509
(COPYRIGHT © 1998, B I MOYLE ASSOCIATES, INC.) BIM-ALERT is a proprietary product of B I Moyle Associates, Inc. It cannot be reproduced, changed, copied, or stored in any form (including, but not limited to, copies on magnetic media) without the express prior written permission of B I Moyle Associates, Inc. BIM-ALERT CICS AND VSE SECURITY SYSTEM AUDITING AND REPORT WRITING GUIDE Release 5.0

CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

  • Upload
    vanphuc

  • View
    244

  • Download
    2

Embed Size (px)

Citation preview

Page 1: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

(COPYRIGHT © 1998, B I MOYLE ASSOCIATES, INC.)

BIM-ALERT is a proprietary product of B I Moyle Associates, Inc. It cannot bereproduced, changed, copied, or stored in any form (including, but not limited to, copieson magnetic media) without the express prior written permission of B I MoyleAssociates, Inc.

B I M - A L E R T

CICS AND VSE SECURITY SYSTEM

AUDITINGAND

REPORT WRITING GUIDE

Release 5.0

Page 2: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

This documentation applies toRelease 5.0 of the program productBIM-ALERT.

Original Printing .................... 05/15/98Last Revised........................... 05/15/98

Page 3: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

iii

Contents

Trademark Information................................................................................................ ixRelated Publications ..................................................................................................... x

Chapter 1 Using the BIM-ALERT Batch Report Writer...........................................1-1About This Chapter ........................................................................................................1-2About the Batch Report Writer ......................................................................................1-3

Introduction ...............................................................................................................1-3Installation .................................................................................................................1-4Execution ...................................................................................................................1-5Input...........................................................................................................................1-8Processing................................................................................................................1-10Output Reports.........................................................................................................1-11

Sample Commands Page.....................................................................................1-11Sample Header Page ...........................................................................................1-12Sample Detail Page Header.................................................................................1-13Detail Page Lines ................................................................................................1-13

Chapter 2 Commands....................................................................................................2-1Introduction....................................................................................................................2-2

About This Chapter....................................................................................................2-2Conventions ...............................................................................................................2-3Syntax Rules ..............................................................................................................2-4Order of Commands...................................................................................................2-7

Command Descriptions ..................................................................................................2-8HELP Command........................................................................................................2-8

Input ......................................................................................................................2-8Output ...................................................................................................................2-8

OPTIONS Command...............................................................................................2-10XFORM Command..................................................................................................2-13REPORT Command ................................................................................................2-17TITLES Command ..................................................................................................2-21SUBTITLE Command.............................................................................................2-23FIELDS Command ..................................................................................................2-30FIELD Command ....................................................................................................2-31FILEDUMP Command............................................................................................2-35

Output .................................................................................................................2-36SELECT IF Command.............................................................................................2-37RUN Command .......................................................................................................2-43

Chapter 3 ALRTVCSC Security File Report (CICS).................................................3-1Introduction....................................................................................................................3-3

General Information...................................................................................................3-3Sample JCL................................................................................................................3-3Input Record Description...........................................................................................3-4

Map Field Information (Type 04010000) .............................................................3-4ALERT-Transaction Information (Type 06010000) .............................................3-4Terminal Schedule Information (Type 06020000)................................................3-5Authorized Transaction Information (Type 06030000) ........................................3-5Authorized Program Information (Type 06040000) .............................................3-5

Page 4: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

iv Auditing and Report Writing Guide

Authorized File Information (Type 06050000).....................................................3-5Restricted Map Information (Type 06060000) .....................................................3-5ALERT-Transaction Information (Type 07010000) .............................................3-6Operator Schedule Information (Type 07020000) ................................................3-6Authorized Transaction Information (Type 07030000) ........................................3-6Authorized Program Information (Type 07040000) .............................................3-6Authorized File Information (Type 07050000).....................................................3-6Authorized Map Information (Type 07060000)....................................................3-6Authorized Field Resource Information (Type 07070000) ...................................3-7Field Segment Information (Type 08010000) .......................................................3-7Field Segment Information (Type 09010000) .......................................................3-7Group Alert-Transaction Information (Type 0A010000)......................................3-7Group Authorized Transaction Information (Type 0A030000) ............................3-7Group Authorized Program Information (Type 0A040000) .................................3-8Group Authorized File Information (Type 0A050000) .........................................3-8Group Authorized Map Information (Type 0A060000)........................................3-8Group Authorized Field Information (Type 0A070000) .......................................3-8

Field Information .......................................................................................................3-9Fieldname List..............................................................................................................3-11

Common Segment Fields .........................................................................................3-11Transaction Record Fields .......................................................................................3-15Program Record Fields ............................................................................................3-17File Record Fields....................................................................................................3-19Map Record Fields...................................................................................................3-21Location Record Fields ............................................................................................3-24Terminal Record Fields............................................................................................3-27Operator Record Fields............................................................................................3-58Field Resource Information Fields...........................................................................3-99Field Resource Security Information Fields...........................................................3-106Group Security Information Fields ........................................................................3-110User Group Record Fields .....................................................................................3-119User Profile Record Fields.....................................................................................3-122

Sample ALRTVCSC Reports.....................................................................................3-126Introduction............................................................................................................3-126S1B500 System Transaction Security Report ........................................................3-126S1B510 System Program Security Report .............................................................3-128S1B520 System File Security Report.....................................................................3-129S1B530 System Map Display Security Report ......................................................3-130S1B540 Organizational Information Report ..........................................................3-131Operator and Terminal Reports .............................................................................3-132Operator Security Report - Access Time Report....................................................3-133Operator Authorization Report ..............................................................................3-135Operator Sign-On Report .......................................................................................3-136

Chapter 4 ALRTVVSC Security File Report (VSE).................................................. 4-1Introduction....................................................................................................................4-2

General Information...................................................................................................4-2Sample JCL................................................................................................................4-2Input Record Description...........................................................................................4-3

Task ID Build Information: Fields (Type 01010000) ..........................................4-3SECID Job Entry Source (Type 04010000)..........................................................4-3SECID Job Entry Mode (Type 04020000)............................................................4-3

Page 5: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Related Publications v

SECID RJENODE Information (Type 04030000)................................................4-3SECID RJEUID Information (Type 04040000)....................................................4-3

Fieldname List................................................................................................................4-6Common Segment Fields ...........................................................................................4-6User Record Fields ..................................................................................................4-11Jobmask Record Fields ............................................................................................4-15SECID Record Fields ..............................................................................................4-16DASD and Tape Dataset Record Fields...................................................................4-18Resource Record Fields ...........................................................................................4-23Reference Record Field ...........................................................................................4-26Node Information Fields..........................................................................................4-27Remote Submittal Information Fields ......................................................................4-29XPCC Submittal Information Fields........................................................................4-31

Sample ALRTVVSC Report ........................................................................................4-32Introduction .............................................................................................................4-32Logical Table Ruleset Report ..................................................................................4-32

Chapter 5 ALRTVCVI Violation Log File Report (CICS) ........................................5-1Introduction....................................................................................................................5-2

General Information...................................................................................................5-2Sample JCL................................................................................................................5-3Input Record Description...........................................................................................5-4Field Information .......................................................................................................5-5

Fieldname List................................................................................................................5-7Common Segment Fields ...........................................................................................5-7Initialization Record Field .......................................................................................5-10Sign-On and Sign-Off Record Fields .......................................................................5-11Violation Record Fields...........................................................................................5-15

Sample ALRTVCVI Reports .......................................................................................5-20Introduction .............................................................................................................5-20S1B190 Security Violation Report ..........................................................................5-20S1B192 Security Violation Report ..........................................................................5-22

Chapter 6 ALRTVVVI Violation Log File Report (VSE) ..........................................6-1Introduction....................................................................................................................6-2

General Information...................................................................................................6-2Sample JCL................................................................................................................6-3Input Record Description...........................................................................................6-4Field Information .......................................................................................................6-5

Fieldname List................................................................................................................6-7Common Segment Fields ...........................................................................................6-7Access Check Information .......................................................................................6-11

Sample ALRTVVVI Reports .......................................................................................6-31Introduction .............................................................................................................6-31Dataset Name Report ...............................................................................................6-31User Entry Report ....................................................................................................6-33Resource Class Report .............................................................................................6-34SECID/User Dataset Summary Report ....................................................................6-36SECID/User Resource Summary Report .................................................................6-37

Chapter 7 ALRTVCAU Audit File Report..................................................................7-1Introduction....................................................................................................................7-3

Page 6: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

vi Auditing and Report Writing Guide

General Information...................................................................................................7-3Sample JCL................................................................................................................7-3Input Record Description...........................................................................................7-4

System Options Or Parameter Lists (Type 01010000)..........................................7-4System Option Values (Type 01020000) ..............................................................7-4System Parameter Values (Type 01030000) .........................................................7-4Terminal or Operator Parameter Values (Type 01040000)...................................7-4Terminal Or Operator Data List (Type 02010000) ...............................................7-4Terminal Or Operator Data Fields (Type 02020000)............................................7-4User Profile Data Fields (Type 02030000) ...........................................................7-5Secured Resource Information List (Type 03010000) ..........................................7-5Secured Resource Field Values (Type 03020000) ................................................7-5Restricted Map Field Information (Type 03030000) ............................................7-5Field Resource Field Values for Files (Type 03040000) ......................................7-5Field Resource Segments for Files (Type 03040100) ...........................................7-5Field Resource Field Values for Maps (Type 03050000) .....................................7-5Field Resource Segments for Maps (Type 03050100) ..........................................7-5Secured Resource Authorization Lists (Type 04010000)......................................7-5Activate Or Deactivate Data Fields (Type 05010000) ..........................................7-5Administrator Maintenance Information (Type 06010000) ..................................7-6Location ID Information List (Type 07010000) ...................................................7-6Location ID Field Values (Type 07020000) .........................................................7-6

Field Information .......................................................................................................7-7Fieldname List................................................................................................................7-9

Common Segment Fields ...........................................................................................7-9System Options and Parameter Fields......................................................................7-14Terminal and Operator Profile Fields ......................................................................7-32Secured Resource Fields ..........................................................................................7-50Secured Resource Authorization Fields ...................................................................7-65Activation and Deactivation Fields ..........................................................................7-68Administrator Maintenance Fields ...........................................................................7-71Location Information Fields.....................................................................................7-74Password Change Field............................................................................................7-77Program Refresh Fields............................................................................................7-78Optional Zap Fields .................................................................................................7-79Record Dump Information .......................................................................................7-80

Sample ALRTVCAU Reports ......................................................................................7-81Introduction..............................................................................................................7-81System Options Update Report................................................................................7-81System Parameter Change Report............................................................................7-83System Parameter Update Report ............................................................................7-84Global Terminal/Operator Parameter Change Report..............................................7-85Resource Name Update Report................................................................................7-87Resource Update Report ..........................................................................................7-89Resource Activation and Deactivation Report .........................................................7-91Administrator Change Activity Report ....................................................................7-92Location Change Report ..........................................................................................7-94Operator Profile Change Report ..............................................................................7-95

Chapter 8 ALRTVVAU Audit File Report ................................................................. 8-1Introduction....................................................................................................................8-2

General Information...................................................................................................8-2

Page 7: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Related Publications vii

Sample JCL................................................................................................................8-2Input Record Description...........................................................................................8-3

User Information Data List (Type 01010000).......................................................8-3User Information Data Values (Type 01020000)..................................................8-3User Information Task ID Build Parameters (Type 01030000)............................8-3Jobmask Data List (Type 03010000) ....................................................................8-3Jobmask Data Values (Type 03020000) ...............................................................8-3SECID Data List (Type 05010000) ......................................................................8-3SECID Data Values (Type 05020000)..................................................................8-4DASD Dataset Data List (Type 06010000) ..........................................................8-4DASD Dataset Data Values (Type 06020000) .....................................................8-4Tape Dataset Data List (Type 07010000) .............................................................8-4Tape Dataset Data Values (Type 07020000) ........................................................8-4Resource Data List (Type 08010000) ...................................................................8-4Resource Data Values (Type 08020000) ..............................................................8-4Library Data List (Type 09010000) ......................................................................8-5Library Data Values (Type 09020000) .................................................................8-5Rules Table Maintenance Values (Type 0A010000) ............................................8-5Rules Table Before/After Values (Type 0A020000) ............................................8-5Control File Maintenance Values (Type 0B010000) ............................................8-5Control File Before/After Values (Type 0B020000) ............................................8-5Control File Monitor Parameters (Type 0B030000) .............................................8-5Node Name Before/After Values (Type C0010000).............................................8-5Node Name Parameters (Type C0020000) ...........................................................8-6Remote Submittal Parameter Descriptions (Type C1010000) ..............................8-6Remote Submittal Parameters (Type C1020000)..................................................8-6Remote Submittal Parameters (Type C1030000)..................................................8-6

Field Information .......................................................................................................8-7Fieldname List................................................................................................................8-9

Common Segment Fields ...........................................................................................8-9Extended User Fields...............................................................................................8-15Jobmask Fields.........................................................................................................8-20SECID Maintenance Fields......................................................................................8-24DASD Dataset Maintenance Fields .........................................................................8-28Tape Dataset Maintenance Fields ............................................................................8-32Resource Maintenance Fields ..................................................................................8-36Library Maintenance Fields .....................................................................................8-40Rules Table Maintenance Fields..............................................................................8-44Control File Maintenance Fields..............................................................................8-47Node Information Fields..........................................................................................8-53Remote Submittal Information Fields ......................................................................8-55

Sample ALRTVVAU Reports......................................................................................8-57Introduction .............................................................................................................8-57DASD Dataset Change Report.................................................................................8-58Resource Change Report .........................................................................................8-59Control File Maintenance Report.............................................................................8-60

Appendix A Additional BIM-ALERT/VSE Reports .....................................................A-1About This Appendix................................................................................................A-2Log File Integrity Report ..........................................................................................A-3Status Change Report................................................................................................A-4Dataset Name Report ................................................................................................A-7

Page 8: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

viii Auditing and Report Writing Guide

User Entry Report .....................................................................................................A-9Resource Class Report ............................................................................................A-11Program Execution Report......................................................................................A-13SECID/USER Job Summary Report .......................................................................A-14Control Totals Reports............................................................................................A-15SECID Authorized Resource Report ......................................................................A-16

Appendix B Additional BIM-ALERT/CICS Reports ...................................................B-1Introduction...............................................................................................................B-2S1B100: Audit Trail Batch Report ..........................................................................B-4S1B190: Violation, Sign-On, and Specification Reports .........................................B-7S1B192: Security Violation Query Report.............................................................B-15S1B500: System Transaction Security Report .......................................................B-16S1B510: System Program Security Report ............................................................B-17S1B520: System File Security Report....................................................................B-18S1B530: System Map Security Report...................................................................B-19S1B540: Organizational Information Report .........................................................B-20S1B550: Operator Security Information Report ....................................................B-21S1B560: Terminal Security Information Report ....................................................B-23S1B570/S1B571: Operator/Terminal Authorized Resources.................................B-25

Index ......................................................................................................................Index-1

Page 9: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Related Publications ix

Trademark Information

This manual refers to the following brand or product names, registered trademarks, and trademarks which arelisted according to their respective owners.

Computer Associates International, Inc.:CA-VOLLIE

International Business Machines Corporation:CICS/VSECPDITTOIBMICCFMSHPVMVSAMVSE/ESAVSE/SPVSE/POWERVTAM

Page 10: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

x Auditing and Report Writing Guide

Related Publications

This section lists the documentation that deals with BIM-ALERT/VSE and BIM-ALERT/CICS. Your BIM Account Manager can order any of these documents for you.

Subject Manual

Installation The BIM-ALERT Installation and Operations Guide explains how toinstall and maintain BIM-ALERT/VSE.

UsingBIM-ALERT

The BIM-ALERT/VSE Security Administrator's Guide explains how touse BIM-ALERT/VSE to set up and maintain security.

Reports The BIM-ALERT Auditing and Report Writing Guide explains how touse the BIM-ALERT batch report writer.

Messages The BIM-ALERT Messages Guide contains explanations of all messagesissued by BIM-ALERT/VSE.

Subject Manual

Installation The BIM-ALERT Installation and Operations Guide explains how toinstall BIM-ALERT/CICS.

UsingBIM-ALERT

The BIM-ALERT/CICS Security Administrator's Guide explains how touse BIM-ALERT/CICS to set up and maintain security.

Reports The BIM-ALERT Auditing and Report Writing Guide explains how touse the BIM-ALERT batch report writer.

Messages The BIM-ALERT Messages Guide contains explanations of all messagesissued by BIM-ALERT/CICS.

Overview

BIM-ALERT/VSEManuals

BIM-ALERT/CICSManuals

Page 11: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

1-1

1

Using the BIM-ALERT Batch Report Writer

This chapter describes how to use the BIM-ALERT batch report writer (ALRTVREP).

About This Chapter ........................................................................................................1-2About the Batch Report Writer ......................................................................................1-3

Introduction ...............................................................................................................1-3Installation .................................................................................................................1-4Execution ...................................................................................................................1-5Input...........................................................................................................................1-8Processing................................................................................................................1-10Output Reports.........................................................................................................1-11

Page 12: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About This Chapter

1-2 Auditing and Report Writing Guide

About This Chapter

This chapter describes how to use the BIM-ALERT batch report writer (ALRTVREP). Itincludes descriptions of the following:

• Installation requirements

• Sample JCL for producing reports

• Lists of available commands and required commands

• ALRTVREP processing, including

− Sorting− I/O to input files− Output formatting− Generation of multiple reports

• Components of reports

Page 13: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Introduction

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-3

About the Batch Report Writer

Introduction

The BIM-ALERT batch report writer provides comprehensive auditing and report writingcapabilities. The BIM-ALERT batch report writer generates reports from data in thefollowing files:

• BIM-ALERT/CICS security database and violation log file• BIM-ALERT/VSE security database and log file• BIM-ALERT audit file, which is common to BIM-ALERT/VSE and

BIM-ALERT/CICS

Previous releases of BIM-ALERT/VSE and BIM-ALERT/CICS included a number ofseparate batch auditing and report writing programs. These programs continue to be providedin the current release of BIM-ALERT. They are documented in Appendix A, "AdditionalBIM-ALERT/VSE Reports" and Appendix B, "Additional BIM-ALERT/CICS Reports"

Reports similar to those produced by many of these programs, however, can be produced bythe BIM-ALERT batch report writer. The description of each such program includes areference to the BIM-ALERT batch report writer report most similar to the program's output.

Description

Other BatchAuditing andReport WritingPrograms

Page 14: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Installation About the Batch Report Writer

1-4 Auditing and Report Writing Guide

Installation

The BIM-ALERT batch report writer is installed as part of the normal installation procedure.Refer to the BIM-ALERT Installation and Operations Guide for detailed instructions oninstalling the distribution tape. If you have successfully installed the distribution tape andexecuted the file conversions detailed in the installation procedures, the BIM-ALERT batchreport writer is ready to use.

The BIM-ALERT batch report writer uses the BIM-ALERT/VSE and BIM-ALERT/CICSsecurity, log, and audit files as input. These files must be converted to the version 5.0 formatbefore the BIM-ALERT batch report writer can be used to generate reports.

WARNING!

Using files that have not been converted to version 5.0 format will cause unpredictable results.Refer to the BIM-ALERT Installation and Operations Guide for specific instructions aboutconverting files.

No AdditionalInstallation StepsRequired

ReleaseCompatibility

Page 15: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Execution

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-5

Execution

ALRTVREP is the driver program you execute to generate reports with the BIM-ALERTbatch report writer. The following sample JCL can be customized to execute one or morereports from a batch job:

// JOB ALRTRPT BIM-ALERT 5.0 REPORT WRITER// DLBL IJSYSUC,'BIM.USER.CATALOG',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SAUDT,'ALERT.S1SAUDT.V50',,VSAM// DLBL ALERTXP,'ALERT.ALERTXP.V50',,VSAM// DLBL AXPLOG1,'ALERT.AXPLOG1.V50',,VSAM// DLBL AXPLOG3,'ALERT.AXPLOG3.V50',,VSAM// LIBDEF PHASE,SEARCH=BIMLIB.ALERT// EXEC ALRTVREP,SIZE=256KOPTIONS UPPERCASE /* All subsequent output (reports and */ /* messages) will be converted to */ /* uppercase. */REPORT ALRTVCVI /* Report BIM-ALERT/CICS Violation */ /* Log records. */TITLE ('BIM-ALERT/CICS VIOLATION REPORT' - 'FOR JANUARY, 1998','BY TERMINAL ID')FIELD TERMINAL SORTPRTY(1)FIELDS OPERNUM OPERNAME SYSTEMID VIOLATEC DESCRIPTSELECT IF RECTYPE EQ C'3' AND SYSDATE GE D'01/01/1998' AND - SYSDATE LE D'01/31/1998'RUN/*/&

Sample JCL

Page 16: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Execution About the Batch Report Writer

1-6 Auditing and Report Writing Guide

The statements in the preceding sample JCL are as follows:

Statement Meaning

// JOB ALRTRPT Standard VSE job card. This statement is required. The job name can be any nameacceptable to VSE.

// DLBL IJSYSUC VSAM user catalog. This statement can be omitted in either of the following cases:• The user catalog containing the BIM-ALERT/VSE or BIM-ALERT/CICS files to be

referenced by the job is defined as IJSYSUC in standard labels.

• The DLBL statements for the files specify a CAT=xxxx.

// DLBL S1SECLG BIM-ALERT/CICS violation log file. This statement is necessary only when generatingreports from the BIM-ALERT/CICS violation log file. If the S1SECLG file is defined ineither the partition standard labels or the system standard labels, this statement can beomitted in the jobstream.

// DLBL S1SCTY BIM-ALERT/CICS security database. This statement is necessary only when generatingreports from the BIM-ALERT/CICS security file or log file. If the S1SCTY file is definedin either the partition standard labels or the system standard labels, this statement can beomitted from the jobstream.

// DLBL S1SAUDT BIM-ALERT/VSE and BIM-ALERT/CICS audit database. This statement is necessaryonly when generating reports from the audit file (ALRTVCAU and ALRTVVAU). If theS1SAUDT file is defined in either the partition standard labels or the system standardlabels, this statement can be omitted from the jobstream.

