TSS7192E SESSIONL LOCKED ‑ EXCESSIVE VIOLATIONS: SIGNOFF
• For CICS online sessions—CA Top Secret will cancel the session and issue following messages:

  TSS7191E JOB/SESSION CANCELLED EXCESSIVE VIOLATIONS
  TSS7192E SESSION LOCKED ‑ EXCESSIVE VIOLATIONS: SIGNOFF
  

SUS

For TSO: CA Top Secret will O/S CANCEL the session and suspend the violator's ACID.

For non‑TSO online sessions: CA Top Secret will prevent further access of any kind. This forces the user to sign off.

RES

Resets actions SUS, CAN or WARN to NOT.

WARN

Indicates that CAN and SUS is enforced for users operating in WARN mode as well as in FAIL or IMPL.

The VTHRESH option is in effect during WARN, FAIL, and IMPL modes. CA Top Secret will not, however, SUSPEND or CANCEL violators during WARN mode unless VTHRESH(WARN) is set.

TSO users who reach the VTHRESH limit while in ISPF browse or edit is not suspended or cancelled until they leave the screen. VTHRESH operands are not in effect when TSS LOCK is active. You must specify TSS UNLOCK first. Then the VTHRESH options take effect after the next user action. If you want to change the SUSPEND suboption to CANCEL, you must specify the RES suboption first. This resets SUSPEND and CANCEL actions to NOT.