// DLBL ALERTXP BIM-ALERT/VSE security database. This statement is necessary only when generatingALRTVVSC reports from the BIM-ALERT/VSE security file. If the ALERTXP file isdefined in either the partition standard labels or the system standard labels, this statementcan be omitted from the jobstream.

// DLBL AXPLOG1 BIM-ALERT/VSE log file database. This statement is necessary only when generatingALRTVVVI reports on the current log file. If the AXPLOG1 file is defined in either thepartition standard labels or the system standard labels, this statement can be omitted fromthe jobstream.

// DLBL AXPLOG3 BIM-ALERT/VSE archived log file database. This statement is necessary only whengenerating ALRTVVVI reports that request information older than that contained in thecurrent log file AXPLOG1. If the AXPLOG3 file is defined in either the partition standardlabels or the system standard labels, this statement can be omitted from the jobstream.

You may receive an OPEN error message with error code 160 when using AXPLOG3 asinput. The message can be disregarded. The report writer attempts to open input files firstas keyed, which results in an error for a non-keyed file such as AXPLOG3. The reportwriter will automatically attempt another OPEN, this time with a non-keyed ACB.

(continued)

Explanation ofSample JCL

Page 17: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Execution

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-7

Statement Meaning

// LIBDEF PHASE VSE sublibrary information. This statement can be omitted if the library containing theBIM-ALERT batch report writer phases is defined in the partition permanent search chain.

// EXECALRTVREP,SIZE=256K

VSE EXEC statement and SIZE= parameter. Both the EXEC statement and the SIZE=parameter are required. ALRTVREP is the driver for the BIM-ALERT batch report writer.It should run in a partition of at least 768K.

Page 18: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input About the Batch Report Writer

1-8 Auditing and Report Writing Guide

Input

Input to ALRTVREP is provided as a series of commands, keywords, and keyword valuesfollowing the // EXEC ALRTVREP,SIZE=256K statement.

The following program commands are available:

Command Description

HELP Print various levels of help information.

OPTIONS Specify program execution options.

XFORM Define field transformation table.

REPORT Define the report type to be executed and specify report formattingoptions.

TITLES Define report titles.

SUBTITLE Define report subtitles.

FIELDS Define one or more fields to be included in the report.

FIELD Specify formatting or sort parameter options relating to a single data fieldto be included in the report.

FILEDUMP Generate a pre-defined list of SUBTITLE and FIELD commands to beused to dump individual physical input records.

SELECT IF Define selection criteria for the purpose of restricting report output.

RUN Specify that all input for this report has been processed and reportexecution is to begin.

For complete information about these commands, refer to Chapter 2, "Commands".

Introduction

AvailableCommands

Page 19: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Input

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-9

To generate a single report, you must include at least the following commands:

Required Command Explanation

REPORT The REPORT command must be specified to identify the type ofreport to be executed. OPTIONS and TITLES commands arenot required. If they are specified, they can either precede orfollow the first REPORT command.

FIELD or FIELDS At least one FIELD or FIELDS command must follow theREPORT command statement and specify one or more validfieldnames. These commands tell the report writer which datafields are to be extracted from the input dataset for the report.

RUN The RUN command must follow the REPORT and FIELDcommands. It initiates generation of the report.

Multiple reports can be produced in a single job step by repeating the RUN commandstatement. Each report can be directed to a separate output dataset or printer using theOUTFILE keyword on the REPORT command statement.

Titles, field names, and selection criteria can be modified between RUN commands.

For a list of the types of reports that can be generated, see the description of the REPORTcommand on page 2-17.

A simple example of input commands for a report is shown below. It includes all the requiredcommands in their proper order. A TITLES command has been added so that the resultingreport will include a meaningful label.

// EXEC ALRTVREP,SIZE=256K TITLES 'Log File Activity Report' REPORT ALRTVCVI FIELDS RECTYPE SYSDATE SYSTIME RUN/*

RequiredCommands

Generating MultipleReports

Sample Input

Page 20: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Processing About the Batch Report Writer

1-10 Auditing and Report Writing Guide

Processing

The ALRTVREP program first reads all commands and keywords provided as input fromSYSIPT, until it encounters the special characters /* beginning in column 1.

Input syntax and keyword values are edited and validated until a RUN command isencountered. Then ALRTVREP will generate either the report or, if OPTIONS TEST hasbeen specified, a report definition analysis. (The OPTIONS command is described on page2-10.)

If field sorting has been specified on any FIELD or SUBTITLE command statement (byspecifying the SORTPRTY keyword), your installed sort program will be called to performthe sorting operation.

Unless sorting is specified, no sorting will be performed.

All I/O to input files is performed in a standard E15 sort exit routine. This routine extracts thedata fields specified in the SUBTITLE, FIELD, or FIELDS command statements from thephysical input records, assembles the data fields into a logical record, applies any specifiedselection criteria, and passes the selected records to the sort routine. (For a completedescription of how to select records, see the description of the SELECT IF command on page2-37.)

Report output is formatted in a standard E35 sort exit routine. Each field is moved from thelogical (sorted) record and formatted according to default or user-specified formatting optionson the report output detail line.

Input Processing

Sorting

I/O to Input Files

Output Formatting

Page 21: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Output Reports

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-11

Output Reports

Reports produced by the BIM-ALERT batch report writer are comprised of four kinds ofpages, arranged in the following order:

• A commands page• A header page• One or more detail pages• A trailer page

Each of these kinds of report pages is explained below.

The first page of every report, the commands page, lists the user's report writer commands anddiagnostic messages for any errors detected in those commands.

Sample Commands PageThe following is a sample report commands page for an ALRTVCSC report:

03/20/1998 08:50:58************************************************************************************************************************************* B I M - A L E R T R E P O R T W R I T E R *************************************************************************************************************************************======================================================== INPUT STATEMENTS ==========================================================STMT 0001 ===> TITLES 'B I M - A L E R T' -STMT 0002 ===> '* * OPERATOR REPORT * *'STMT 0003 ===> REPORT ALRTVCSCSTMT 0004 ===> FIELD OPRNUMBRSTMT 0005 ===> FIELD OPRNAMESTMT 0006 ===> FIELD OPRADMNOSTMT 0007 ===> SELECT IF RECTYPE EQ C'OP'STMT 0008 ===> RUN======================================================= DIAGNOSTIC MESSAGES ========================================================******** TITLES 'B I M - A L E R T' '* * OPERATOR REPORT * *'******** REPORT ALRTVCSC******** FIELD OPRNUMBR******** FIELD OPRNAME******** FIELD OPRADMNO******** SELECT IF RECTYPE EQ C 'OP'******** RUN

ALRT204I NO DIAGNOSTIC ERRORS DETECTED

Components

Commands Page

Page 22: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Output Reports About the Batch Report Writer

1-12 Auditing and Report Writing Guide

The next page of the report, the header page, consists of an optional LOGO segment and aninformation box containing report definition specifications, including the report title and thedate and time the report was generated.

The entire header page can be suppressed using the NOHDRPAGE keyword of the REPORTcommand. The REPORT command is described beginning on page 2-17.

Several forms of logos for the header page are available, including a user-defined customlogo. The logo can also be suppressed altogether. For more information about available logosand suppression of logos, refer to the explanation of the keyword LOGO in the discussion ofthe REPORT command, which begins on page 2-17.

Sample Header PageThe following is a sample report header page using the default BIM logo:

BBBBBBBBBBBBBBB IIIIIIIIIIIIIIII MMMMMMMMM MMMMMMMMM BBBBBBBBBBBBBBBB IIIIIIIIIIIIIIII MMMMMMMMMM MMMMMMMMMM BBB BBB III III MMM MM MM MMM BBB BBB IIIIII IIIIII MMM M MMM BBB BBB IIIIII IIIIII MMM MM MM MMM BBB BBBBB III III MMM MMMM MMMM MMM BBB BBB IIIIII IIIIII MMM MM M MM MMM BBB BBB IIIIII IIIIII MMM MM MM MMM BBB BBB III III MMM MM MM MMM BBBBBBBBBBBBBBBB IIIIIIIIIIIIIIII MMMMMMMMM MMMMMMMMM BBBBBBBBBBBBBBB IIIIIIIIIIIIIIII MMMMMMMMM MMMMMMMMM

COPYRIGHT 1998 - B I MOYLE ASSOCIATES, INC.

*************************************************************************** * BIM-ALERT/CICS * * * * OPERATOR REPORT * * * * 03/20/1998 08:50:58 * * * * REPORT TYPE: ALRTVCSC * * INPUT FILE: S1SCTY * * INPUT DATASET: ALERT.S1SCTY.V50 * * OUTPUT FILE: SYSLST * * JOB NAME: ALRTVREP * * SECURITY-ID: SECADMIN * * SORT PROGRAM: NOSORT * * REQUIRED LINE LEN: 041 * * FORMATTED LINE LEN: 133 * * OUTPUT LINE LEN: 133 * * * * ------------------------- SELECTION CRITERIA -------------------------- * * FIELD NAME COMP LITERAL (OR FIELD NAME) * * RECTYPE (+000,002) EQ C'OP' * * * ***************************************************************************

Header Page

Page 23: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About the Batch Report Writer Output Reports

Chapter 1. Using the BIM-ALERT Batch Report Writer 1-13

Following the header page is the body of the report, the detail pages.

Each detail page includes an optional detail page header segment, which contains the reportdate, page number, titles, subtitles, and field column labels. This segment will be printed atthe top of every detail page in the body of the report. Any or all of the elements on the detailpage header can be suppressed. You can do this by specifying keywords on the REPORTcommand statement and by omitting either or both of the TITLES and SUBTITLE commandstatements. For more information about these command statements, refer to Chapter2,"Commands".

Sample Detail Page HeaderThe following illustrates a typical report detail page header:

DATE: 03/20/1998 09:10:28 PAGE: 000001 BIM-ALERT/CICS VIOLATION REPORT FOR JANUARY, 1998 BY TERMINAL ID CICS VIOL TERM OPERATOR OPERATOR SYSTEM VIOL VIOLATION ID NUMBER NAME ID CODE DESCRIPTION ---- -------- -------- ------ ---- -----------

Detail Page LinesFollowing the detail page header lines are the actual report detail lines, comprised of the datafields specified on the FIELD and FIELDS command statements.

Each fieldname specified on the FIELD and FIELDS command statements is associated with acolumn of output on the detail page. The columns are positioned from left to right on theoutput page in the order the fieldnames are specified in the input command statements.

The width of each report column is determined by either the longest of three column labels(which have a maximum length of 16) or the field output length, whichever is greater. Eachfieldname is defined with default labels and output length.

The user can override default length and label values associated with any fieldname byspecifying new values on a FIELD command statement using the LENGTH and LABELkeywords (for a complete discussion of these keywords, see the discussion of the FIELDcommand on page 2-31).

Detail Pages

Page 24: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Output Reports About the Batch Report Writer

1-14 Auditing and Report Writing Guide

When all records have been processed and written to the report output file, a trailer page iswritten. This page contains an 'End of Report' heading and various messages detailingstatistical information gathered during the report generation process.

The trailer page can be suppressed using the NOTRAILER keyword of the REPORTcommand. The REPORT command is described beginning on page 2-17.

The following is an example of the information contained on a typical trailer page:

******** END OF REPORT *******INPUT RECORDS READ............00002657DETAIL RECORDS GENERATED......00002656DETAIL RECORDS SELECTED.......00000554 000707 RECORDS WRITTEN TO SYSLST

A difference in the values indicated by "Input records read" and "Valid input records," as inthe preceding example, does not necessarily indicate that the input file contains invalidrecords. Instead, the file may contain certain control records that are counted as input but thatdo not contain any information useful for reporting purposes.

Trailer Page

Page 25: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

2-1

2

Commands

This chapter details the commands used to generate reports with the BIM-ALERT batch reportwriter (ALRTVREP).

Introduction....................................................................................................................2-2About This Chapter....................................................................................................2-2Conventions ...............................................................................................................2-3Syntax Rules ..............................................................................................................2-4Order of Commands...................................................................................................2-7

Command Descriptions ..................................................................................................2-8HELP Command........................................................................................................2-8OPTIONS Command...............................................................................................2-10XFORM Command..................................................................................................2-13REPORT Command ................................................................................................2-17TITLES Command ..................................................................................................2-21SUBTITLE Command.............................................................................................2-23FIELDS Command ..................................................................................................2-30FILEDUMP Command............................................................................................2-35SELECT IF Command.............................................................................................2-37RUN Command .......................................................................................................2-43

Page 26: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About This Chapter Introduction

2-2 Auditing and Report Writing Guide

Introduction

About This Chapter

Input to ALRTVREP is provided as a series of command statements from SYSIPT. Thischapter details the commands used to generate reports with the BIM-ALERT batch reportwriter (ALRTVREP). It includes a discussion of the general syntax rules that apply to allcommands, followed by detailed information about each of the following commands. Forinformation about how these statements are processed, refer to page 1-10.

• HELP• OPTIONS• XFORM• REPORT• TITLES• SUBTITLE• FIELDS• FIELD• FILEDUMP• SELECT IF• RUN

Page 27: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Conventions

Chapter 2. Commands 2-3

Conventions

Throughout the discussion of the various commands, keywords, and keyword values in thismanual, the following conventions will be followed in order to distinguish commands,keywords, and keyword values:

• COMMANDS are shown in uppercase bold.• KEYWORDS are shown in uppercase.• Keyword values and fieldnames are shown in italics.

Parts of a command that are optional are enclosed in square brackets ([ ]).

Parentheses, when shown, are required input characters. All keyword values for a givenkeyword must be enclosed in parentheses.

Parts of a command that can be included more than once are followed by ellipses (...). Thedescription of the command indicates which items can be repeated.

These conventions are illustrated in the following example:

COMMAND KEYWORD [(keywordvalue) ...]

Commands andTheir Parameters

Optional Input

Parentheses

Input that Can BeRepeated

ConventionsExample

Page 28: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Syntax Rules Introduction

2-4 Auditing and Report Writing Guide

Syntax Rules

Commands, keywords, and keyword values can be placed in any input column from 1 to 72.Column positions 73 to 80 are ignored.

Leading and trailing blanks are ignored. The first non-blank character string encountered isassumed to be the first program command.

Commands can be followed by one or more keywords, which in turn can be further defined bykeyword values.

• All keyword values for a given keyword must be enclosed in parentheses.

• Any keyword or keyword value that contains a special character (see below) must beenclosed in single quotes.

• Multiple keywords or keyword values must be separated from each other by blanks orcommas.

• A set of keyword values can be separated from its keyword by blanks or commas.

The following characters have special meaning to ALRTVREP:

• (blank)• , (comma)• - (hyphen)• ( (left parenthesis)• ) (right parenthesis)• @ (at-sign)• + (plus sign)• * (asterisk)• / (forward slash)• = (equal sign)• ¬ (logical not)• < (less-than sign)• > (greater-than sign)• . (period)• : (colon)• ; (semi-colon)• ' (single quote)• " (double quote)

Any literal character string provided as input to ALRTVREP that contains one or more ofthese special characters must be enclosed in single quotes.

Input Columns

Leading andTrailing Blanks

Parameters

Special Characters

Page 29: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Syntax Rules

Chapter 2. Commands 2-5

The single quote character (') is reserved as a string delimiter. Literal character stringsprovided as input to ALRTVREP, whether or not they are delimited by single quotes, may notinclude any single quotes.

The double quote character (") may be included in literal character strings.

A command statement can be continued to a subsequent line by ending the partial statementwith a hyphen (-) and one or more blanks.

A command statement can be broken only at the beginning or end of a whole keyword orkeyword value. Refer to the following examples:

Valid Continuation Invalid Continuation

COMMAND1 KEYWORD1(value1, - value2)

COMMAND1 KEYWORD1(value1, val - ue2)

COMMAND2 KEYWORD2 (value1) - KEYWORD3 (value2)

COMMAND2 KEYWORD2 (value1) KEY - WORD3 (value2)

CMD3 KEYWORD3( - 'string value 1')

COMMAND3 KEYWORD3('string - value 1')

All characters following a continuation indicator will be treated as comments and ignored bythe program.

Bulk comment information can be inserted at any point, except that it can not begin in column1. Signal the beginning of such comments with a slash followed by an asterisk (/*). Signal theend of the comments with an asterisk followed by a slash (*/).

This type of comment can extend over several input lines. All data following the initial /* willbe ignored until the closing */ is encountered. At that point, if a continuation characterfollows the */, the preceding command statement, if any, will be resumed. If no continuationcharacter follows the */, a new command statement will be expected.

WARNING!

Do not attempt to begin a comment in column 1. If the characters /* are encounteredbeginning in column 1, they are treated as signaling end of input.

ReservedCharacter

CommandStatementContinuation

Comments in Input

Page 30: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Syntax Rules Introduction

2-6 Auditing and Report Writing Guide

The following example of correct input syntax includes two input commands and commentinformation. Each command is followed by several keywords and keyword values.

// EXEC ALRTVREP,SIZE=256K COMMAND1 'KEYWORD1' KEYWORD2 ( VALUE1,VALUE2 ) - KEYWORD3 ( VALUE1 ( SUBVALUE ) ) - Comments after continuation KEYWORD4 ( VALUE1 (SUBVALUE1,'SUB VALUE2') VALUE2) - /* These comments continue over more than one line.Note that no continuation indicator is required between comment lines. The one that appears following the block comment information is necessary only to continue the COMMAND1 statement. */ - KEYWORD5 ( VALUE1 ) COMMAND2 KEYWORD1,KEYWORD2,KEYWORD3(VALUE1)/*

Example of ProperCommand Syntax

Page 31: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Order of Commands

Chapter 2. Commands 2-7

Order of Commands

The following sections detail each of the commands that can be used as input to the BIM-ALERT batch report writer (ALRTVREP). The commands are presented in theirrecommended order, the order in which they might logically be specified, rather thanalphabetically.

The following restrictions apply to the order in which commands can be specified:

• The REPORT command must precede any command that extracts data from the inputdataset. Thus it must precede any SUBTITLES, FIELD, FIELDS, FILEDUMP, orSELECT IF command specified.

• The RUN command must be the last command specified.

Page 32: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

HELP Command Command Descriptions

2-8 Auditing and Report Writing Guide

Command Descriptions

HELP Command

Use the HELP command to print available program HELP information.

HELP [option[, option]]

The following table shows the valid options for the HELP command. Specifying HELP withno options prints all available information.

Use One or MoreOptions (Optional) Explanation

COMMANDS Print a brief summary of all program commands.

MESSAGES Print all ALRTVREP program error messages and a briefexplanation of each.

command[, command ...] Print information about the specified command. Multiplecommands can be specified, separated by commas.

report-type Print detailed information about all fields for the report-typespecified.

report-type (*) Print a list of field names for the type of report specified,along with a brief, rather than detailed, description of eachfield.

report-type (fieldname, ...) Print detailed information about the report-type fieldnamesspecified. Multiple fieldnames can be specified, separatedby commas.

InputA sample of input syntax for the HELP command is shown below:

// EXEC ALRTVREP,SIZE=256K HELP COMMANDS ALRTVCSC (RECTYPE) HELP ALRTVCSC (*)/*

OutputThe report on the following page is printed when the preceding HELP commands are used.

(continued)

Purpose

Syntax

Options

Example

Page 33: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions HELP Command

Chapter 2. Commands 2-9

************************************************************************************************************************************* B I M - A L E R T R E P O R T W R I T E R *************************************************************************************************************************************======================================================== INPUT STATEMENTS ==========================================================STMT 0001 ===> HELP COMMANDS ALRTVCSC(RECTYPE)STMT 0002 ===> HELP ALRTVCSC (*)======================================================= DIAGNOSTIC MESSAGES ========================================================******** HELP COMMANDS OPTIONS Specify program options. XFORM Define transformation table. TITLES Specify report title information. SUBTITLE Specify report sub-title information. REPORT Specify report-type and formatting parameters. FIELDS Specify field names to be included in the report FIELD Specify a single field name and sort/formatting parameters. SELECT Specify selection criteria to be used when report output is being generated. FILEDUMP Specify to generate dump of input records using pre-defined field list. RUN Generate report output. HELP Print program HELP information for all valid input commands. --------------------------------------------------------------------------- ALRTVCSC field information: RECTYPE Descr: Record type Labels: 'RECORD' 'TYPE' Field type: 00000000 - Common segment information Data length: 002, format: C - Character Output length: 012, format: T - Transformed Transformation: C'TX' = TRANSACT-PFX C'TR' = TRANSACTION C'PX' = PROGRAM-PFX C'PR' = PROGRAM C'FX' = FILE-PFX C'FL' = FILE C'MX' = MAP-PFX C'MP' = MAP C'LO' = LOCATION C'DV' = TERMINAL C'OP' = OPERATOR******** HELP ALRTVCSC report - Field name list:

- FIELD KEY - 00000000 INPUT RECORD KEY- FIELD RECLEN - 00000000 INPUT RECORD LENGTH- FIELD DSNAME - 00000000 INPUT FILE DATASET NAME- FIELD RECTYPE - 00000000 RECORD TYPE- FIELD INFOTYPE - 00000000 FIELD/RECORD INFORMATION TYPE- FIELD FILEVEL - 00000000 BIM-ALERT/CICS/VSE PRODUCT LEVEL- FIELD SEQNUM - 00000000 OUTPUT REPORT LINE NUMBER- FIELD INRECNUM - 00000000 INPUT RECORD NUMBER- FIELD TRANSID - 01000000 TRANSACTION CODE- FIELD TRANNBR - 01000000 ALERT TRANSACTION NUMBER- FIELD TRANSEQ - 01000000 ALERT TRANSACTION SEQUENCE NUMBER- FIELD TRFRTIME - 01000000 SCHEDULED TRANSACTION FROM-TIME- FIELD TRTOTIME - 01000000 SCHEDULED TRANSACTION TO-TIME- FIELD TRSTATUS - 01000000 TRANSACTION STATUS- FIELD TRDESCR - 01000000 TRANSACTION DESCRIPTION- FIELD PROGNAME - 02000000 PROGRAM NAME- FIELD PROGNUM - 02000000 ALERT PROGRAM NUMBER- FIELD PROGSEQ - 02000000 ALERT PROGRAM SEQUENCE NUMBER- FIELD PROGFTIM - 02000000 SCHEDULED PROGRAM FROM-TIME- FIELD PROGTTIM - 02000000 SCHEDULED PROGRAM TO-TIME- FIELD PROGSTAT - 02000000 PROGRAM STATUS- FIELD PROGDESC - 02000000 PROGRAM DESCRIPTION- FIELD FILENAME - 03000000 FILE NAME- FIELD FILENUM - 03000000 ALERT FILE NUMBER- FIELD FILESEQ - 03000000 ALERT FILE SEQUENCE NUMBER- FIELD FILEFTIM - 03000000 SCHEDULED FILE FROM-TIME- FIELD FILETTIM - 03000000 SCHEDULED FILE TO-TIME- FIELD FILESTAT - 03000000 FILE STATUS- FIELD FILEPROC - 03000000 FILE ACCESS TYPE- FIELD FILEDESC - 03000000 FILE DESCRIPTION- FIELD MAPNAME - 04000000 MAP NAME- FIELD MAPNUM - 04000000 ALERT MAP REFERENCE NUMBER- FIELD MAPSEQ - 04000000 ALERT MAP SEQUENCE NUMBER- FIELD MAPSET - 04000000 MAPSET NAME- FIELD MAPTITLE - 04000000 MAP TITLE- FIELD MAPSTAT - 04000000 MAP STATUS- FIELD MAPFDNUM - 04010000 MAP FIELD NUMBER- FIELD MAPFDISP - 04010000 MAP FIELD DISPLAY INDICATOR- FIELD MAPFDSCR - 04010000 MAP FIELD DESCRIPTION

Page 34: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

OPTIONS Command Command Descriptions

2-10 Auditing and Report Writing Guide

OPTIONS Command

Use the OPTIONS command to specify certain global report formatting parameters.

The OPTIONS command has the following format:

OPTIONS option[, option ...]

Use One or MoreOptions Explanation Default

UPPERCASE

NOUPPERCASE

Force all output to uppercase format only.

Print all output as is, without translating to uppercase.

NOUPPERCASE

DATEFORM (date-format) The format in which to print all dates. Valid values are detailed onpage 2-11.

MM,/,DD,/,YYYY

TIMEFORM (time-format) The format in which to print all time values. Valid values aredetailed on page 2-11.

HH,:,MM

SORTNAME ( xxxxxxxx ) The name of the sort program to be used to drive the reportgeneration process. The program specified must be locatable in oneof the sublibraries in the partition's LIBDEF search chain.

SORT

PAGELEN ( nnn ) The number of lines per page to be used in formatting the reportoutput. Valid values are numbers from 16 to 255.

55

LINELEN ( nnn ) The number of character positions to be used in formatting reportoutput. This number must be in the range 16 to 133 and largeenough to contain all output field information, as determined by theFIELD and FIELDS command statements.

133

TEST

NOTEST

Specify during the design phase of a new report to cause all reportcommands to be processed, but no report to be generated. Instead, asample report output page, formatted based on the commandstatements processed, will be produced.

Specify to turn off a previously specified TEST option.

NOTEST

Purpose

Syntax

Options

Page 35: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions OPTIONS Command

Chapter 2. Commands 2-11

Values for the DATEFORM and TIMEFORM keywords can consist of any combination ofcharacter strings and keywords. The maximum date or time format length can not exceed 32characters. This length is calculated by adding together the number of characters in all stringvalues and keywords specified.

The valid values for each of these parameters is given below.

The following table shows the valid values for the date-format parameter of the DATEFORMkeyword.

The default value is MM,/,DD,/,YYYY.

Use One or More Values Description

MM Two-character numeric month.

MMM Three-character month name abbreviation.

DD Two-character numeric day of the month.

DDD Three-character day of the week abbreviation.

YY Two-character year value.

YYYY Four-character year value.

string A string value up to eight characters in length. If it includesany special characters (see page 2-4), the string must beenclosed in single quotes.

The following table shows the valid values for the time-format parameter of the TIMEFORMkeyword.

The default value is HH,:,MM.

Use One or More Values Description

HH Two-character numeric hour value (24-hour clock).

MM Two-character numeric minute value.

SS Two-character numeric value representing seconds.

HH12 Two-character numeric hour value (12-hour clock).

AMPM Two-character string, either AM or PM.

string A string value up to eight characters in length. If itincludes any special characters (see page 2-4), the stringmust be enclosed in single quotes.

DATEFORM andTIMEFORM Values

DATEFORM Values

TIMEFORM Values

Page 36: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

OPTIONS Command Command Descriptions

2-12 Auditing and Report Writing Guide

The following sample OPTIONS command will cause the report to be executed in a testmode, printed in uppercase format, using a page length of 75 lines per page and an 80-columnwidth format. The default date and time formats (MM/DD/YYYY and HH:SS) are replacedwith alternate formats.

// EXEC ALRTVREP,SIZE=256K OPTIONS TEST UPPERCASE - LINELEN (80) PAGELEN (75) - DATEFORM ( YYYY,/,MM,/,DD ) - TIMEFORM ( HH,:,MM,:,SS ) . ./*

Example

Page 37: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions XFORM Command

Chapter 2. Commands 2-13

XFORM Command

Use the XFORM command to define one or more transformation tables to be used to formatreport data fields named on subsequent SUBTITLE or FIELD command statements.

XFORM table-name [(value-pair, ...)] ...

Certain report data fields are transformed automatically using default transformation tablesinternal to BIM-ALERT. These fields include the DATE, TIME, ACTION, and STATUSfields. For specific information about which fields are transformed by default and whichtransformation tables are used for each, refer to the chapter detailing the particular type ofreport to be run.

The table-name specifies a transformation table to be used to format report data fields namedon subsequent SUBTITLE or FIELD command statements.

Specify a one- to eight-character string value to establish the name of the table you want todefine. The name can contain any combination of printable characters except specialcharacters (see page 2-4).

Multiple table-names can be specified on a single XFORM command statement. At least onemust be specified.

Each table-name can be followed by a series of one or more value-pairs enclosed inparentheses.

• If included, these value-pairs define the table.

• If no value-pairs are included, the table-name specified is assumed to refer to a pre-defined user transformation table, which must have already been assembled, link-edited,and placed in a library available at job execution time. Refer to the example showingomitting the value-pairs on page 2-16.

(continued)

Purpose

Syntax

Usage Notes

Table-Name

Value-Pair

Page 38: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

XFORM Command Command Descriptions

2-14 Auditing and Report Writing Guide

Each value-pair consists of two values:

Specify BOTHValues(Optional) Explanation

a'value1' The first of the paired string values can be any of the following:• A 1- to 32-character value specified as C'value1'.

• A 1- to 4-byte hexadecimal value specified as X'value1'. (Ahexadecimal string must contain an even number of validhexadecimal characters.)

• The literal ELSE. This parameter is explained below. If a valueis specified (rather than ELSE), it will be compared against thecorresponding data in the input record data field.

If the string value matches the input data value, the second value inthe value-pair will be displayed on the report detail line.

If the value is shorter than the input data value, the values will becompared using the shorter length.

If the value is longer than the input data value, the values will beassumed not to match.

T'value2' The second transformation value can be any 1- to 32-character stringto be displayed in the report column or report subtitle line wheneverthe first table value matches the corresponding value in the input datafield.

Any number of paired values can be specified for a given table-name.

ELSE can be specified in the final pair of table parameters to specify a transformation value tobe used when no previous table value is matched.

If specified, the ELSE parameter should be the last value in the transformation table. Novalues listed after the ELSE parameter will be tested or used during the transformationprocess.

The following example illustrates the proper use of ELSE as the last value1 parameter.

ELSE Parameter

Page 39: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions XFORM Command

Chapter 2. Commands 2-15

The following example illustrates the use of the XFORM command to define a transformationtable to be used to represent the days of the week. It includes the ELSE parameter, properlyspecified. Assume that the input data field is a single-byte character value ranging from 1 to7.

// EXEC ALRTVREP,SIZE=256K . . XFORM WEEKDAYS ( C'1' T'SUNDAY' - C'2' T'MONDAY' - C'3' T'TUESDAY' - C'4' T'WEDNESDAY' - C'5' T'THURSDAY' - C'6' T'FRIDAY' - C'7' T'SATURDAY' - ELSE T'UNDEFINED') FIELD OPSCHDAY XFORM (WEEKDAYS) . ./*

Example 1: Use ofELSE Parameter

Page 40: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

XFORM Command Command Descriptions

2-16 Auditing and Report Writing Guide

The same transformation table can be pre-defined by assembling and link-editing a phaseusing the following JCL and input statements. Pre-defining a table in this way allows it to beused by report command statements without being recoded.

// JOB WEEKDAYT// OPTION CATAL PHASE WEEKDAYS,S,NOAUTO// EXEC ASSEMBLYWEEKDAYS CSECTEND EQU 0INLEN EQU 1ELSE EQU X'FF' DC AL1(INLEN,C'1',L'T1)T1 DC C'SUNDAY' DC AL1(INLEN,C'2',L'T2)T2 DC C'MONDAY' DC AL1(INLEN,C'3',L'T3)T3 DC C'TUESDAY' DC AL1(INLEN,C'4',L'T4)T4 DC C'WEDNESDAY' DC AL1(INLEN,C'5',L'T5)T5 DC C'THURSDAY' DC AL1(INLEN,C'6',L'T6)T6 DC C'FRIDAY' DC AL1(INLEN,C'7',L'T7)T7 DC C'SATURDAY' DC AL1(ELSE,L'T8)T8 DC C'UNDEFINED' DC AL1(END) END WEEKDAYS/*// EXEC LNKEDT,SIZE=128K/&

All value1 and value2 parameters must be immediately preceded by a one-byte length field.The ELSE parameter is represented by a single character with a value of X'FF'.

When pre-defined tables are used, the XFORM command statement can simply specify a listof table names without the table-defining value-pair values. A sample command specifyingthree pre-defined transformation table names is shown below:

// EXEC ALRTVREP,SIZE=256K . XFORM USERTAB1 USERTAB2 USERTAB3 . ./*

Example 2:Alternative Method

Example 3:Omitting the Value-Pairs

Page 41: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions REPORT Command

Chapter 2. Commands 2-17

REPORT Command

Use the REPORT command to identify the type of report to be generated and to definevarious report formatting options to customize the report output.

REPORT report-type [option] ...

The report-type parameter specifies the type of report to be generated. The following reporttypes can be specified:

ReportType Report Name Default Input Dataset

ALRTVCSC BIM-ALERT/CICS Security File Report S1SCTY

ALRTVVSC BIM-ALERT/VSE Security File Report ALERTXP

ALRTVCVI BIM-ALERT/CICS Violation Log File Report S1SECLG

ALRTVVVI BIM-ALERT/VSE Violation Log File Report AXPLOG1

ALRTVCAU BIM-ALERT/CICS Audit File Report S1SAUDT

ALRTVVAU BIM-ALERT/VSE Audit File Report S1SAUDT

Purpose

Syntax

Report-Type

Page 42: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

REPORT Command Command Descriptions

2-18 Auditing and Report Writing Guide

Immediately following the report type, any of the following optional parameters can bespecified. Specifying these parameters on the REPORT command statement overrides thecurrent report formatting and processing settings, whether they are default values or valuesspecified on the OPTIONS command statement.

Specify One or MoreOptions (Optional) Explanation

INFILE (filename) An input dataset to be used instead of the default dataset. The default dataset is determinedby the type of report specified (see page 2-17). The filename specified must appear as aJCL statement in the ALRTVREP jobstep. If the INFILE keyword is specified, theFILETYPE keyword (below) must also be specified.

FILETYPE (type, blksiz) The type and block size of the input dataset. Specify this only if a non-VSAM file is beingused as input. ALRTVREP assumes that the appropriate VSAM file (depending on the typeof report being run) is to be read as input. If a sequential disk or tape copy of one of theseVSAM datasets will be used as input, specify FILETYPE(DISK) or FILETYPE(TAPE). Ifsuch an alternate type of input file is specified, the optional blksiz parameter can bespecified. If blksiz is not specified, it defaults to 8000 for all reports except ALRTVVVI,for which it defaults to 4096. The record format must be variable-blocked for a sequentialfile. If the FILETYPE keyword is specified, the INFILE keyword must also be specified.

NOHDRPAGE Suppress printing of the report header page. For a description of the header page, see page1-12.

NOHDRDATE Suppress printing of the current date and time on the first line of each report page.

NOPAGENUM Suppress printing of the page number on the first line of each report page.

NOLABELS Suppress printing of all field column labels in the page header segment of each report detailpage.

NOTRAILER Suppress printing of the trailer page information following the last detail page of the report.For a description of the trailer page, see page 1-14.

LOGO ( xxxxxxxx ) The logo, if any, to be included on the header page of the report. Valid options are detailedon page 2-20.

DATEFORM (date-format) The format in which to print all dates in the report. Valid values are detailed on page 2-11.

TIMEFORM (time-format) The format in which to print all time values in the report. Valid values are detailed on page2-11.

PAGELEN ( xxx ) The number of lines per page to be used in formatting the report. Valid values are numbersfrom 16 to 255.

(continued)

Options

Page 43: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions REPORT Command

Chapter 2. Commands 2-19

Specify One or MoreOptions (Optional) Explanation

NOCC Suppress the use of carriage control in the report.• When carriage control is used, the first print position in each output line will be

reserved for the ANSI carriage control character.

• When carriage control is suppressed, blank lines are inserted between report detail linesto achieve the requested report formatting.

LINESPC ( x ) Report detail line spacing. Valid values are as follows:

1 Single spaced2 Double spaced3 Triple spaced

The default value is 1.

OUTFILE ( filename ) A sequential disk file to which to direct report output instead of SYSLST. This option isvalid only when used in conjunction with the EXTRACT keyword to build a flat file withno formatting of data. If specified, the filename must appear as a JCL statement in theALRTVREP jobstep.

EXTRACT Generate an output dataset containing unformatted fields extracted from input datasetrecords. When EXTRACT is specified, no header or trailer page is written, page headerinformation is suppressed, and line spacing and carriage control options are ignored. Onlydetail records will be written to the output dataset.

The output of the extraction process is directed to a dataset allocated to the DLBL filenamespecified on the OUTFILE keyword. This data might then be used as input to a reportwriting program other than the BIM-ALERT batch report writer, or for some other purpose.

Page 44: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

REPORT Command Command Descriptions

2-20 Auditing and Report Writing Guide

The following table shows the valid values for the LOGO keyword. If no logo is specified,BIMLOGO will be loaded and used. If it is not available, a default logo will be generated byALRTVREP.

If a logo is specified, the library in which it is located must be in the LIBDEF phase searchstring for the partition in which ALRTVREP is running.

Use One Value Description

JOBNAME Causes the batch job name to be printed in 12x12 banner format onthe header page.

NONE Causes the header page to be produced with no logo.

string A character string (eight byte maximum) that is one of the following:• The name of a user-created logo. The library containing the logo

must be in the LIBDEF phase search string for the partition inwhich ALRTVREP is running. (For instructions on generatinglogos using the ALRTLOGO macro, see the BIM-ALERT/CICSSecurity Administrator's Guide. If the string specified does notname a logo created using the ALRTLOGO macro, the characterstring itself will be formatted as a logo.

• The string to be formatted as a logo. If the string contains anyspecial characters (see page 2-4), it must be enclosed in singlequotes.

The following example illustrates the use of the REPORT command to produce an BIM-ALERT/CICS violation activity report with header and trailer information and single-spaceddetail lines using default ANSI carriage control. A page length of 75 is specified.

Default page header information will be printed at the top of each output page and will includethe report execution date and time, page numbers, report titles and field column labels.

// EXEC ALRTVREP,SIZE=256KOPTIONS TEST - DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL(TERMINAL:) SORTPRTY(1) - CTLBREAK(P)

. ./*

LOGO Values

Example

Page 45: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions TITLES Command

Chapter 2. Commands 2-21

TITLES Command

Use the TITLES command to define title information to be printed in the report header pageand at the top of each detail page of the report.

The TITLES command statement is optional.

TITLES string[, string...]

The TITLES command requires specification of one or more literal strings to be printed in thereport header page and at the top of each detail page. Each title string will be centered on aseparate output line.

String values must conform to the following rules:

• If the string includes any special characters (see page 2-4), it must be enclosed in singlequotes.

• A maximum of five lines of information can be specified, each with a maximum lengthof 64 characters.

• Multiple title strings must be separated by at least one blank or comma.

The TITLES command statement is optional. If it is not specified, a default two-line title,consisting of the product ID on the first line and a description of the report type on the secondline, will be printed.

Purpose

Syntax

Strings

Usage Notes

Page 46: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

TITLES Command Command Descriptions

2-22 Auditing and Report Writing Guide

Input

The TITLES command statement shown below will produce three lines of text at the top ofevery detail page of the report.

// EXEC ALRTVREP,SIZE=256KOPTIONS TEST - DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL(TERMINAL:) SORTPRTY(1) - CTLBREAK(P)

. ./*

Output

The TITLES command statement shown in the preceding figure will be formatted in thereport page header as shown below:

DATE: 03/20/1998 12:40:39 PAGE: 000001 B I M - A L E R T / C I C S VIOLATION REPORT FOR JANUARY 1998 BY TERMINAL ID DATE TIME TERMINAL TELEPHONE USER ID USER NAME VIOLATION DESCR ---- ---- -------- --------- ------- --------- --------------- 01/21/1998 09:27:34 BC22 (612) 933-2885 JACK FROST, JACK OPERATOR UNAUTHORIZED TRANSACTION - SCTY 01/28/1998 14:41:25 BC22 (612) 933-2885 JACK FROST, JACK INCORRECT OPERATOR SECURITY CODE ENTERED 01/29/1998 13:52:34 BC22 (612) 933-2885 JACK FROST, JACK - OPERATOR INACTIVE TIME LIMIT EXCEEDED -

Example

Page 47: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SUBTITLE Command

Chapter 2. Commands 2-23

SUBTITLE Command

Use the SUBTITLE command to define additional information to be printed immediatelyfollowing the title information.

SUBTITLE fieldname [option, ...]

If a SUBTITLE command statement is specified, up to five lines of output can be added tothe page header information printed at the top of each report detail page.

By using the TITLES command and multiple SUBTITLE command statements, up to tenpage header lines can be defined (five title lines and five subtitle lines).

The following table shows the valid fieldname values for the SUBTITLE commandstatement:

Specify One orMore Fieldnames Description

LITERAL (string) A literal string up to 32 characters long to be used as a subtitle. Ifthe string includes any special characters (see page 2-4), it must beenclosed in single quotes.

fieldname [label] The fieldname to be extracted from the next input record whenevera control break requires a new page header to be printed, optionallyfollowed by single literal label to accompany the data extracted. If alabel is specified, it will be printed first, followed immediately by asingle blank and the data field. The label• May consist of a maximum of 16 characters

• Must be enclosed in single quotes if it includes any specialcharacters (see page 2-4)

Purpose

Syntax

Usage Notes

Fieldname

Page 48: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SUBTITLE Command Command Descriptions

2-24 Auditing and Report Writing Guide

The following options can be used on the SUBTITLE command statement to customizereport output:

Use One or MoreOptions (Optional) Description

FORMAT ( x ) One of the following four types of formatting for the subtitle field. For an example showing howto use these values, refer to page 2-28.

SpecifyOne Value

Explanation

'C' Character. Data is moved directly from the input record to the pageheader detail line. Each non-displayable character is translated to aperiod (.).

'X' Hexadecimal. Data is converted to displayable hexadecimal format.Two character positions on the output line are required for eachcharacter in the input field.

'Z' Zoned-decimal. Up to four bytes of input data is converted to itsdisplayable EBCDIC zoned-decimal equivalent and displayed on theoutput line. Zoned-decimal output fields are displayed in zero-suppressed format. If the input field is longer than four bytes, bytepositions past the fourth are ignored.

Data fields whose binary values are negative are displayed with aminus sign before the numeric value, except one-character fields,which display as their corresponding numeric values from 0 to 255.

'T' Transformed. Some input data fields can be transformed usinginternal transformation routines or tables associated with each fieldname. Date and time values are typically transformed using specialroutines. If a transformation routine is available for the fieldnamespecified, it will always be performed by default unless overridden byan alternate formatting option. If you specify FORMAT(T) for afieldname that cannot be transformed, a warning message will appearwhen the command statement is being processed, and the defaultoutput format will be substituted.

(continued)

Options

Page 49: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SUBTITLE Command

Chapter 2. Commands 2-25

Use One or MoreOptions (Optional) Description

LABEL (value) A single label printed in the page header area immediately before the data field identified by thefieldname specified on the SUBTITLE command statement. No label is printed with thefieldname specified unless the LABEL parameter is also specified. Valid values are as follows:

Specify One Value Explanation

F (or FIELD) Causes the specified fieldname to be used as the label.

string A literal string of up to 16 characters to be used as thelabel. If it includes a special character (see page 2-4), thestring must be enclosed in single quotes.

LENGTH ( xxx ) The number of character positions to be reserved for the field data in the report page header line.Restrictions on the value are as follows:• The LENGTH specified can not exceed the LINELEN value specified on a preceding

OPTIONS or REPORT command statement. If LINELEN has not been specified, themaximum LENGTH value is 133.

• If you specify a LENGTH that exceeds the amount of data to be displayed, the default fillcharacter value of blanks will be printed following the data (to specify a different fillcharacter, use the FILLCHAR keyword described on page 2-32).

• If you specify a LENGTH that is less than the amount of character positions to be displayed,the data is truncated to the length specified.

JUSTIFY ( x ) A value indicating how displayable data (i.e., the label and the data field) is to be positioned onthe page header line. Valid values are as follows:

L Left (default)C CenteredR Right

LINE ( x ) The line in the page header area where the subtitle information is to appear. Valid values are thenumbers 1 to 5, which denote the five lines of the page header area reserved for subtitleinformation. For example, specifying a value of 2 causes a blank line to appear between thelast title line and the subtitle information.

The default value is 1. This value causes the subtitle information to appear on the lineimmediately following the last title line.

(continued)

Page 50: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SUBTITLE Command Command Descriptions

2-26 Auditing and Report Writing Guide

Use One or MoreOptions (Optional) Description

SORTPRTY ( nn ) The priority of the data field in the sort process. The value specified is subject to the followingrestrictions:• Valid values are numbers from 1 to 99; the value 1 causes the field to be given the highest

priority.

• Fields assigned equal SORTPRTY values will be given priority relative to the order in whichthe SUBTITLE commands are processed.

• The SORTPRTY can also be specified on the FIELD command statement (for a completedescription of the FIELD command, refer to page 2-31).

− If equal SORTPRTY values are assigned on FIELD and SUBTITLE commandstatements, the fieldname specified on the SUBTITLE command statement will be givenpriority.

− If no SORTPRTY keyword is specified on either a FIELD or SUBTITLE commandstatement, no sorting of data will be performed.

SORTSEQ ( xx ) The sequence in which the data field is to be sorted. Unless the SORTPRTY keyword is alsospecified, SORTSEQ will have no effect on the order in which output is presented. Valid valuesare as follows:

AS AscendingDE Descending

CTLBREAK ( x ) Cause a control break condition to be recognized and the specified action to be performedwhenever the displayable data extracted from the input record changes. Valid values are asfollows:P Skip to new page.

S Insert a blank line between output detail lines.

Y No space. This causes a control-break condition to be recognized, but no detailline spacing will be affected. Instead, this option will have the effect ofoverriding any REPCHAR specification on columns containing data matching thedata printed in the previous output line (see the description of the REPCHARkeyword on page 2-33).

All report column data will be printed on the first line of the control break with no columninformation replaced by the REPCHAR character.

It is advisable that you specify the SORTPRTY keyword on all command statements on whichyou specify CTLBREAK, but it is not required. If the field is not part of the sort sequence, theinput data field should already be in some logical sequence or a control-break condition canoccur on every detail line.

(continued)

Page 51: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SUBTITLE Command

Chapter 2. Commands 2-27

Use One or MoreOptions (Optional) Description

FILLCHAR ( 'x' ) A single displayable character to be used as filler in the space reserved for the field informationon the subtitle line. (The amount of space reserved is determined either by the default fieldlength or by the value specified on the LENGTH keyword.) If the length of displayableinformation is less than the reserved space on the line, the FILLCHAR value will be displayed inall print positions to the right. If no FILLCHAR value is specified, a blank will be used.

MISSCHAR ( 'x' ) A printable character to appear in the subtitle line whenever there is no data available to bedisplayed. This character will appear in the detail page header in the position reserved for thesubtitle field information whenever the displayable data field is blank, or if the field name is notcontained in the record being printed. If no MISSCHAR value is specified, a period (.) will beused.

XFORM (table-name) The name of a transformation table to be used to represent the data field in the report. Thetable-name specified must have been defined on a preceding XFORM command. If the inputdata field value does not match any of the values in the transformation table, the defaulttransformation table, if one exists, will be used. For more information about defaulttransformation tables, see the description of the XFORM command on page 2-13.

NOTRUNC Suppress truncation of leading and trailing blanks when character format fields are displayed andcause leading zeroes to be printed in zoned-decimal fields. Specifying the NOTRUNC keywordcauses the following actions:• When character format fields are being displayed (that is, FORMAT(C) is specified or

assumed), leading and trailing blanks are truncated before the data is positioned in the reportcolumn.

• When NOTRUNC is specified on the FIELD command statement, leading and trailingblanks will be treated as displayable characters and may appear to cause data being printed tobe shifted to the left or right in the output report column.

• When zoned-decimal output format is used (that is, FORMAT(Z) is specified or assumed),leading zeroes are normally suppressed. When NOTRUNC is specified for a zoned decimalformatted field, leading zeroes will be printed. The number of zeroes printed will be basedon the specified or assumed field length (refer to the description of the LENGTH keywordon page 2-25).

• When NOTRUNC is not specified, data fields containing all blanks will be represented bythe "missing character" (refer to the description of the MISSCHAR keyword on page 2-32).

• Specifying NOTRUNC will cause blank data fields to be printed as blanks.

Page 52: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SUBTITLE Command Command Descriptions

2-28 Auditing and Report Writing Guide

FORMAT Keyword Example

The following example illustrates the same field transformed into the four different formats.The field displayed (OPRTMLT) is the operator's inactive time limit, which is maintained inthe record as a four-byte binary time-of-day value. For this example, we will assume that theinactive time limit is 30 minutes.

// EXEC ALRTVREP,SIZE=256K . . SUBTITLE OPRTMLT FORMAT(C) - JUSTIFY(C) LINE(1) SUBTITLE OPRTMLT FORMAT(X) - JUSTIFY(C) LINE(2) SUBTITLE OPRTMLT FORMAT(Z) - JUSTIFY(C) LINE(3) NOTRUNC SUBTITLE OPRTMLT FORMAT(T) - JUSTIFY(C) LINE(4) . .

The preceding commands would produce four lines of output as follows:

....0002BF200018000000:30

(continued)

Examples

Page 53: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SUBTITLE Command

Chapter 2. Commands 2-29

General Example

The following example illustrates several options for the SUBTITLE command. Use of theLINE keyword with a value of 2 (LINE(2)) on the first SUBTITLE command statement willcause the subtitle information to appear on subtitle line 2 and a single blank line to appear inthe page header following the title information (subtitle line 1).

In addition, the specification of the SORTPRTY and CTLBREAK keywords will cause thereport to be sorted by TERMINAL and a new-page control break to be recognized when theterminal name changes.

// EXEC ALRTVREP,SIZE=256KOPTIONS DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE LITERAL ('******************') JUSTIFY(C) LINE(2)SUBTITLE LITERAL ('* *') JUSTIFY(C) LINE(3)SUBTITLE LITERAL ('******************') JUSTIFY(C) LINE(4)SUBTITLE TERMINAL LINE(3) JUSTIFY(C) - LABEL('TERMINAL:') SORTPRTY(1) - CTLBREAK(P) . ./*

The following report output was generated by commands similar to the preceding ones:

DATE: 03/20/1998 12:59:30 PAGE: 000004 B I M - A L E R T / C I C S VIOLATION REPORT FOR JANUARY 1998 BY TERMINAL ID

****************** * TERMINAL: BC22 * ****************** DATE TIME TERMINAL TELEPHONE USER ID USER NAME VIOLATION DESCR ---- ---- -------- --------- ------- --------- --------------- 01/02/1998 10:02:40 BC22 (612) 933-2885 JACK FROST ,JACK - OPERATOR NOT SIGNED ON - 01/02/1998 10:43:18 BC22 (612) 933-2885 JACK FROST ,JACK - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 01/06/1998 06:22:26 BC22 (612) 933-2885 JACK FROST ,JACK OPERATOR UNAUTHORIZED TRANSACTION - CEMT 01/06/1998 07:14:44 BC22 (612) 933-2885 JACK FROST ,JACK - OPERATOR INACTIVE TIME LIMIT EXCEEDED -

Page 54: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

FIELDS Command Command Descriptions

2-30 Auditing and Report Writing Guide

FIELDS Command

Use the FIELDS command to identify data elements to be extracted from the input dataset,formatted using default options, and printed on the report output detail line.

FIELDS fieldname1[, fieldname2 ...]

One or more valid fieldnames must be specified on the FIELDS command statement.

The fieldnames that can be specified are determined by the type of report specified on thepreceding REPORT command statement. Refer to the fieldnames listed in the chapter foreach report type.

Multiple fieldnames can be specified, separated by commas. At least one fieldname must bespecified.

When the FIELDS command is specified, default formatting options will be used for allfieldnames specified. This includes output format and length, report column labels, andoutput justification.

To customize report output (for example, to change or eliminate the column label printed forthe field, change the column width assigned to the field data, or change the justification withinthe report column of the data being printed) you must use a FIELD command for eachfieldname, rather than a FIELDS command. Refer to the description of the FIELD commandon page 2-31 for complete information about customizing report output.

Both FIELD and FIELDS commands can be specified for the same report, as illustrated bythe example on page 2-34.

The following sample input illustrates the use of the FIELDS command statement:

// EXEC ALRTVREP,SIZE=256KOPTIONS DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL('TERMINAL:') SORTPRTY(1) - CTLBREAK(P)FIELDS SEQNUM RECTYPE SYSDATE - SYSTIME OPERNAME DESCRIPT . ./*

Purpose

Syntax

Fieldnames

Usage Notes

Example

Page 55: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions FIELD Command

Chapter 2. Commands 2-31

FIELD Command

Use the FIELD command to identify a single data element to be extracted from the inputdataset, formatted, and printed on the output report detail line.

FIELD fieldname [, option ...]

Unlike the FIELDS command, the FIELD command allows you to override defaultformatting options for the fieldname specified and thereby customize report output.

The following table shows the valid values for the fieldname parameter:

Specify One Value Description

fieldname The data element to be extracted from the input dataset, formatted, and printed on the outputreport detail line. Valid fieldnames are determined by the type of report specified on thepreceding REPORT command statement. Refer to the fieldnames listed in the chapter for eachreport type.

LITERAL (string) A literal string to be included on each detail line. Although the string is not actually contained inany record, it can be useful for clarifying report data. The literal string specified will appear oneach detail line relative to the position it is assigned in the FIELD command. See page 2-34 foran example of the use of LITERAL.

The string can be no longer than 48 characters. If it includes any special characters (see page 2-4), it must be enclosed in single quotes.

No column headers will appear above any column of literal data. If a given FIELD commandspecifies LITERAL (string), it can not include the LABEL keyword to specify column headings.(The LABEL keyword is detailed on page 2-33).

Purpose

Syntax

Usage Notes

Fieldname

Page 56: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

FIELD Command Command Descriptions

2-32 Auditing and Report Writing Guide

The options shown in the following table can be used on the FIELD command statement tooverride default field formatting options, specify sorting requirements, and define reportcolumn formatting, labeling, width, and justification specifications.

Specify One or MoreOptions (Optional) Description

FORMAT ( x ) One of the four valid types of formatting for the report field. Valid values are detailed onpage 2-24.

LABEL ( xxx ) A label to be used instead of the default column header labels associated with the fieldname.Field labels appear by default in the page header at the head of the report output columnassociated with the field. Valid values are detailed on page 2-33.

LENGTH ( xxx ) The number of character positions to be reserved for the field data in the report page headerline. Restrictions on the value are detailed on page 2-25.

JUSTIFY ( x ) A value indicating how displayable data is to be positioned in the output column. Valid valuesareL LeftC CenteredR Right

By default, all data is centered within its output column, with the exception of fields defined aszoned-decimal display (FORMAT(Z)), which are zero-suppressed and right-justified.

SORTPRTY ( nn ) The priority of the data field in the sort process. Valid values are detailed on page 2-26.

SORTSEQ ( xx ) The sequence in which the data field is to be sorted. Unless the SORTPRTY keyword is alsospecified, SORTSEQ will have no effect on the order in which output is presented. Validvalues are AS (ascending) and DE (descending).

FILLCHAR ( 'x' ) A single displayable character to be used as filler in the column reserved for the fieldnameinformation on the detail line. (The amount of space reserved is determined by either thedefault field length or the value specified on the LENGTH keyword.)

If the length of displayable information is less than the report column width, the FILLCHARvalue will be displayed in all print positions to the left and to the right of displayable fieldinformation.

If no FILLCHAR value is specified, a blank will be used.

MISSCHAR ( 'x' ) A printable character to appear in the output detail line whenever there is no data available tobe displayed. It will be positioned in the report column based on the value of the JUSTIFYkeyword specified for the fieldname.

This character will appear in the output column whenever either the displayable datafieldname is blank or the fieldname is not contained in the record being printed.

If no MISSCHAR value is specified, a period (.) will be used.

(continued)

Options

Page 57: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions FIELD Command

Chapter 2. Commands 2-33

Specify One or MoreOptions (Optional) Description

REPCHAR ( 'x' ) A replacement character to appear in the output detail line whenever the fieldname outputmatches the data printed on the preceding detail line. The replacement character will continueto be printed on each detail line until either the display value changes, a control-break occurs(see CTLBREAK keyword, below), or a new-page condition occurs.

The replacement character is positioned in the report column based on the justification optiondesignated for the fieldname (refer to the description of the JUSTIFY keyword on page 2-32).

CTLBREAK ( x ) Cause a control break condition to be recognized and the specified action to be takenwhenever the displayable information in the report column changes. Valid values aredetailed on page 2-26.

XFORM (table-name) The name of a transformation table to be used to represent the data field in the report. Thetable-name specified must have been defined on a preceding XFORM command.

If the input data field value does not match any of the values in the transformation table, thedefault transformation table, if one exists, will be used. For more information about defaulttransformation tables, see the description of the XFORM command on page 2-13.

NOTRUNC Suppress truncation of leading and trailing blanks when character format fields are displayedand cause leading zeroes to be printed in zoned-decimal fields. Details about the NOTRUNCkeyword are provided on page 2-27.

The LABEL value defines the label to appear in the page header at the head of the reportoutput column associated with the field. The LABEL value can be any of the following:

Specify One Value Explanation

F (or FIELD) Replace the default column headers with the fieldname.

N (or NO) Eliminate the column header labels for this fieldname.

'label1'[,'label2','label3'] Literal strings to be used as column header labels. Amaximum of three literals can be assigned to any fieldname;they will be placed one above the other in the page headersegment of the detail page of the report. Each label can be upto 16 characters in length and must be enclosed in singlequotes if it includes any special characters (see page 2-4).

By default, labels are centered over the report column. Toleft- or right-justify labels, use a greater-than or less-than sign(> or <) as the first character in the label string. This sign willnot appear in the output report. Refer to the followingexample:

LABEL('<L-justified-Label','>R-justified-Label')

LABEL Keyword

Page 58: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

FIELD Command Command Descriptions

2-34 Auditing and Report Writing Guide

The following sample input syntax illustrates the use of various FIELD command statements.Note the combined use of the FIELD and FIELDS commands.

// EXEC ALRTVREP,SIZE=256KOPTIONS DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL('TERMINAL:') SORTPRTY(1) - CTLBREAK(P)FIELD LITERAL ('RECORD TYPE:') REPCHAR(' ')FIELD RECTYPE REPCHAR(' ')FIELDS SYSDATE SYSTIEM OPERNAME DESCRIPT . ./*

Example

Page 59: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions FILEDUMP Command

Chapter 2. Commands 2-35

FILEDUMP Command

Use the FILEDUMP command following any REPORT command to generate a series ofpre-defined SUBTITLE and FIELD command statements, which, when followed by a RUNcommand, will cause the output report to consist of a character and hexadecimal dump of thephysical input records.

FILEDUMP

The following input statements will be generated and processed by specifying theFILEDUMP command:

SUBTITLE KEY LABEL(KEY:) FORMAT(C) NOTRUNC SUBTITLE KEY LABEL(' ') LINE(2) FORMAT(X) SUBTITLE INRECNUM LABEL(REC:) LINE(3) LENGTH(6) NOTRUNC CTLBREAK(P) SUBTITLE RECLEN LABEL(LEN:) LINE(4) NOTRUNC FIELD OFFSET FIELD RECORD LABEL(NO) JUSTIFY(L) FIELD RECORD FILLCHAR(*) FORMAT(C) LENGTH(32) NOTRUNC

The records dumped can be restricted by inserting a SELECT IF command statement prior tothe RUN command.

Purpose

Syntax

CommandsGenerated

Usage Notes

Page 60: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

FILEDUMP Command Command Descriptions

2-36 Auditing and Report Writing Guide

Input

The following input syntax illustrates the correct use and placement of the FILEDUMPcommand in the sequence of input commands:

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVCVI TITLES 'RECORD DUMP' FILEDUMP SELECT IF KEY EQ C'3' RUN/*

OutputThe following sample report page will be generated when the FILEDUMP command is usedas shown in the previous commands:

DATE: 03/20/1998 13:44:14 PAGE: 000001 RECORD DUMPKEY: 3 F3REC: 002104LEN: 000150

---------------------------------- 0000 F3AF55C1 DB000000 00012423 1FC2C3F3 F3C6D3D3 40404040 4040F0F0 F0F0F0F0 *3..A.........BC33FLL 000000* 0020 F0F0F0F0 F0F0F0F0 F0F0F0F0 F0F0F0F0 F0F0F0F0 5C5C5C5C 00000000 00404040 *00000000000000000000****..... * 0040 40404040 40404040 40404040 40404040 40124040 40404040 40404040 406040D6 * . - O* 0060 D7C5D9C1 E3D6D940 D5D6E340 E2C9C7D5 C5C440D6 D5406040 40404040 40404040 *PERATOR NOT SIGNED ON - * 0080 40404040 E3C5E2E3 00000000 00000000 00000000 0000 * TEST.............. *

Example

Page 61: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SELECT IF Command

Chapter 2. Commands 2-37

SELECT IF Command

Use the SELECT IF command to limit the amount of data displayed in the report output.

A SELECT IF command statement is not required to execute a report. If specified, theSELECT IF command must be placed in the command input somewhere after the REPORTcommand and before the RUN command.

Only one SELECT IF command statement can be specified per report.

The selection criteria specified on the SELECT IF command statement are applied during theE15 sort exit processing, after the logical record has been assembled from the available fieldinput data, and before the record is passed to the sort.

SELECT IF fieldname[(+dsp,len)] [comparator - operand2[(+dsp,len)]] [connector ...]

Purpose

Usage Notes

Syntax

Page 62: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SELECT IF Command Command Descriptions

2-38 Auditing and Report Writing Guide

The following table shows the parameters for the SELECT IF command:

Parameter Description

fieldname The first comparison operand. This parameter is required. Valid valuesare determined by the report-type being executed. Refer to the chapterthat details the specified report-type.

(+dsp,len) An optional displacement value and compare length, enclosed inparentheses, for the fieldname specified. This parameter is explainedfurther through examples provided below. The displacement valuedefaults to +0 (the first character position).

comparator An optional comparison to be made between fieldname and operand2, theresult of which determines which records will be selected. Valid valuesare as follows:

EQ EqualLT Less thanLE Less than or equal toNE Not equalGT Greater thanGE Greater than or equal to

For example, specifying GT selects all records in which fieldname isgreater than operand2.

operand2 The second operand for the optional comparison. Valid values aredetailed on page 2-39.

connector A connector value, required if more than one comparison is to be made.Valid values are detailed on page 2-40.

To select output based on the second and third characters in the INITMESG field being equalto AB, specify the following command:

SELECT IF INITMESG(+1,2) EQ C'AB'

To specify a length value with a default displacement value, use a command similar to thefollowing:

SELECT IF INITMESG(2) EQ C'AB'

This command statement will be interpreted as requiring that the first two character positionsof the INITMESG field be equal to AB.

Parameters

(+dsp,len)Parameter

Page 63: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SELECT IF Command

Chapter 2. Commands 2-39

The value of the operand2 parameter can be either another fieldname or one of several literaltypes. These values are described in the following table:

Specify oneValue Description

fieldname A fieldname, which can be specified with displacement and length values (+dsp,len), as described onpage 2-38.

C'cccc' Data in character format. A string of up to 32 characters can be specified within the single quotes.

N'nnnn' Numeric data, which will be converted to the proper format for a valid compare (packed, binary, and soon) automatically. This format is governed by how the data is stored in the record. A string of up to 16numeric characters can be specified within the single quotes.

X'xxxx' A hexadecimal value. The maximum string length enclosed in the single quotes is eight bytes(representing four data bytes). Each string must be composed of an even number of hexadecimalcharacter values (i.e., 0-9, A-F).

T'tttt' A transformed value. The input data represented by fieldname is to be transformed into its displayableform before the comparison is made. A string of up to 32 characters can be contained in the singlequotes.

If the fieldname cannot be transformed, the comparison is made to the unmodified contents of the datarepresented by the fieldname.

D'mm/dd/yyyy' A date value. If fieldname contains date information, it can be compared to the literal value enclosed inthe single quotes.

Each date value is transformed internally to a binary value before comparisons are performed. This valuerepresents a date in the range January 01, 1900 to December 31, 2041. Dates that fall outside this rangeare assigned one of those extreme values.

The format used to designate a date value must match the date format assigned to the report itself (see thedescription of the DATEFORM keyword on page 2-11). If you have not specified a DATEFORM to beused, the default MM/DD/YYYY format should be used.

yy values 42 - 99 are taken to represent the years 1942 to 1999. yy values 00 - 41 are taken to representthe years 2000 to 2041.

Example: To select records whose SYSDATE field falls in the month of January, 1998, use thefollowing command:SELECT IF SYSDATE GE D'01/01/1998' AND SYSDATE LE D'01/31/1998'

(continued)

Operand2 Values

Page 64: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SELECT IF Command Command Descriptions

2-40 Auditing and Report Writing Guide

Specify OneValue Description

H'hh:mm' A time value. If fieldname contains time information, it may be compared to the literal time valueenclosed in the single quotes.

Each time value is transformed internally to a binary value representing the number of seconds since thepreceding midnight before comparisons are performed. Time value literals are based on a 24-hour clocktime.

The format you use to designate a time value must match the time format assigned to the report itself (seethe description of the TIMEFORM keyword on page 2-11). If you have not specified a TIMEFORM tobe used, the default HH:MM format should be used.

Example: To select records whose SYSTIME field is in the range 11:00 a.m. to 2:00 p.m., use thefollowing command:SELECT IF SYSTIME GE H'11:00' AND SYSTIME LE H'14:00'

The two valid connector values are the following:

Field Meaning

AND Select the record if both the preceding and the following comparisons are true.

OR Select the record if either the preceding or the following comparison is true (or ifboth are true).

Boolean syntax rules apply to all comparisons linked by connector values. Note the followingrules:

• Expressions linked by AND are evaluated as a group before expressions linked by OR.

• You can override this default priority by enclosing one or more expressions inparentheses. Expressions enclosed in parentheses are evaluated first.

• Parentheses can not be nested.

Connector Values

Page 65: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions SELECT IF Command

Chapter 2. Commands 2-41

For example, suppose the fieldnames of a record have the following values:

• FIELD1 C'1'• FIELD2 C'2'• FIELD3 C'A'

Given these values, the following SELECT IF statements would have the specified results:

SELECT IF Statement Result and ExplanationSELECT IF FIELD1 EQ C'1' AND - FIELD2 EQ C'2' AND - FIELD3 EQ C'Z'

The record will NOT be selected. All threecomparisons must be true for the record to beselected. Since it is false that FIELD3=Z, therecord will not be selected.

SELECT IF FIELD1 EQ C'1' OR - FIELD2 EQ C'9' OR - FIELD3 EQ C'Z'

The record will be selected. Only one of thecomparisons must be true for the record to beselected. Since FIELD1=1, the record will beselected.

SELECT IF FIELD1 EQ C'1' OR - (FIELD2 EQ C'9' OR - FIELD3 EQ C'Z')

The record will be selected. Although theparentheses cause the second OR to be evaluatedfirst, only one of the comparisons need be truefor the record to be selected, as in the previousexample. Since FIELD1=1, the record will beselected.

SELECT IF FIELD1 EQ C'9' AND - FIELD2 EQ C'9' OR FIELD3 EQC'A'

The record will be selected. Although it is falsethat both FIELD1=9 and FIELD2=9, it is truethat FIELD3=A. Therefore the comparison istrue.

SELECT IF FIELD1 EQ C'9' AND - (FIELD2 EQ C'9' OR - FIELD3 EQ C'A')

The record will NOT be selected. Although it istrue that either FIELD2=9 or FIELD3=A(because FIELD3=A), it is false that FIELD1=9.Therefore the comparison is false.

Sample BooleanComparisons

Page 66: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SELECT IF Command Command Descriptions

2-42 Auditing and Report Writing Guide

The following sample input illustrates the use of a SELECT IF command statement:

// EXEC ALRTVREP,SIZE=256KOPTIONS DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL(TERMINAL:) SORTPRTY(1) - CTLBREAK(P)FIELD LITERAL ('RECORD TYPE:') REPCHAR(' ')FIELD RECTYPE REPCHAR(' ')FIELDS SYSDATE SYSTIME OPERNAME DESCRIPTSELECT IF RECTYPE EQ C'3' AND - SYSDATE GE D'01/01/1998' AND - SYSDATE LE D'01/31/1998' . ./*

Note that the format of the date defined in the OPTIONS command statement matches theformat of the date literal value shown on the SELECT IF command statement.

Example

Page 67: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Command Descriptions RUN Command

Chapter 2. Commands 2-43

RUN Command

Use the RUN command to initiate the report generation process.

The RUN command is required.

RUN

The RUN command must be placed on a line by itself with no accompanying keywords orkeyword values.

Place the RUN command after the REPORT command that identifies the report to beexecuted, and also after any OPTIONS, TITLES, FIELD, FIELDS, and SELECT IFcommands used to define and customize the report.

Whenever a RUN command is encountered, all OPTIONS, REPORT, TITLES, FIELD,FIELDS, and SELECT IF command information processed up to that point is combined tomake up a report definition, which is then passed to the report generation program forexecution.

If OPTIONS TEST has been specified, the report generation process is not invoked, and noinput dataset is opened for processing. Rather, a detailed report definition analysis isformatted and displayed as output, along with a sample of how such a report might appear.

Multiple RUN command statements can be specified to generate more than one report. Byplacing TITLES, FIELD, FIELDS, or SELECT IF command statements between the RUNcommands, some or all of the information relating to the preceding report can be replacedbefore the next report is generated.

Purpose

Syntax

Usage Notes

Page 68: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

RUN Command Command Descriptions

2-44 Auditing and Report Writing Guide

Input

The following example shows the generation of two similar reports by repeating the RUNcommand without respecifying all command statements:

// EXEC ALRTVREP,SIZE=256KOPTIONS DATEFORM(MM,/,DD,/,YYYY) - TIMEFORM(HH,:,MM,:,SS)REPORT ALRTVCVI - PAGELEN(75) LOGO(JOBNAME)TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR JANUARY 1998' - 'BY TERMINAL ID')SUBTITLE TERMINAL LINE(2) JUSTIFY(C) - LABEL(TERMINAL:) SORTPRTY(1) - CTLBREAK(P)FIELD LITERAL ('RECORD TYPE:') REPCHAR(' ')FIELD RECTYPE REPCHAR(' ')FIELDS SYSDATE SYSTIME OPERNAME DESCRIPTSELECT IF RECTYPE EQ C'3' AND - SYSDATE GE D'01/01/1998' AND - SYSDATE LE D'01/31/1998'RUN

TITLES ('B I M - A L E R T / C I C S' - 'VIOLATION REPORT FOR FEBRUARY 1998' - 'BY TERMINAL ID')SELECT IF RECTYPE EQ C'3' AND - SYSDATE GE D'02/01/1998' AND - SYSDATE LE D'02/28/1998'RUN/*

Output

The following report shows sample output from the second report that would be generatedfrom such a sequence of input command statements:

B I M - A L E R T / C I C S VIOLATION REPORT FOR FEBRUARY 1998 BY TERMINAL ID

TERMINAL: BC31 SYSTEM RECORD CREATION LOG OPERATOR VIOLATION TYPE DATE TIME NAME DESCRIPTION ------ -------- ------ -------- ----------- RECORD TYPE: VIOLATION 02/25/1998 11:53:41 FROST, JACK OPERATOR UNAUTHORIZED TRANSACTION - CEMT 02/28/1998 14:44:12 FROST, JACK INCORRECT OPERATOR SECURITY CODE ENTERED 02/28/1998 14:49:53 FROST, JACK OPERATOR UNAUTHORIZED TRANSACTION - CSMT

Example

Page 69: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

3-1

3

ALRTVCSC Security File Report (CICS)

This chapter describes the ALRTVCSC security file report, which you can use to select anddisplay information from the BIM-ALERT/CICS security file. (User profile information fromboth BIM-ALERT/CICS and BIM-ALERT/VSE is available.)

Introduction....................................................................................................................3-3General Information...................................................................................................3-3Sample JCL................................................................................................................3-3Input Record Description...........................................................................................3-4Field Information .......................................................................................................3-9

Fieldname List..............................................................................................................3-11Common Segment Fields .........................................................................................3-11Transaction Record Fields .......................................................................................3-15Program Record Fields ............................................................................................3-17File Record Fields....................................................................................................3-19Map Record Fields...................................................................................................3-21Location Record Fields............................................................................................3-24Terminal Record Fields ...........................................................................................3-27Operator Record Fields............................................................................................3-58Field Resource Information Fields...........................................................................3-99Field Resource Security Information Fields...........................................................3-106Group Security Information Fields ........................................................................3-110User Group Record Fields .....................................................................................3-119User Profile Record Fields.....................................................................................3-122

Sample ALRTVCSC Reports.....................................................................................3-126Introduction ...........................................................................................................3-126S1B500 System Transaction Security Report ........................................................3-126

Page 70: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

3-2 Auditing and Report Writing Guide

S1B510 System Program Security Report .............................................................3-128S1B520 System File Security Report.....................................................................3-129S1B530 System Map Display Security Report ......................................................3-130S1B540 Organizational Information Report ..........................................................3-131Operator and Terminal Reports .............................................................................3-132Operator Security Report - Access Time Report....................................................3-133Operator Authorization Report ..............................................................................3-135Operator Sign-On Report .......................................................................................3-136

Page 71: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction General Information

Chapter 3. ALRTVCSC Security File Report (CICS) 3-3

Introduction

General Information

Security information contained in the BIM-ALERT/CICS security file is available forselection and display in the ALRTVCSC report type. User profile information is availablefrom both BIM-ALERT/CICS and BIM-ALERT/VSE.

This report type requires the BIM-ALERT/CICS security file, or a VSAM copy of the file, asinput.

The phase ALRTVCSC is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVCSC reads the input file and formats the data for thereport.

Sample JCL

The following sample JCL can be used to execute any ALRTVCSC report:

// JOB ALRTVCSC BIM-ALERT/CICS security file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// EXEC ALRTVREP,SIZE=256K . ./*/&

Report Description

Input Dataset

I/O Module Name

Page 72: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

3-4 Auditing and Report Writing Guide

Input Record Description

Each BIM-ALERT/CICS security file record contains a 50-byte record key and one of severalsubordinate information field types (segments), determined by the contents of the RECTYPEfield in the record key.

The transaction security record defines a single CICS transaction and a 30-characterdescription of the transaction.

The program security record defines a single CICS program name and a 30-characterdescription of the program.

The file security record defines a single CICS file name and a 30-character description of thefile.

The map security record defines a single CICS map name and related security information.

Map Field Information (Type 04010000)This segment, contained in the type 04 map security information record, identifies the variousmap field elements required to secure individual fields within a map.

The 04010000 segment is a variable-occurrence segment. In other words, the segment canoccur several times within the parent map information record.

When a fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every occurrence of the segmentin the input record.

See the individual fieldname definitions for more information.

The location security record defines a single user-defined location and related securityinformation.

The terminal security record defines a single CICS terminal name and related securityinformation. See the corresponding fieldname definitions for more information.

ALERT-Transaction Information (Type 06010000)

Introduction

TransactionSecurityInformation (Type01000000)

Program SecurityInformation (Type02000000)

File SecurityInformation (Type03000000)

Map SecurityInformation (Type04000000)

Location SecurityInformation (Type05000000)

Terminal SecurityInformation (Type06000000)

Page 73: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 3. ALRTVCSC Security File Report (CICS) 3-5

This segment defines the CICS transaction IDs for which automatic log records will begenerated when entered from this terminal. It is a variable-occurrence segment. Thefieldnames defined within this segment can occur up to six times within the parent terminalinformation record (once for each CICS transaction ID defined).

When the fieldname defined within this segment is included in a FIELD or FIELDScommand statement, one report output detail line will be generated for every CICS transactionID so defined.

Terminal Schedule Information (Type 06020000)This segment defines the scheduled dates and times during which the terminal can be used. Itis a multiple-occurrence segment. The fieldnames defined within this segment occur seventimes within the parent terminal information record (once for each day of the week).

When a fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every occurrence of the segmentin the input record.

Authorized Transaction Information (Type 06030000)This segment defines the CICS transactions that can be entered from this terminal. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach CICS transaction ID authorized for this terminal.

When the fieldname defined within this segment is included in a FIELD or FIELDScommand statement, one report output detail line will be generated for every CICS transactionID authorized.

Authorized Program Information (Type 06040000)This segment defines the CICS programs that can be accessed from this terminal. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach CICS program name authorized for this terminal. When the fieldname defined withinthis segment is included in a FIELD or FIELDS command statement, one report output detailline will be generated for every CICS program name authorized.

Authorized File Information (Type 06050000)This segment defines the CICS file names that can be accessed from this terminal. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach CICS file name authorized for this terminal.

When the fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every CICS file name authorized.

Restricted Map Information (Type 06060000)This segment defines the CICS map names that can be accessed from this terminal. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach CICS map name restricted for this terminal.

When the fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every CICS map name restricted.

Page 74: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

3-6 Auditing and Report Writing Guide

The operator security record defines a single CICS operator and related security information.See the corresponding fieldname definitions for more information.

ALERT-Transaction Information (Type 07010000)This segment defines the CICS transaction IDs for which automatic log records will begenerated whenever executed by this operator. It is a variable-occurrence segment. Thefieldname defined within this segment can occur up to six times within the parent operatorinformation record (once for each CICS transaction ID defined).

When the fieldname defined within this segment is included in a FIELD or FIELDScommand statement, one report output detail line will be generated for every CICS transactionID so defined.

Operator Schedule Information (Type 07020000)This segment defines the scheduled dates and times during which the operator can sign on tothe CICS system. It is a multiple-occurrence segment. The fieldnames defined within thissegment occur seven times within the parent operator information record (once for each day ofthe week).

When a fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every occurrence of the segmentin the input record.

Authorized Transaction Information (Type 07030000)This segment defines the CICS transactions that this operator can execute. It is a variable-occurrence segment. The fieldname defined within this segment type occurs once for eachCICS transaction ID authorized for this operator.

When the fieldname defined within this segment is included in a FIELD or FIELDScommand statement, one report output detail line will be generated for every CICS transactionID authorized.

Authorized Program Information (Type 07040000)This segment defines the CICS programs that are authorized for this operator. It is a variable-occurrence segment. The fieldname defined within this segment type occurs once for eachCICS program name authorized for this operator.

When the fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every CICS program nameauthorized.

Authorized File Information (Type 07050000)This segment defines the CICS file names that are authorized for this operator. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach CICS file name authorized for this operator.

When the fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every CICS file name authorized.

Authorized Map Information (Type 07060000)

Operator SecurityInformation (Type07000000)

Page 75: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 3. ALRTVCSC Security File Report (CICS) 3-7

This segment defines the CICS map names that are restricted for this operator. It is a variable-occurrence segment. The fieldname defined within this segment type occurs once for eachCICS map name restricted for this operator.

When the fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for every CICS map name restricted.

Authorized Field Resource Information (Type 07070000)This segment defines the field-level resources that are authorized for this operator. It is avariable-occurrence segment. The fieldname defined within this segment type occurs once foreach field resource authorized for this operator. When the fieldname defined within thissegment is included in a FIELD or FIELDS command statement, one report output detail linewill be generated for every field resource authorized.

The field resource security record defines a single resource based upon the value for VSAMfiles of a field (or fields) within a VSAM record.

Field Segment Information (Type 08010000)This segment identifies the various data fields that define a field resource for VSAM files. Itis a variable-occurrence segment. The fieldnames defined within this segment may occur upto five times. When a fieldname defined within this segment is included in a FIELD orFIELDS command statement, one report output detail line will be generated for everyoccurence of the segment in the input record.

The field resource security record defines a single resource based upon the value for BMSmaps of a field (or fields) within a BMS map.

Field Segment Information (Type 09010000)This segment identifies the various data fields that define a field resource for BMS maps. It isa variable-occurrence segment. The fieldnames defined within this segment may occur up tofive times. When a fieldname defined within this segment is included in a FIELD or FIELDScommand statement, one report output detail line will be generated for every occurence of thesegment in the input record.

The group security record defines a way to treat several resources (transactions, maps, etc.) asa single resource. Thus, an operator who is authorized to have access to a group is authorizedto have access to any resource within that group.

Group Alert-Transaction Information (Type 0A010000)This segment defines the CICS transaction IDs that exist in the group. These transaction IDswill be automatically logged to the violation file whenever this operator executes them. The0A010000 segment is a variable-occurrence segment. The fieldnames defined within thissegment may occur up to six times within the parent group record. When a fieldname definedwithin this segment is included in a FIELD or FIELDS command statement, one report outputdetail line will be generated for every occurence of the segment in the input record. See the0A010000 fieldname definitions for more information.

Group Authorized Transaction Information (Type 0A030000)

Resource FieldInformation forVSAM Files (Type08000000)

Field ResourceSecurityInformation (Type09000000)

Group SecurityInformation (Type0A000000)

Page 76: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

3-8 Auditing and Report Writing Guide

This segment defines the CICS transactions that exist in the group. These transactions may beexeucted by an operator who is authorized access to the group. The 0A030000 segment is avariable occurrence segment. The fieldnames defined within this segment type occur once foreach transaction defined within this group. When a fieldname defined within this segment isincluded in a FIELD or FIELDS command statement, one report output detail line will begenerated for every occurence of the segment in the input record. See the 0A030000fieldname definitions for more information.

Group Authorized Program Information (Type 0A040000)This segment defines the CICS programs that exist in the group. These programs may beexeucted by an operator who is authorized access to the group. The 0A040000 segment is avariable occurrence segment. The fieldnames defined within this segment type occur once foreach program defined within this group. When a fieldname defined within this segment isincluded in a FIELD or FIELDS command statement, one report output detail line will begenerated for every occurence of the segment in the input record. See the 0A040000fieldname definitions for more information.

Group Authorized File Information (Type 0A050000)This segment defines the CICS files that exist in the group. These files may be exeucted by anoperator who is authorized access to the group. The 0A050000 segment is a variableoccurrence segment. The fieldnames defined within this segment type occur once for each filedefined within this group. When a fieldname defined within this segment is included in aFIELD or FIELDS command statement, one report output detail line will be generated forevery occurence of the segment in the input record. See the 0A050000 fieldname definitionsfor more information.

Group Authorized Map Information (Type 0A060000)This segment defines the CICS map names that exist in the group. These maps are restrictedfor the operator who is authorized access to the group. The 0A060000 segment is a variableoccurrence segment. The fieldnames defined within this segment type occur once for eachBMS map defined within this group. When a fieldname defined within this segment isincluded in a FIELD or FIELDS command statement, one report output detail line will begenerated for every occurence of the segment in the input record. See the 0A060000fieldname definitions for more information.

Group Authorized Field Information (Type 0A070000)This segment defines the field resources that exist in the group. These field resources may beaccessed by an operator who is authorized access to the group. The 0A070000 segment is avariable occurrence segment. The fieldnames defined within this segment type occur once foreach field resource defined within this group. When a fieldname defined within this segmentis included in a FIELD or FIELDS command statement, one report output detail line will begenerated for every occurence of the segment in the input record. See the 0A070000fieldname definitions for more information.

Page 77: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Field Information

Chapter 3. ALRTVCSC Security File Report (CICS) 3-9

Field Information

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default or user specifications. Each data field is selected from a pre-defined list of ALRTVCSC fieldnames.

At report generation time, each fieldname specified is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to each selected fieldname is located, extracted from the physical inputrecord by the ALRTVCSC I/O module, and moved to, or transformed into, the appropriateoutput report column, using either the default values described in the fieldname entries orthose specified by the user in a FIELD command statement.

The following information is provided for each ALRTVCSC fieldname (if applicable):

Heading Description

Group Field: YES Indicates that the fieldname being defined is a fieldname containing several individual fieldnameswithin the group. The individual fieldnames are listed.• If the fieldname is specified in a SUBTITLE, FIELD, or FIELDS command statement, input

data represented by all individual fieldnames within the group will be printed as a single field.

• If the individual fieldnames are specified in a command statement, each fieldname is assigned itsown column in the report output detail line.

Field type Each fieldname is defined as a particular field type. By definition, type 00000000 information ispresent in every input record. Following the type 00000000 common segment information,ALRTVCSC records will contain one subordinate type of field information, type 01000000 to07000000, containing information as indicated by the RECTYPE field.

Default label-n Default label information is positioned in the output report, if requested, at the top of each page ofoutput. Up to three labels can be specified for each field; they will be placed above the reportcolumn reserved for the fieldname.

Occurrences:variable

Indicates that the field is defined within a variable-occurrence segment. This fieldname, if includedon any FIELD or FIELDS command statement, will generate a report detail line for everyoccurrence of the information in the record.

Belongs to group Indicates a higher level group fieldname, which can be included on any SUBTITLE, FIELD, orFIELDS command statement to display the data represented by this fieldname.

(continued)

Page 78: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Information Introduction

3-10 Auditing and Report Writing Guide

Heading Description

Input data length Represents the defined length of the data in the input record corresponding to the fieldname. If thelength is indicated as variable, then the length of the data field has no pre-defined length, and theamount of data present is defined in each individual input record.

Input data format Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default outputlength

This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be increased or decreased by the use of the LENGTH keyword on a FIELD commandstatement.

Default outputformat

One of the following output formats is assigned by default for each fieldname; it determines howthe data will appear in the output report:

C Character. The input data is simply moved from the input record to the report detail line.Each non-printable character is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-characterhexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is treated as a binary numberand converted to its decimal equivalent. By default, zoned-decimal formatted outputfields are zero-suppressed and right-justified in the report column. Users can override thefield justification value by using the JUSTIFY keyword on the FIELD commandstatement. Zero-suppression can be overridden by specifying NOTRUNC on the FIELDor SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forth inthe transformation table shown, or as determined by some other programmedtransformation algorithm, such as that performed on BIM-ALERT/CICS TERMPHONfield.

Users can override the field output format value by using the FORMAT keyword on the FIELDcommand statement.

Page 79: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-11

Fieldname List

Common Segment Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the common segment of allinput records and will be printed on all detail lines when appropriate.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label-1: RECORD KEYInput data length: 18Input data format: Hexadecimal (X)Default output data length: 36Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: RECORDDefault label-3: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 6Default output data format: Zoned-decimal (Z)

DSNAME Input file dataset name.

Field type: 00000000 - Common segment informationDefault label-1: INPUT DSNAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

(continued)

Page 80: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

3-12 Auditing and Report Writing Guide

Field Description

RECTYPE Input record type, which indicates what type of security information iscontained in the security file record.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: TYPEInput data length: 2Input data format: Character (C)Default output length: 11Default output format: Transformed (T)C'TX'...........T'TRANSACT-PFX'C'TR'...........T'TRANSACTION'C'PX'...........T'PROGRAM-PFX'C'PR'...........T'PROGRAM'C'FX'...........T'FILE-PFX'C'FL'...........T'FILE'C'MX'...........T'MAP-PFX'C'MP'...........T'MAP'C'LO'...........T'LOCATION'C'DV'...........T'TERMINAL'C'OP'...........T'OPERATOR'C'SC'...........T'PASSWD-HIST'C'RX'...........T'FIELD-RES-PFX'C'RS'...........T'FLD RESOURCE'C'UG'...........T'USER GROUP'C'GR'...........T'GROUP RESOURCE'C'UP'...........T'USER PROFILE'

(continued)

Page 81: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-13

Field Description

INFOTYPE Information type. This describes the type of information contained inthe field or record.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X)Default output length: 23Default output format: Transformed (T)X'00000000'.....T'Common segment information'X'01000000'.....T'Transaction information'X'02000000'.....T'Program information'X'03000000'.....T'File information'X'04000000'.....T'Map information'X'04010000'.....T'Map field information'X'05000000'.....T'Location information'X'06000000'.....T'Terminal information'X'06010000'.....T'Terminal Alert-transaction information'X'06020000'.....T'Terminal Schedule information'X'06030000'.....T'Terminal Tranid auth information'X'06040000'.....T'Terminal Program auth information'X'06050000'.....T'Terminal File autho information'X'06060000'.....T'Terminal Map auth information'X'07000000'.....T'Operator information'X'07010000'.....T'Operator Alert-transaction information'X'07020000'.....T'Operator Schedule information'X'07030000'.....T'Operator Transaction ID auth information'X'07040000'.....T'Operator Program auth information'X'07050000'.....T'Operator File auth information'X'07060000'.....T'Operator Map auth information'X'07070000'.....T'Operator Field auth information'X'08000000'.....T'Field information'X'08010000'.....T'Field segment information'X'09000000'.....T'Field information'X'09010000'.....T'Operator Map auth information'X'0A000000'.....T'Group information'X'0A010000'.....T'Group Alert-transaction information'X'0A030000'.....T'Group Transaction auth information'X'0A040000'.....T'Group Program auth information'X'0A050000'.....T'Group File auth information'X'0A060000'.....T'Group Map auth information'X'0A070000'.....T'Group Field auth information'X'0B000000'.....T'User-Group auth information'X'0B010000'.....T'User-Group Alert-tran auth information'X'0B020000'.....T'User-Group Transaction auth information'X'0C000000'.....T'User-Profile information'

(continued)

Page 82: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

3-14 Auditing and Report Writing Guide

Field Description

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: noneInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 4Default output format: Zoned-decimal (Z)

INRECNUM Physical input record sequence number, assigned by the ALRTVCSCI/O module when the input record is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 4Default output format: Zoned-decimal (Z)

Page 83: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Transaction Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-15

Transaction Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVCSC input filetransaction records (RECTYPE EQ C'TR', segment X'01000000'). These fields will beprinted only on report detail lines with other transaction record and common segmentfieldnames.

Field Description

TRANSID Transaction ID being secured.

Field type: 01000000 - Transaction informationDefault label-1: TRANDefault label-2: CODEInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRANNBR Transaction number, used internally by BIM-ALERT/CICS.

Default label-1: TRANSACTNDefault label-2: NUMBERField type: 01000000 - Transaction informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

TRANSEQ Transaction sequence number, used internally by BIM-ALERT/CICS.

Default label-1: TRANSACTNDefault label-2: SEQUENCEDefault label-3: NUMBERField type: 01000000 - Transaction informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

(continued)

Page 84: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Transaction Record Fields Fieldname List

3-16 Auditing and Report Writing Guide

Field Description

TRFRTIME Transaction's scheduled "from" time.

Default label-1: TRANSACTNDefault label-2: FROMDefault label-3: TIMEField type: 01000000 - Transaction informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TRTOTIME Transaction's scheduled "to" time.

Default label-1: TRANSACTNDefault label-2: TODefault label-3: TIMEField type: 01000000 - Transaction informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TRSTATUS Transaction status.

Default label-1: TRANSACTNDefault label-2: STATUSField type: 01000000 - Transaction informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'C'M'............T'MONITOR'C'S'............T'SAFE'C'P'............T'PRELOADED'

TRDESCR Transaction description.

Default label-1: TRANSACTNDefault label-2: DESCRIPTIONField type: 01000000 - Transaction informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Page 85: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Program Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-17

Program Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVCSC input fileprogram records (RECTYPE EQ C'PR', segment X'02000000'). These fields will be printedonly on report detail lines with other program record and common segment fieldnames.

Field Description

PROGNAME Program name.

Default label-1: PROGRAMDefault label-2: NAMEField type: 02000000 - Program informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

PROGNUM Program number, used internally by BIM-ALERT/CICS.

Default label-1: PROGRAMDefault label-2: NUMBERField type: 02000000 - Program informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

PROGSEQ Program sequence number, used internally by BIM-ALERT/CICS.

Default label-1: PROGRAMDefault label-2: SEQUENCEDefault label-3: NUMBERField type: 02000000 - Program informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

(continued)

Page 86: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Program Record Fields Fieldname List

3-18 Auditing and Report Writing Guide

Field Description

PROGFTIM Program's scheduled "from" time.

Default label-1: PROGRAMDefault label-2: FROMDefault label-3: TIMEField type: 02000000 - Program informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

PROGTTIM Program's scheduled "to" time.

Default label-1: PROGRAMDefault label-2: TODefault label-3: TIMEField type: 02000000 - Program informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

PROGSTAT Program's status.

Default label-1: PROGRAMDefault label-2: STATUSField type: 02000000 - Program informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'C'M'............T'MONITOR'C'P'............T'PRELOADED'

PROGDESC Program description.

Default label-1: PROGRAMDefault label-2: DESCRIPTIONField type: 02000000 - Program informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Page 87: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List File Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-19

File Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the file records of theALRTVCSC input file (RECTYPE EQ C'FL', segment X'03000000'). These fields will beprinted only on report detail lines with other file record and common segment fieldnames.

Field Description

FILENAME File name.

Default label-1: FILEDefault label-2: NAMEField type: 03000000 - File informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

FILENUM File number, used internally by BIM-ALERT/CICS.

Default label-1: FILEDefault label-2: NUMBERField type: 03000000 - File informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

FILESEQ File sequence number, used internally by BIM-ALERT/CICS.

Default label-1: FILEDefault label-2: SEQUENCEDefault label-3: NUMBERField type: 03000000 - File informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

FILEFTIM File's scheduled "from" time.

Default label-1: FILEDefault label-2: FROMDefault label-3: TIMEField type: 03000000 - File informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 88: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

File Record Fields Fieldname List

3-20 Auditing and Report Writing Guide

Field Description

FILETTIM File's scheduled "to" time.

Default label-1: FILEDefault label-2: TODefault label-3: TIMEField type: 03000000 - File informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

FILESTAT File's status.

Default label-1: FILEDefault label-2: STATUSField type: 03000000 - File informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'C'M'............T'MONITOR'C'P'............T'PRELOADED'

FILEPROC File process type.

Default label-1: FILEDefault label-2: PROCESSDefault label-3: TYPEField type: 03000000 - File informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'U'............T'UPDATE'C'I'............T'INQUIRY'

FILEDESC File description.

Default label-1: FILEDefault label-2: DESCRIPTIONField type: 03000000 - File informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Page 89: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Map Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-21

Map Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVCSC input filemap records (RECTYPE EQ C'MP', segment X'04000000'). These fields will be printed onlyon report detail lines with other map record and common segment fieldnames.

Field Description

MAPNAME Map name.

Default label-1: MAPDefault label-2: NAMEField type: 04000000 - Map informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

MAPNUM Map number, used internally by BIM-ALERT/CICS.

Default label-1: MAPDefault label-2: NUMBERField type: 04000000 - Map informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

MAPSEQ Map sequence number, used internally by BIM-ALERT/CICS.

Default label-1: MAPDefault label-2: SEQUENCEDefault label-3: NUMBERField type: 04000000 - Map informationInput data length: 4Input data format: Packed decimal (P)Default output length: 7Default output format: Zoned-decimal (Z)

(continued)

Page 90: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Map Record Fields Fieldname List

3-22 Auditing and Report Writing Guide

Field Description

MAPSET Mapset name.

Default label-1: MAPSETDefault label-2: NAMEField type: 04000000 - Map informationInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

MAPTITLE Map description.

Default label-1: MAPDefault label-2: TITLEField type: 04000000 - Map informationInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

MAPSTAT Map's status.

Default label-1: MAPDefault label-2: STATUSField type: 04000000 - Map informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'

MAPFDNUM Map restricted field number.

Default label-1: MAPDefault label-2: FLDDefault label-3: NUMOccurrences: VariableField type: 04010000 - Map field informationInput data length: 2Input data format: Packed-decimal (P)Default output length: 3Default output format: Zoned-decimal (Z)

(continued)

Page 91: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Map Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-23

Field Description

MAPFDISP Map restricted field display indicator.

Default label-1: MAPDefault label-2: FLDDefault label-3: DSPLOccurrences: VariableField type: 04010000 - Map field informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO'

MAPFDSCR Map restricted field description.

Default label-1: MAPDefault label-2: FIELDDefault label-3: DESCRIPTIONOccurrences: VariableField type: 04010000 - Map field informationInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

Page 92: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Location Record Fields Fieldname List

3-24 Auditing and Report Writing Guide

Location Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVCSC input filelocation records (RECTYPE EQ C'LO', segment X'05000000'). These fields will be printedonly on report detail lines with other location record and common segment fieldnames.

Field Description

LOCATION Location code.

Group Field: YES - Input data represented by the following fieldnameswill be printed under the LOCATION column heading:

COMPANY DIVISION DEPARTMT SECTION

Data represented by these fieldnames can be printed in separate reportcolumns by including the individual fieldnames instead of the groupfieldname in the SUBTITLE, FIELD or FIELDS command statement.

Default label-1: LOCATIONField type: 05000000 - Location informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

COMPANY Company number.

Belongs to group: LOCATIONDefault label-1: COMPDefault label-2: NUMField type: 05000000 - Location informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

COMPNAME Company name.

Default label-1: COMPANY NAMEField type: 05000000 - Location informationInput data length: 4Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

(continued)

Page 93: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Location Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-25

Field Description

DIVISION Division number.

Belongs to group: LOCATIONDefault label-1: DIV.Default label-2: NUMField type: 05000000 - Location informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

DIVNAME Division name.

Default label-1: DIVISION NAMEField type: 05000000 - Location informationInput data length: 8Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

DEPARTMT Department number.

Belongs to group: LOCATIONDefault label-1: DEPTDefault label-2: NUMField type: 05000000 - Location informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

DEPTNAME Department name.

Default label-1: DEPARTMENT NAMEField type: 05000000 - Location informationInput data length: 12Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

SECTION Section number.

Belongs to group: LOCATIONDefault label-1: SECTDefault label-2: NUMField type: 05000000 - Location informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 94: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Location Record Fields Fieldname List

3-26 Auditing and Report Writing Guide

Field Description

SECTNAME Section name.

Default label-1: SECTION NAMEField type: 05000000 - Location informationInput data length: 16Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

LOCSTAT Location status.

Default label-1: LOCDefault label-2: STATUSField type: 05000000 - Location informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'

LOCNAME Location name.

Default label-1: LOCATIONDefault label-2: NAMEField type: 05000000 - Location informationInput data length: 35Input data format: Character (C)Default output length: 35Default output format: Character (C)

Page 95: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-27

Terminal Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVCSC input fileterminal records (RECTYPE EQ C'DV', segment X'06000000'). These fields will be printedonly on report detail lines with other terminal record and common segment fieldnames.

Field Description

TERMID Terminal name.

Default label-1: TERMDefault label-2: IDField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMMODL Terminal after which this terminal was modeled.

Default label-1: TERMDefault label-2: MODELField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMPHON Phone number to be called if violations are detected at this terminal.

Default label-1: TERMDefault label-2: PHONEDefault label-3: NUMBERField type: 06000000 - Terminal informationInput data length: 10Input data format: Character (C)Default output length: 14Default output format: Transformed (T)C''............T'(612)933-2885'

(continued)

Page 96: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-28 Auditing and Report Writing Guide

Field Description

TRMLOCTN Company, division, department, and section where this terminal islocated.

Group Field: YES - Input data represented by the followingfieldnames will be printed under the TRMLOCTN column heading:

TERMCOMP TERMDIV TERMDEPT TERMSECT

Data represented by these fieldnames can be printed in separate reportcolumns by including the individual fieldnames instead of the groupfieldname in the FIELD or FIELDS command statement.

Default label-1: TERMINALDefault label-2: LOCATIONField type: 06000000 - Terminal informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

TERMCOMP Company number where this terminal is located.

Belongs to group: TRMLOCTNDefault label-1: TERMDefault label-2: COMPField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMDIV Division number where this terminal is located.

Belongs to group: TRMLOCTNDefault label-1: TERMDefault label-2: DIV.Field type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 97: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-29

Field Description

TERMDEPT Department number where this terminal is located.

Belongs to group: TRMLOCTNDefault label-1: TERMDefault label-2: DEPTField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMSECT Section number where this terminal is located.

Belongs to group: TRMLOCTNDefault label-1: TERMDefault label-2: SECTField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMCNAME Company name where this terminal is located.

Default label-1: COMPANY NAMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

TRMVNAME Division name where this terminal is located.

Default label-1: DIVISION NAMEField type: 06000000 - Terminal informationInput data length: 8Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

TRMDNAME Department name where this terminal is located.

Default label-1: DEPARTMENT NAMEField type: 06000000 - Terminal informationInput data length: 12Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

(continued)

Page 98: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-30 Auditing and Report Writing Guide

Field Description

TRMSNAME Section name where this terminal is located.

Default label-1: SECTION NAMEField type: 06000000 - Terminal informationInput data length: 16Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

TERMSTAT Terminal status.

Default label-1: TERMDefault label-2: STATUSField type: 06000000 - Terminal informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'C'P'............T'PRELOADED'C'V'............T'SUSPENDED'

TRMTIMLM Terminal inactive time limit.

Default label-1: TERMINALDefault label-2: INACTIVEDefault label-3: TIME LMTField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

TMOPSNEX Terminal operator sign-on status, which indicates whether the operatorusing the terminal is exempt from signing on.

Default label-1: TRM-OPDefault label-2: SIGNONDefault label-3: EXEMPTField type: 06000000 - Terminal informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'O'............T'OPT'C'Y'............T'YES'C'N'............T'NO'

(continued)

Page 99: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-31

Field Description

TERMSNEX Terminal sign-on status, which indicates whether the terminal isexempt from sign-on procedures.

Default label-1: TERMDefault label-2: SIGNONDefault label-3: EXEMPTField type: 06000000 - Terminal informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO'

TERMSCDT Date the terminal password was issued.

Default label-1: TERMDefault label-2: SCTY-CODEDefault label-3: DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TRMEFFDT New password effective date.

Default label-1: TERMDefault label-2: NEW SCODEDefault label-3: EFF. DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 100: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-32 Auditing and Report Writing Guide

Field Description

TRMVIORP Terminal ID of the terminal to be notified in real-time that a violationhas been detected on this terminal.

Default label-1: VIOLATIONDefault label-2: REPORTDefault label-3: TERMIDField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMPRINT Terminal ID of the printer to be notified in real-time that a violationhas been detected on this terminal.

Default label-1: TERMDefault label-2: ASSOCDefault label-3: PRINTERField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMGRP Name of the user-defined group to which this terminal belongs.

Default label-1: TERMDefault label-2: GROUPDefault label-3: IDField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TERMPROC Terminal process type.

Default label-1: TERMDefault label-2: PROCDefault label-3: TYPEField type: 06000000 - Terminal informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'U'............T'UPDATE'C'I'............T'INQUIRY'

(continued)

Page 101: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-33

Field Description

TRMADMIN Administrator or subadministrator who owns the terminal profile.

Default label-1: TERMDefault label-2: ADMINDefault label-3: NBRField type: 06000000 - Terminal informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

TRMTIMDF Time zone differential (number of hours, + or -) between the terminallocation and that of the host CPU.

Default label-1: TERMDefault label-2: TIMEDefault label-3: DIFFField type: 06000000 - Terminal informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

TRMUSRDA Terminal user defined data.

Default label-1: TERMINALDefault label-2: USERDefault label-3: INFOField type: 06000000 - Terminal informationInput data length: 10Input data format: Character (C)Default output length: 10Default output format: Character (C)

TRMLOGO Terminal logo suffix ID.

Default label-1: TERMDefault label-2: LOGODefault label-3: SUFXField type: 06000000 - Terminal informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

Page 102: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-34 Auditing and Report Writing Guide

Field Description

TRMLANG Terminal message language suffix.

Default label-1: TERMDefault label-2: MESGDefault label-3: SUFXField type: 06000000 - Terminal informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

TRMALTRN Terminal alert transactions.

Group field: YES - Input data represented by the followingfieldnames will be printed on one or more separate detail lines underthe TRMALTRN column heading:

TRMALTR1 TRMALTR2 TRMALTR3 TRMALTR4 TRNALTR5TRMALTR6

Data represented by these fieldnames can be printed in separate reportcolumns by specifying the individual fieldnames instead of the groupfieldname in the SUBTITLE, FIELD, or FIELDS commandstatement.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRANOccurrences: VariableField type: 06010000 - Terminal transaction informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMALTR1 Terminal alert transaction 1.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN1Belongs to group: TRMALTRNField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 103: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-35

Field Description

TRMALTR2 Terminal alert transaction 2.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN2Field type: 06000000 - Terminal informationBelongs to group: TRMALTRNInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMALTR3 Terminal alert transaction 3.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN3Belongs to group: TRMALTRNField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMALTR4 Terminal alert transaction 4.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN4Belongs to group: TRMALTRNField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TRMALTR5 Terminal alert transaction 5.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN5Belongs to group: TRMALTRNField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 104: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-36 Auditing and Report Writing Guide

Field Description

TRMALTR6 Terminal alert transaction 6.

Default label-1: TERMDefault label-2: ALERTDefault label-3: TRAN6Belongs to group: TRMALTRNField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMSCHDAY Terminal schedule day.

Default label-1: TERMDefault label-2: SCHEDDefault label-3: DAYField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'1'............T'SUNDAY'C'2'............T'MONDAY'C'3'............T'TUESDAY'C'4'............T'WEDNESDAY'C'5'............T'THURSDAY'C'6'............T'FRIDAY'C'7'............T'SATURDAY'

TMSCHFTM Terminal scheduled "from" time.

Default label-1: TERMDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

X'00001770'.....T' 00:01 '

(continued)

Page 105: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-37

Field Description

TMSCHTTM Terminal scheduled "to" time.

Default label-1: TERMDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTMPFTM Terminal temporary "from" time.

Default label-1: TERMDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMTMPTTM Terminal temporary "to" time.

Default label-1: TERMDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 106: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-38 Auditing and Report Writing Guide

Field Description

TMTMPEFD Terminal temporary schedule effective date.

Default label-1: TERMDefault label-2: TEMPDefault label-3: EFF DATEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTMPEFX Terminal temporary schedule expiration date.

Default label-1: TERMDefault label-2: TEMPDefault label-3: EXP DATEField type: 06020000 - Terminal schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned toeach day of the week.Input data length: 4Input data format: Hexidecimal (X)Default output length: 1Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMSFTMSU Sunday scheduled "from" time.

Default label-1: SUNDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 107: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-39

Field Description

TMSTTMSU Sunday scheduled "to" time.

Default label-1: SUNDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMSU Sunday temporary "from" time.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMTTTMSU Sunday temporary "to" time.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 108: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-40 Auditing and Report Writing Guide

Field Description

TMTEFDSU Sunday temporary effective date.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTEFXSU Sunday temporary expiration date.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMSFTMMO Monday scheduled "from" time.

Default label-1: MONDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 109: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-41

Field Description

TMSTTMMO Monday scheduled "to" time.

Default label-1: MONDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMMO Monday temporary "from" time.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMTTTMMO Monday temporary "to" time.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDMO Monday temporary effective date.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 110: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-42 Auditing and Report Writing Guide

Field Description

TMTEFXMO Monday temporary expiration date.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMSFTMTU Tuesday scheduled "from" time.

Default label-1: TUESDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMSTTMST Tuesday scheduled "to" time.

Default label-1: TUESDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMTU Tuesday temporary "from" time.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 111: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-43

Field Description

TMTTTMTU Tuesday temporary "to" time.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDTU Tuesday temporary effective date.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTEFXTU Tuesday temporary expiration date.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 112: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-44 Auditing and Report Writing Guide

Field Description

TMSFTMWE Wednesday scheduled "from" time.

Default label-1: WEDNESDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMSTTMWE Wednesday scheduled "to" time.

Default label-1: WEDNESDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMWE Wednesday temporary "from" time.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 113: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-45

Field Description

TMTTTMWE Wednesday temporary "to" time.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDWE Wednesday temporary effective date.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTEFXWE Wednesday temporary expiration date.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMSFTMTH Thursday scheduled "from" time.

Default label-1: THURSDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 114: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-46 Auditing and Report Writing Guide

Field Description

TMSTTMTH Thursday scheduled "to" time.

Default label-1: THURSDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMTH Thursday temporary "from" time.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMTTTMTH Thursday temporary "to" time.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDTH Thursday temporary effective date.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 115: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-47

Field Description

TMTEFXTH Thursday temporary expiration date.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMSFTMFR Friday scheduled "from" time.

Default label-1: FRIDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMSTTMFR Friday scheduled "to" time.

Default label-1: FRIDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 116: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-48 Auditing and Report Writing Guide

Field Description

TMTFTMFR Friday temporary "from" time.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMTTTMFR Friday temporary "to" time.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDFR Friday temporary effective date.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTEFXFR Friday temporary expiration date.Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10

Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 117: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-49

Field Description

TMSFTMSA Saturday scheduled "from" time.

Default label-1: SATURDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMSTTMSA Saturday scheduled "to" time.

Default label-1: SATURDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTFTMSA Saturday temporary "from" time.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 118: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-50 Auditing and Report Writing Guide

Field Description

TMTTTMSA Saturday temporary "to" time.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTEFDSA Saturday temporary effective date.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

TMTEFXSA Saturday temporary expiration date.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 06000000 - Terminal informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 119: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-51

Field Description

TMTRAUTH Terminal transaction authority (ALL, YES, or NONE).

Default label-1: TERMDefault label-2: TRANDefault label-3: AUTHField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMTRAUTL Terminal transaction authorization list.

Default label-1: TERMDefault label-2: TRANDefault label-3: AUTHField type: 06030000 - Terminal transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every transaction authorizedfor this terminal.Input data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMTRAUTF Terminal authorized transaction "from" time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06030000 - Terminal transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every transaction authorizedfor this terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 120: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-52 Auditing and Report Writing Guide

Field Description

TMTRAUTT Terminal authorized transaction "to" time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06030000 - Terminal transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every transaction authorizedfor this terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

TMTRAUTD Terminal authorized transaction description.

Default label-1: TRANSACTIONDefault label-2: DESCRIPTIONField type: 06030000 - Terminal transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every transaction authorizedfor this terminal.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

TMPRAUTH Terminal program authority (ALL, YES, or NONE).

Default label-1: TERMDefault label-2: PROGDefault label-3: AUTHField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 121: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-53

Field Description

TMPRAUTL Terminal program authorization list.

Default label-1: TERMDefault label-2: PROGDefault label-3: AUTHField type: 06040000 - Terminal program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TMPRAUTF Terminal authorized program "from" time.

Default label-1: PROGDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06040000 - Terminal program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

TMPRAUTT Terminal authorized program "to" time.

Default label-1: PROGDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06040000 - Terminal program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 122: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-54 Auditing and Report Writing Guide

Field Description

TMPRAUTD Terminal authorized program description.

Default label-1: PROGRAMDefault label-2: DESCRIPTIONField type: 06040000 - Terminal program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

TMFLAUTH Terminal file authority (ALL, YES, or NONE).

Default label-1: TERMDefault label-2: FILEDefault label-3: AUTHField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Output data format: Character (C)

TMFLAUTL Terminal file authorization list.

Default label-1: TERMDefault label-2: FILEDefault label-3: AUTHField type: 06050000 - Terminal file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 123: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-55

Field Description

TMFLAUTC Terminal file access authorization. Specify in conjunction with fieldTMFLAUTH, which names the file to which the terminal is granted ordenied update access.

Default label-1: TERMDefault label-2: FILEDefault label-3: ACCESSField type: 06050000 - Terminal file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'I'............T'INQUIRY'C'N'............T'UPDATE'

TMFLAUTF Terminal authorized file scheduled "from" time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 06050000 - Terminal file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 124: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal Record Fields Fieldname List

3-56 Auditing and Report Writing Guide

Field Description

TMFLAUTT Terminal authorized file scheduled "to" time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 06050000 - Terminal file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)X'AFCB46BC'.....T'01/01/1998'

TMFLAUTD Terminal authorized file description.

Default label-1: FILEDefault label-2: DESCRIPTIONField type: 06050000 - Terminal file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

TMMPAUTH Terminal map restrictions (YES or NONE).

Default label-1: TERMDefault label-2: MAPDefault label-3: AUTHField type: 06000000 - Terminal informationInput data length: 4Input data format: Character (C)Default output length: 4Output data format: Character (C)

(continued)

Page 125: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-57

Field Description

TMMPAUTL Terminal restricted map list.

Default label-1: TERMDefault label-2: MAPDefault label-3: AUTHField type: 06060000 - Terminal map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TMMPAUTM Terminal restricted mapset name.

Default label-1: MAPSETDefault label-2: NAMEField type: 06060000 - Terminal map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

TMMPAUTD Terminal restricted map title.

Default label-1: MAPDefault label-2: TITLEField type: 06060000 - Terminal map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis terminal.Input data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

Page 126: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-58 Auditing and Report Writing Guide

Operator Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC inputoperator records (RECTYPE EQ C'OP', segment X'07000000'). These fields will be printedonly on report detail lines with other operator record and common segment fieldnames.

Field Description

OPRNUMBR User ID.

Default label-1: USERIDField type: 07000000 - Operator informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

OPUSERID User ID.

Default label-1: USERIDField type: 07000000 - Operator informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

OPRIUIID IUI User ID.

Default label-1: IUIDefault label-2: USERIDField type: 07000000 - Operator informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPROPID CICS OP-ID.

Default label-1: OPIDField type: 07000000 - Operator informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 127: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-59

Field Description

OPRNAME User name.

Default label-1: USER NAMEField type: 07000000 - Operator informationInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

OPRTYPE Operator type.

Default label-1: OPERATORDefault label-2: TYPEField type: 07000000 - Operator informationInput data length: 1Input data format: Character (C)Default output length: 17Default output format: Transformed (T)

C'R'............T'Regular UserID'C'M'............T'Main Administrator'C'T'............T'Sub Adm (Trm/Opr)'C'O'............T'Sub Adm (Oper)'

OPEXTSEC Operator external security.

Default label-1: OPERDefault label-2: EXTDefault label-3: SCTYField type: 07000000 - Operator informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'Yes'C'N'............T'No'

OPRMODEL The operator profile this operator is modeled after.

Default label-1: OPERATORDefault label-2: MODELField type: 07000000 - Operator informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

(continued)

Page 128: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-60 Auditing and Report Writing Guide

Field Description

OPRLOCTN Company, division, department, and section to which this operatorbelongs.

Group Field: YES - Input data represented by the following fieldnameswill be printed under the OPRLOCTN column heading:

OPRCOMP OPRDIV OPRDEPT OPRSECT

Data represented by these fieldnames can be printed in separate reportcolumns by including the individual fieldnames instead of the groupfieldnames in the SUBTITLE, FIELD, or FIELDS command statement.

Default label-1: OPERATORDefault label-2: LOCATIONField type: 07000000 - Operator informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

OPRCOMP Company number to which this operator belongs.

Belongs to group: OPRLOCTNDefault label-1: OPERDefault label-2: COMPField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRDIV Division number to which this operator belongs.

Belongs to group: OPRLOCTNDefault label-1: OPERDefault label-2: DIV.Field type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 129: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-61

Field Description

OPRDEPT Department number to which this operator belongs.

Belongs to group: OPRLOCTNDefault label-1: OPERDefault label-2: DEPTField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRSECT Section number to which this operator belongs.

Belongs to group: OPRLOCTNDefault label-1: OPERDefault label-2: SECTField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRCNAME Company name to which this operator belongs.

Default label-1: COMPANY NAMEField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

OPRVNAME Division name to which this operator belongs.

Default label-1: DIVISION NAMEField type: 07000000 - Operator informationInput data length: 8Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

OPRDNAME Department name to which this operator belongs.

Default label-1: DEPARTMENT NAMEField type: 07000000 - Operator informationInput data length: 12Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

(continued)

Page 130: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-62 Auditing and Report Writing Guide

Field Description

OPRSNAME Section name to which this operator belongs.

Default label-1: SECTION NAMEField type: 07000000 - Operator informationInput data length: 16Input data format: Character (C)Default output length: 35Default output format: Transformed (T)

OPRSTAT Operator status.

Default label-1: OPERDefault label-2: STATField type: 07000000 - Operator informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE'C'D'............T'DISABLED'C'M'............T'MONITOR'C'S'............T'SAFE'C'P'............T'PRELOADED'C'V'............T'SUSPENDED'C'K'............T'KEEP'

OPRSECDT The date the operator’s password was issued.

Default label-1: OPERDefault label-2: PASSWORDDefault label-3: ISS. DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 131: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-63

Field Description

OPREFFDT Operator new password effective date.

Default label-1: OPERDefault label-2: NEW-PSWDDefault label-3: EFF. DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPRPRMT Operator primary terminal ID.

Default label-1: OPERDefault label-2: PRIMARYDefault label-3: TERMIDField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRALTM1 Alternate terminal or group of terminals available to this operator.

Default label-1: OPERDefault label-2: ALTRNATEDefault label-3: TERM1Field type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRALTM2 Alternate terminal or group of terminals available to this operator.

Default label-1: OPERDefault label-2: ALTERNATEDefault label-3: TERM 2Field type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 132: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-64 Auditing and Report Writing Guide

Field Description

OPRTMGRP Alterate group of terminals available to this operator.

Default label-1: OPERDefault label-2: TERMDefault label-3: GROUPField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRPROC Operator processing type.

Default label-1: OPERDefault label-2: PROCDefault label-3: TYPEField type: 07000000 - Operator informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Transformed (T)

C'U'............T'UPDATE'C'I'............T'INQUIRY'

OPRTMLT Operator inactive time limit.Default label-1: OPERDefault label-2: INACTIVEDefault label-3: TIME LMTField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

OPRADMNO Administrator or subadministrator who owns this operator profile.

Default label-1: OPERDefault label-2: ADMINDefault label-3: NUMBERField type: 07000000 - Operator informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

Page 133: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-65

Field Description

OPRUSRDA Operator user-defined data.

Default label-1: OPERATORDefault label-2: USERDefault label-3: INFOField type: 07000000 - Operator informationInput data length: 10Input data format: Character (C)Default output length: 10Default output format: Character (C)

OPRLTERM Terminal ID on which this operator was last signed on.

Default label-1: OPERDefault label-2: LASTDefault label-3: TERMField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPRLDATE Date of this operator's last sign-on.

Default label-1: OPERDefault label-2: LASTDefault label-3: SIGNON DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPRLTIME Time of this operator's last sign-on.

Default label-1: OPERDefault label-2: LASTDefault label-3: SIGNON TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexidecimal (X)Default output length: 8Default output format: Transformed (T)P'0131415F'.....T' 13:14 ' (or user-defined TIMEFORM)

(continued)

Page 134: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-66 Auditing and Report Writing Guide

Field Description

OPERLANG Operator message language suffix.

Default label-1: OPERDefault label-2: MESGDefault label-3: LANGField type: 07000000 - Operator informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

OPALTRAN Operator alert transactions.

Group field: YES - Input data represented by the following fieldnameswill be printed on one or more separate detail lines under theOPALTRAN column heading:

OPALTRN1 OPALTRN2 OPALTRN3 OPALTRN4 OPALTRN5OPALTRN6

Data represented by these fieldnames can be printed in separate reportcolumns by specifying the individual fieldnames instead of the groupfieldname in the SUBTITLE, FIELD or FIELDS command statement.

Default label-1: ALERTDefault label-2: TRANDefault label-3: LISTOccurrences: VariableField type: 07010000 - Operator transaction informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPALTRN1 Operator alert transaction 1.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-1Belongs to group: OPALTRANField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 135: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-67

Field Description

OPALTRN2 Operator alert transaction 2.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-2Field type: 07000000 - Operator informationBelongs to group: OPALTRANInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPALTRN3 Operator alert transaction 3.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-3Belongs to group: OPALTRANField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPALTRN4 Operator alert transaction 4.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-4Belongs to group: OPALTRANField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPALTRN5 Operator alert transaction 5.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-5Belongs to group: OPALTRANField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 136: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-68 Auditing and Report Writing Guide

Field Description

OPALTRN6 Operator alert transaction 6.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-6Belongs to group: OPMALTRNField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPSCHDAY Operator schedule day.

Default label-1: OPERDefault label-2: SCHEDDefault label-3: DAYField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'1'............T'SUNDAY'C'2'............T'MONDAY'C'3'............T'TUESDAY'C'4'............T'WEDNESDAY'C'5'............T'THURSDAY'C'6'............T'FRIDAY'C'7'............T'SATURDAY'

OPSCHFTM Operator scheduled "from" time.

Default label-1: OPERDefault label-2: SCHEDDefault label-3: FROM TIMEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

X'00001770'.....T' 00:01 '

(continued)

Page 137: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-69

Field Description

OPSCHTTM Operator scheduled "to" time.

Default label-1: OPERDefault label-2: SCHEDDefault label-3: TO TIMEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTMPFTM Operator temporary "from" time.

Default label-1: OPERDefault label-2: TEMPDefault label-3: FROM TIMEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTMPTTM Operator temporary "to" time.

Default label-1: OPERDefault label-2: TEMPDefault label-3: TO TIMEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 138: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-70 Auditing and Report Writing Guide

Field Description

OPTMPEFD Operator temporary schedule effective date.

Default label-1: OPERDefault label-2: TEMPDefault label-3: EFF DATEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTMPEFX Operator temporary schedule expiration date.

Default label-1: OPERDefault label-2: TEMPDefault label-3: EXP DATEField type: 07020000 - Operator schedule informationOccurrences: Multiple - seven lines of output will be generated if thisfieldname is specified, representing schedule restrictions assigned to eachday of the week.Input data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMSU Sunday scheduled "from" time.

Default label-1: SUNDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 139: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-71

Field Description

OPSTTMSU Sunday scheduled "to" time.

Default label-1: SUNDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMSU Sunday temporary "from" time.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMSU Sunday temporary "to" time.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 140: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-72 Auditing and Report Writing Guide

Field Description

OPTEFDSU Sunday temporary effective date.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXSU Sunday temporary expiration date.

Default label-1: SUNDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMMO Monday scheduled "from" time.

Default label-1: MONDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 141: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-73

Field Description

OPSTTMMO Monday scheduled "to" time.

Default label-1: MONDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMMO Monday temporary "from" time.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMMO Monday temporary "to" time.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 142: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-74 Auditing and Report Writing Guide

Field Description

OPTEFDMO Monday temporary effective date.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXMO Monday temporary expiration date.

Default label-1: MONDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMTU Tuesday scheduled "from" time.

Default label-1: TUESDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 143: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-75

Field Description

OPSTTMST Tuesday scheduled "to" time.

Default label-1: TUESDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMTU Tuesday temporary "from" time.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMTU Tuesday temporary "to" time.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 144: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-76 Auditing and Report Writing Guide

Field Description

OPTEFDTU Tuesday temporary effective date.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXTU Tuesday temporary expiration date.

Default label-1: TUESDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMWE Wednesday scheduled "from" time.

Default label-1: WEDNESDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 145: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-77

Field Description

OPSTTMWE Wednesday scheduled "to" time.

Default label-1: WEDNESDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMWE Wednesday temporary "from" time.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMWE Wednesday temporary "to" time.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 146: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-78 Auditing and Report Writing Guide

Field Description

OPTEFDWE Wednesday temporary effective date.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXWE Wednesday temporary expiration date.

Default label-1: WEDNESDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMTH Thursday scheduled "from" time.

Default label-1: THURSDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 147: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-79

Field Description

OPSTTMTH Thursday scheduled "to" time.

Default label-1: THURSDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMTH Thursday temporary "from" time.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMTH Thursday temporary "to" time.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 148: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-80 Auditing and Report Writing Guide

Field Description

OPTEFDTH Thursday temporary effective date.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXTH Thursday temporary expiration date.

Default label-1: THURSDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMFR Friday scheduled "from" time.

Default label-1: FRIDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 149: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-81

Field Description

OPSTTMFR Friday scheduled "to" time.

Default label-1: FRIDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMFR Friday temporary "from" time.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMFR Friday temporary "to" time.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 150: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-82 Auditing and Report Writing Guide

Field Description

OPTEFDFR Friday temporary effective date.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXFR Friday temporary expiration date.

Default label-1: FRIDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPSFTMSA Saturday scheduled "from" time.

Default label-1: SATURDAYDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 151: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-83

Field Description

OPSTTMSA Saturday scheduled "to" time.

Default label-1: SATURDAYDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPTFTMSA Saturday temporary "from" time.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: FROM-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTTTMSA Saturday temporary "to" time.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: TO-TIMEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 152: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-84 Auditing and Report Writing Guide

Field Description

OPTEFDSA Saturday temporary effective date.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: EFF DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10

Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTEFXSA Saturday temporary expiration date.

Default label-1: SATURDAYDefault label-2: TEMPDefault label-3: EXP DATEField type: 07000000 - Operator informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

OPTRAUTH Operator transaction authority (ALL, YES, or NONE).

Default label-1: OPERDefault label-2: TRANDefault label-3: AUTHField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPTRMODL Operator transaction modeling (YES or NO).

Default label-1: OPERDefault label-2: TRANSDefault label-3: MODELLEDField type: 07000000 - Operator informationInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 153: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-85

Field Description

OPTRAUTL Operator transaction authorization list.

Default label-1: TRANDefault label-2: AUTHDefault label-3: LISTField type: 07030000 - Operator transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPTRAUTF Operator authorized transaction "from" time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07030000 - Operator transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPTRAUTT Operator authorized transaction "to" time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07030000 - Operator transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

(continued)

Page 154: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-86 Auditing and Report Writing Guide

Field Description

OPTRAUTD Operator authorized transaction description.

Default label-1: TRANSACTIONDefault label-2: DESCRIPTIONField type: 07030000 - Operator transaction informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

OPPRAUTH Operator program authority (ALL, YES, or NONE).

Default label-1: OPERDefault label-2: PROGDefault label-3: AUTHField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OPPRMODL Operator program modeling (YES or NO).

Default label-1: OPERDefault label-2: PROGSDefault label-3: MODELLEDField type: 07000000 - Operator informationInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OPPRAUTL Operator program authorization list.

Default label-1: PROGRAMDefault label-2: AUTHDefault label-3: LISTField type: 07040000 - Operator program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 155: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-87

Field Description

OPPRAUTF Operator authorized program "from" time.

Default label-1: PROGDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07040000 - Operator program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

OPPRAUTT Operator authorized program "to" time.

Default label-1: PROGDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07040000 - Operator program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPPRAUTD Operator authorized program description.

Default label-1: PROGRAMDefault label-2: DESCRIPTIONField type: 07040000 - Operator program informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

(continued)

Page 156: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-88 Auditing and Report Writing Guide

Field Description

OPFLAUTH Operator file authority (ALL, YES, or NONE).

Default label-1: OPERDefault label-2: FILEDefault label-3: AUTHField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Output data format: Character (C)

OPFLMODL Operator file modeling (YES or NO).

Default label-1: OPERDefault label-2: FILESDefault label-3: MODELLEDField type: 07000000 - Operator informationInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OPFLAUTL Operator file authorization list.

Default label-1: FILEDefault label-2: AUTHDefault label-3: LISTField type: 07050000 - Operator file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 157: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-89

Field Description

OPFLAUTC Operator file access authorization. Specify in conjunction with fieldOPFLAUTH, which names the file to which the operator is granted ordenied update access.Default label-1: OPERDefault label-2: FILEDefault label-3: ACCESSField type: 07050000 - Operator file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

'I'............T'INQUIRY'C'N'............T'UPDATE'

OPFLAUTF Operator authorized file scheduled "from" time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 07050000 - Operator file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:01 ' (or user-defined TIMEFORM)

(continued)

Page 158: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-90 Auditing and Report Writing Guide

Field Description

OPFLAUTT Operator authorized file scheduled "to" time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 07050000 - Operator file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'0083D600'.....T' 24:00 ' (or user-defined TIMEFORM)

OPFLAUTD Operator authorized file description.

Default label-1: FILEDefault label-2: DESCRIPTIONField type: 07050000 - Operator file informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

OPMPAUTH Operator map restrictions (YES or NONE).

Default label-1: OPERDefault label-2: MAPDefault label-3: AUTHField type: 07000000 - Operator informationInput data length: 4Input data format: Character (C)Default output length: 4Output data format: Character (C)

(continued)

Page 159: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-91

Field Description

OPMPMODL Operator map modeling (YES or NO).

Default label-1: OPERDefault label-2: MAPSDefault label-3: MODELLEDField type: 07000000 - Operator informationInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OPMPAUTL Operator restricted map list.

Default label-1: MAPDefault label-2: AUTHDefault label-3: LISTField type: 07060000 - Operator map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPMPAUTM Operator restricted mapset name.

Default label-1: MAPSETDefault label-2: NAMEField type: 07060000 - Operator map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

(continued)

Page 160: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-92 Auditing and Report Writing Guide

Field Description

OPMPAUTD Operator restricted map title.

Default label-1: MAPDefault label-2: TITLEField type: 07060000 - Operator map informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

OPFDAUTH Field authorization (YES, NONE, or ALL).

Default label-1: OPERDefault label-2: FIELDDefault label-3: AUTHField type: 07000000 - Operator informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

OPFDMODL Operator field modeling (YES or NO).

Default label-1: OPERDefault label-2: FIELDSDefault label-3: MODELLEDField type: 07000000 - Operator informationInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OPFAUTL Operator authorized field resource name list.

Default label-1: FIELDRESDefault label-2: AUTHDefault label-3: LISTField type: 07070000 - Operator field authorization informationOccurrences: Variable - multiple lines of output will be generated ifthis fieldname is specified, representing every program authorized forthis operator.Input data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 161: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-93

Field Description

OPUSRDA1 User defined data 1.

Default label-1: USERDefault label-2: DATA1Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPUSRDA2 User defined data 2.

Default label-1: USERDefault label-2: DATA2Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPBATUSR Batch user (YES or NO).

Default label-1: BATDefault label-2: USRField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

OPCICUSR CICS user (YES or NO).

Default label-1: CICDefault label-2: USRField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

(continued)

Page 162: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-94 Auditing and Report Writing Guide

Field Description

OPPWSUSR PWS user (YES or NO)

Default label-1: PWSDefault label-2: USRField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

OPREMUSR Allowed to submit remote jobs (YES or NO).

Default label-1: REMDefault label-2: USRField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

OPBATACT Batch action to take for this user.

Default label-1: BATCHDefault label-2: ACTIONField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'...........T'NONE 'C'C'...........T'CANCEL 'C'L'...........T'LOG 'C'W'...........T'WTO/LOG'

(continued)

Page 163: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-95

Field Description

OPMONMOD Batch monitor/audit action.

Default label-1: MON/AUDDefault label-2: ACTIONField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'...........T'NONE 'C'C'...........T'CANCEL 'C'L'...........T'LOG 'C'W'...........T'WTO/LOG'

OPMASCON Master console user (YES or NO).

Default label-1: MON/AUDDefault label-2: MODEField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

OPCTLLIB Controlled library user (YES or NO).

Default label-1: CLBDefault label-2: USRField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO'

OPSECID1 Batch SECID 1.

Default label-1: SECID-1Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 164: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-96 Auditing and Report Writing Guide

Field Description

OPTABLE1 Batch table 1.

Default label-1: TABLE-1Field type: 07070000 - Operator field authorization informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

OPSECID2 Batch SECID 2.

Default label-1: SECID-2Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPTABLE2 Batch table 2.

Default label-1: TABLE-2Field type: 07070000 - Operator field authorization informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

OPSECID3 Batch SECID 3.

Default label-1: SECID-3Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPTABLE3 Batch table 3.

Default label-1: TABLE-3Field type: 07070000 - Operator field authorization informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

Page 165: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Operator Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-97

Field Description

OPSECID4 Batch SECID 4.

Default label-1: SECID-4Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPTABLE4 Batch table 4.

Default label-1: TABLE-4Field type: 07070000 - Operator field authorization informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

OPSECID5 Batch SECID 5.

Default label-1: SECID-5Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPTABLE5 Batch table 5.

Default label-1: TABLE-5Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPEXPDAT Batch user expiration date.

Default label-1: EXPIREDefault label-2: DATEField type: 07070000 - Operator field authorization informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 166: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Record Fields Fieldname List

3-98 Auditing and Report Writing Guide

Field Description

OPUSER1 Batch submit user ID 1.

Default label-1: SUBMITDefault label-2: USERID-1Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPUSER2 Batch submit user ID 2.

Default label-1: SUBMITDefault label-2: USERID-2Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPUSER3 Batch submit user ID 3.

Default label-1: SUBMITDefault label-2: USERID-3Field type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPUS3SRC Batch submit user ID 3 logon source.

Default label-1: USERID-3Default label-2: SOURCEField type: 07070000 - Operator field authorization informationInput data length: 1Input data format: Character (C)Default output length: 13Default output format: Transformed (T)

C'L'...........T'PUTSPOOL/XPCC'C'S'...........T'ASI PROC'

OPEXTUSR External user ID.

Default label-1: EXTERNALDefault label-2: USERIDField type: 07070000 - Operator field authorization informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 167: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-99

Field Resource Information Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC fieldresource information records (segment X'080x0000').

Field Description

RFLNAME Resource name.

Default label-1: RESOURCEDefault label-2: NAMEField type: 08000000 - Field informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

RFLREAL Resource real name.

Default label-1: RESOURCEDefault label-2: REALDefault label-3: NAMEField type: 08000000 - Field informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

RFLSEQNO Resource sequence number.

Default label-1: SEQUENCEDefault label-2: NUMBERField type: 08000000 - Field informationInput data length: 004Input data format: Packed decimal (P)Output length: 007Default output format: Zoned decimal (Z)

RFLDESC Resource description.

Default label-1: RESOURCEDefault label-2: DESCRIPTIONField type: 08000000 - Field informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

(continued)

Page 168: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Resource Information Fields Fieldname List

3-100 Auditing and Report Writing Guide

Field Description

RFLSTAT Resource status.

Default label-1: RESOURCEDefault label-2: STATUSField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 009Default output format: Transformed (T)

C'A' = ACTIVEC'D' = DISABLEDC'M' = MONITORC'S' = SAFEC'P' = PRELOADEDC'V' = SUSPENDEDC'K' = KEEP

RFLTYPE Resource type.

Default label-1: RESOURCEDefault label-2: TYPEField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 004Default output format: Transformed (T)

C'D' = DL/1C'F' = FILEC'M' = MAP

RFLRCFM Record format.

Default label-1: RECORDDefault label-2: FORMATField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 008Default output format: Transformed (T)

C'F' = FIXEDC'V' = VARIABLE

(continued)

Page 169: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-101

Field Description

RFLAACT Add action.

Default label-1: ADDDefault label-2: ACTIONField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'A' = ALLOWC'R' = RETURN CODEC'V' = VIOLATION

RFLBACT Browse action.

Default label-1: BROWSEDefault label-2: ACTIONField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'A' = ALLOWC'R' = RETURN CODEC'V' = VIOLATION

RFLBRET Browse return code.

Default label-1: BROWSEDefault label-2: RETURNDefault label-3: CODEField type: 08000000 - Field informationInput data length: 001Input data format: X - HexadecimalOutput length: 002Default output format: Hexadecimal (X)

RFLBRPO Browse record position.

Default label-1: BROWSEDefault label-2: RECORDDefault label-3: POSITIONField type: 08000000 - Field informationInput data length: 002Input data format: X - HexadecimalOutput length: 005Default output format: Zoned decimal (Z)

(continued)

Page 170: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Resource Information Fields Fieldname List

3-102 Auditing and Report Writing Guide

Field Description

RFLDACT Delete action.

Default label-1: DELETEDefault label-2: ACTIONField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'A' = ALLOWC'R' = RETURN CODEC'V' = VIOLATION

RFLRACT Read action.

Default label-1: READDefault label-2: ACTIONField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'A' = ALLOWC'R' = RETURN CODEC'V' = VIOLATION

RFLRRET Read return code.

Default label-1: READDefault label-2: RETURNDefault label-3: CODEField type: 08000000 - Field informationInput data length: 001Input data format: X - HexadecimalOutput length: 002Default output format: Hexadecimal (X)

RFLRRPO Read record position.

Default label-1: READDefault label-2: RECORDDefault label-3: POSITIONField type: 08000000 - Field informationInput data length: 002Input data format: X - HexadecimalOutput length: 005Default output format: Zoned decimal (Z)

(continued)

Page 171: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-103

Field Description

RFLUACT Update action.

Default label-1: UPDATEDefault label-2: ACTIONField type: 08000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'A' = ALLOWC'R' = RETURN CODEC'V' = VIOLATION

RFL#SEG Number of segments.

Default label-1: NUMBERDefault label-2: OFDefault label-3: SEGMENTSField type: 08000000 - Field informationInput data length: 001Input data format: X - HexadecimalOutput length: 001Default output format: Zoned decimal (Z)

RFLFDSC Field description.

Default label-1: FIELDDefault label-2: DESCRIPTIONField type: 08010000 - Field segment informationInput data length: 015Input data format: Character (C)Output length: 015Default output format: Character (C)

RFLDPOS Data position.

Default label-1: DATADefault label-2: POSITIONField type: 08010000 - Field segment informationInput data length: 002Input data format: X - HexadecimalOutput length: 005Default output format: Zoned decimal (Z)

(continued)

Page 172: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Resource Information Fields Fieldname List

3-104 Auditing and Report Writing Guide

Field Description

RFLDLEN Data length.

Default label-1: DATADefault label-2: LENGTHField type: 08010000 - Field segment informationInput data length: 002Input data format: X - HexadecimalOutput length: 005Default output format: Zoned decimal (Z)

RFLDFMT Data format.

Default label-1: DATADefault label-2: FORMATField type: 08010000 - Field segment informationInput data length: 001Input data format: Character (C)Output length: 011Default output format: Transformed (T)

C'C' = CHARACTERC'P' = PACKEDC'X' = HEXADECIMAL

RFLCOMP Compare operator.

Default label-1: COMPAREDefault label-2: OPERATORField type: 08010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 016Default output format: Transformed (T)

X'02' = RANGEX'04' = LESS OR EQUALX'08' = LESS THANX'10' = GREATER OR EQUALX'20' = GREATER THANX'40' = NOT EQUALX'80' = EQUAL

(continued)

Page 173: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-105

Field Description

RFLCONN Logical connector.

Default label-1: LOGICALDefault label-2: CONNECTORField type: 08010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 003Default output format: Transformed (T)

X'40' = ORX'80' = AND

RFLVALU Data value.

Default label-1: DATADefault label-2: VALUEField type: 08010000 - Field segment informationInput data length: 001Input data format: Character (C)Output length: 016Default output format: Transformed (T)

RFLVAL2 Data value 2.

Default label-1: DATADefault label-2: VALUE 2Field type: 08010000 - Field segment informationInput data length: 001Input data format: Character (C)Output length: 016Default output format: Transformed (T)

Page 174: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Resource Security Information Fields Fieldname List

3-106 Auditing and Report Writing Guide

Field Resource Security Information Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC fieldresource security information records (segment X'090x0000').

Field Description

RMPNAME Resource name.

Labels: 'RESOURCE' 'NAME'Field type: 09000000 - Field informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

RMPREAL Resource real name.

Labels: 'RESOURCE' 'REAL' 'NAME'Field type: 09000000 - Field informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

RMPSEQNO Resource sequence number.

Labels: 'SEQUENCE' 'NUMBER'Field type: 09000000 - Field informationInput data length: 004Input data format: Packed decimal (P)Output length: 007Default output format: Zoned decimal (Z)

RMPDESC Resource description.

Labels: 'RESOURCE' 'DESCRIPTION'Field type: 09000000 - Field informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

(continued)

Page 175: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-107

Field Description

RMPSTAT Resource status.

Labels: 'RESOURCE' 'STATUS'Field type: 09000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 009Default output format: Transformed (T)

C'A' = ACTIVEC'D' = DISABLEDC'M' = MONITORC'S' = SAFEC'P' = PRELOADEDC'V' = SUSPENDEDC'K' = KEEP

RMPTYPE Resource type.

Labels: 'RESOURCE' 'TYPE'Field type: 09000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 004Default output format: Transformed (T)

C'D' = DL/1C'F' = FILEC'M' = MAP

RMPRCFM Record format.

Labels: 'RECORD' 'FORMAT'Field type: 09000000 - Field informationInput data length: 001Input data format: Character (C)Output length: 008Default output format: Transformed (T)

C'F' = FIXEDC'V' = VARIABLE

RMPMSET Mapset name.

Labels: 'MAPSET' 'NAME'Field type: 09000000 - Field informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

(continued)

Page 176: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Resource Security Information Fields Fieldname List

3-108 Auditing and Report Writing Guide

Field Description

RMP#SEG Number of segments.

Labels: 'NUMBER' 'OF' 'SEGMENTS'Field type: 09000000 - Field informationInput data length: 001Input data format: X - HexadecimalOutput length: 001Default output format: Zoned decimal (Z)

RMPFDSC Field description.

Labels: 'FIELD' 'DESCRIPTION'Field type: 09010000 - Field segment informationInput data length: 015Input data format: Character (C)Output length: 015Default output format: Character (C)

RMPROW Map row.

Labels: 'MAP' 'ROW'Field type: 09010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 003Default output format: Zoned decimal (Z)

RMPCOL Map column.

Labels: 'MAP' 'COLUMN'Field type: 09010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 003Default output format: Zoned decimal (Z)

RMPDLEN Data length.

Labels: 'DATA' 'LENGTH'Field type: 09010000 - Field segment informationInput data length: 002Input data format: X - HexadecimalOutput length: 005Default output format: Zoned decimal (Z)

(continued)

Page 177: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Field Resource Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-109

Field Description

RMPCOMP Compare operator.

Labels: 'COMPARE' 'OPERATOR'Field type: 09010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 016Default output format: Transformed (T)

X'02' = RANGEX'04' = LESS OR EQUALX'08' = LESS THANX'10' = GREATER OR EQUALX'20' = GREATER THANX'40' = NOT EQUALX'80' = EQUAL

RMPCONN Logical connector.

Labels: 'LOGICAL' 'CONNECTOR'Field type: 09010000 - Field segment informationInput data length: 001Input data format: X - HexadecimalOutput length: 003Default output format: Transformed (T)

X'40' = ORX'80' = AND

RMPVALU Data value.

Labels: 'DATA' 'VALUE'Field type: 09010000 - Field segment informationInput data length: 001Input data format: Character (C)Output length: 016Default output format: Transformed (T)

RMPVAL2 Data value 2.

Labels: 'DATA' 'VALUE 2'Field type: 09010000 - Field segment informationInput data length: 001Input data format: Character (C)Output length: 016Default output format: Transformed (T)

Page 178: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Group Security Information Fields Fieldname List

3-110 Auditing and Report Writing Guide

Group Security Information Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC groupsecurity records (segment X'0A0x0000').

Field Description

GRPNAME Group name.

Default label-1: GROUPDefault label-2: NAMEField type: 0A000000 - Group informationInput data length: 009Input data format: Character (C)Output length: 009Default output format: Character (C)

GRPDESC Group description.

Default label-1: GROUPDefault label-2: DESCRIPTIONField type: 0A000000 - Group informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

GRPSTAT Group status.

Default label-1: GROUPDefault label-2: STATUSField type: 0A000000 - Group informationInput data length: 001Input data format: Character (C)Output length: 009Default output format: Transformed (T)

C'A' = ACTIVEC'D' = DISABLEDC'M' = MONITORC'S' = SAFEC'P' = PRELOADEDC'V' = SUSPENDEDC'K' = KEEP

(continued)

Page 179: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Group Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-111

Field Description

GRALTRAN Alert-status transactions list, or NONE.

Default label-1: ALERT

Default label-2: TRANDefault label-3: LISTField type: 0A010000 - Group Alert-transaction infoInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRALTRN1 Alert status transaction ID 1.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-1Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRALTRN2 Alert status transaction ID 2.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-2Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRALTRN3 Alert status transaction ID 3.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-3Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

(continued)

Page 180: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Group Security Information Fields Fieldname List

3-112 Auditing and Report Writing Guide

Field Description

GRALTRN4 Alert status transaction ID 4.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-4Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRALTRN5 Alert status transaction ID 5.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-5Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRALTRN6 Alert status transaction ID 6.

Default label-1: ALERTDefault label-2: TRANDefault label-3: ID-6Field type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRTRAUTH Group authorization (YES, NONE, or ALL).

Default label-1: GROUPDefault label-2: TRANDefault label-3: AUTHField type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

(continued)

Page 181: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Group Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-113

Field Description

GRTRAUTL Authorized transactions (listed).

Default label-1: TRANDefault label-2: AUTHDefault label-3: LISTField type: 0A030000 - Group Tran authorization informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRTRAUTF Authorized transaction scheduled FROM-time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 0A030000 - Group Tran authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

GRTRAUTT Authorized transaction scheduled TO-time.

Default label-1: TRANDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 0A030000 - Group Tran authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

GRTRAUTD Authorized transaction description.

Default label-1: TRANSACTIONDefault label-2: DESCRIPTIONField type: 0A030000 - Group Tran authorization informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

(continued)

Page 182: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Group Security Information Fields Fieldname List

3-114 Auditing and Report Writing Guide

Field Description

GRPRAUTH Program authorization (YES, NONE, or ALL).

Default label-1: GROUPDefault label-2: PROGDefault label-3: AUTHField type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRPRAUTL Authorized programs (listed).

Default label-1: PROGRAMDefault label-2: AUTHDefault label-3: LISTField type: 0A040000 - Group Program authorization informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

GRPRAUTF Authorized program scheduled FROM-time.

Default label-1: PROGRAMDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 0A040000 - Group Program authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

GRPRAUTT Authorized program scheduled TO-time.

Default label-1: PROGRAMDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 0A040000 - Group Program authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

(continued)

Page 183: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Group Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-115

Field Description

GRPRAUTD Authorized program description.

Default label-1: PROGRAMDefault label-2: DESCRIPTIONField type: 0A040000 - Group Program authorization informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

GRFLAUTH File authorization (YES, NONE, or ALL).

Default label-1: GROUPDefault label-2: FILEDefault label-3: AUTHField type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

GRFLAUTL Authorized file names (listed).

Default label-1: FILEDefault label-2: AUTHDefault label-3: LISTField type: 0A050000 - Group File authorization informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

GRFLAUTC File authorization update status.

Default label-1: GROUPDefault label-2: FILEDefault label-3: ACCESSField type: 0A050000 - Group File authorization informationInput data length: 001Input data format: Character (C)Output length: 007Default output format: Transformed (T)

C'I' = INQUIRYC'U' = UPDATE

(continued)

Page 184: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Group Security Information Fields Fieldname List

3-116 Auditing and Report Writing Guide

Field Description

GRFLAUTF Authorized file scheduled FROM-time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: FROM-TIMEField type: 0A050000 - Group File authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

GRFLAUTT Authorized file scheduled TO-time.

Default label-1: FILEDefault label-2: SCHEDDefault label-3: TO-TIMEField type: 0A050000 - Group File authorization informationInput data length: 004Input data format: X - HexadecimalOutput length: 008Default output format: Transformed (T)

GRFLAUTD Authorized file description.

Default label-1: FILEDefault label-2: DESCRIPTIONField type: 0A050000 - Group File authorization informationInput data length: 030Input data format: Character (C)Output length: 030Default output format: Character (C)

GRMPAUTH Map restrictions (YES or NONE).

Default label-1: GROUPDefault label-2: MAPDefault label-3: AUTHField type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

(continued)

Page 185: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Group Security Information Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-117

Field Description

GRMPAUTL Restricted maps (listed).

Default label-1: MAPDefault label-2: AUTHDefault label-3: LISTField type: 0A060000 - Group Map authorization informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

GRMPAUTM Restricted mapset name.

Default label-1: MAPSETDefault label-2: NAMEField type: 0A060000 - Group Map authorization informationInput data length: 007Input data format: Character (C)Output length: 007Default output format: Character (C)

GRMPAUTD Restricted map description.

Default label-1: MAPDefault label-2: TITLEField type: 0A060000 - Group Map authorization informationInput data length: 020Input data format: Character (C)Output length: 020Default output format: Character (C)

GRFDAUTH Field authorization (YES, NONE, or ALL).

Default label-1: GROUPDefault label-2: FIELDDefault label-3: AUTHField type: 0A000000 - Group informationInput data length: 004Input data format: Character (C)Output length: 004Default output format: Character (C)

(continued)

Page 186: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Group Security Information Fields Fieldname List

3-118 Auditing and Report Writing Guide

Field Description

GRFDAUTL Authorized field resource names (listed).

Default label-1: FIELDRESDefault label-2: AUTHDefault label-3: LISTField type: 0A070000 - Group Field authorization informationInput data length: 008Input data format: Character (C)Output length: 008Default output format: Character (C)

Page 187: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Group Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-119

User Group Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC user-grouprecords (RECTYPE EQ C'UG', segment X'0B000000'). These fields will be printed only onreport detail lines with other user group record and common segment fieldnames.

Field Description

UGOPRNUM User-group user ID.

Default label-1: USERDefault label-2: IDField type: 0B000000 - User-group informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

UGTERMID User-group terminal ID.

Default label-1: TERMINALDefault label-2: IDField type: 0B000000 - User-group informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

UGALTGRP User-group Alert group.

Default label-1: ALERTDefault label-2: GROUPField type: 0B000000 - User-group informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

UGGROUP User-group group name.

Default label-1: GROUPDefault label-2: NAMEField type: 0B010000 - User-group Alert-transaction informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

(continued)

Page 188: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Group Record Fields Fieldname List

3-120 Auditing and Report Writing Guide

Field Description

UGTRAUTL Authorized transactions (listed).

Default label-1: TRANDefault label-2: AUTHDefault label-3: LISTField type: 0B020000 - User-group informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

UGPRAUTL Authorized programs (listed).

Default label-1: PROGDefault label-2: AUTHDefault label-3: LISTField type: 0B030000 - User-group informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

UGFLAUTL Authorized files (listed).

Default label-1: FILEDefault label-2: AUTHDefault label-3: LISTField type: 0B040000 - User-group informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

UGMPAUTL Authorized maps (listed).

Default label-1: MAPDefault label-2: AUTHDefault label-3: LISTField type: 0B050000 - User-group informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 189: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Group Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-121

Field Description

UGFDAUTL Authorized field resource names (listed).

Default label-1: FIELDRESDefault label-2: AUTHDefault label-3: LISTField type: 0B060000 - User-group informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 190: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Profile Record Fields Fieldname List

3-122 Auditing and Report Writing Guide

User Profile Record Fields

The following fieldnames can be included in any ALRTVCSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVCSC userprofile records (RECTYPE EQ C'UP', segment X'0C000000'). These fields will be printedonly on report detail lines with other user profile record and common segment fieldnames.

Field Description

UPUSERID User profile user ID.

Default label-1: USERIDField type: 0C000000 - User profile informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

UPTIMSTM User profile time stamp.

Default label-1: USER TIME STAMPField type: 0C000000 - User profile informationInput data length: 8Input data format: Hexadecimal (X)Default output length: 17Default output format: Transformed (T)

X'AA893F58 68880000'.....T'01/26/95 10:00:00'

UPUSRNAM User profile user name.

Default label-1: USER NAMEField type: 0C000000 - User profile informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

UPLANG User profile user language.

Default label-1: LANGUAGEField type: 0C000000 - User profile informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

Page 191: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Profile Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-123

Field Description

UPPWDDAT User profile password date.

Default label-1: PASSWORDDefault label-2: DATEField type: 0C000000 - User profile informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

UPPWDZON User profile password time zone.

Default label-1: PASSWORDDefault label-2: ZONEField type: 0C000000 - User profile informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

UPNEWPDT User profile new password date.

Default label-1: NEWDefault label-2: PASSWORDDefault label-3: DATEField type: 0C000000 - User profile informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

UPNEWPZN User profile new password time zone.

Default label-1: NEWDefault label-2: PASSWORDDefault label-3: ZONEField type: 0C000000 - User profile informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

(continued)

Page 192: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Profile Record Fields Fieldname List

3-124 Auditing and Report Writing Guide

Field Description

UPNOTCNT User profile password notification count.

Default label-1: PASSWORDDefault label-2: NOTIFYDefault label-3: COUNTField type: 0C000000 - User profile informationInput data length: 2Input data format: Packed decimal (P)Default output length: 3Default output format: Zoned decimal (Z)

UPSTATUS User profile user ID status.

Default label-1: USERIDDefault label-2: STATUSField type: 0C000000 - User profile informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'...........T'ACTIVE'C'D'...........T'DISABLED'C'K'...........T'KEEP'

UPUSRTYP User profile user type.

Default label-1: USERDefault label-2: TYPEField type: 0C000000 - User profile informationInput data length: 1Input data format: Character (C)Default output length: 17Default output format: Transformed (T)

C'R'...........T'REGULAR USERID'C'M'...........T'MAIN ADMINISTRATOR'C'T'...........T'SUB ADM (TRM/OPR)'C'O'...........T'SUB ADM (OPER)'

UPOWNADM User profile owning administrator.

Default label-1: OWNINGDefault label-2: ADMINField type: 0C000000 - User profile informationInput data length: 16Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 193: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Profile Record Fields

Chapter 3. ALRTVCSC Security File Report (CICS) 3-125

Field Description

UPUPADM User profile administrator last update.

Default label-1: ADMINDefault label-2: LASTDefault label-3: UPDATEField type: 0C000000 - User profile informationInput data length: 16Input data format: Character (C)Default output length: 8Default output format: Character (C)

UPSGNDAT User profile last sign-on date.

Default label-1: LASTDefault label-2: SIGNONDefault label-3: DATEField type: 0C000000 - User profile informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

UPSGNZON User profile last last sign-on zone.

Default label-1: LASTDefault label-2: SIGNONDefault label-3: ZONEField type: 0C000000 - User profile informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

UPSGNSID User profile last sign-on system ID.

Default label-1: LASTDefault label-2: SIGNONDefault label-3: SYSIDField type: 0C000000 - User profile informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 194: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Sample ALRTVCSC Reports

3-126 Auditing and Report Writing Guide

Sample ALRTVCSC Reports

Introduction

The following sample reports illustrate ways to use the BIM-ALERT/CICS batch report writerto produce reports similar to the predefined batch reports (S1Bxxx programs) distributed withBIM-ALERT/CICS and detailed in Appendix B, "Additional BIM-ALERT/CICS Reports".

The input statements of the sample ALRTVCSC reports that follow can be found in the BIM-ALERT installation library in member ALRTVCSC.J.

S1B500 System Transaction Security Report

Use the following command statements to produce the transaction security report shownbelow:

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * SYSTEM TRANSACTION SECURITY INFORMATION * *')REPORT ALRTVCSC LINELEN(80)FIELD TRANSID LABELS(TRAN)FIELD LITERAL(' ')FIELD TRSTATUS LABELS(STATUS)FIELD LITERAL(' ')FIELD TRFRTIME LABELS(>ACCESS) JUSTIFY(R)FIELD LITERAL(/)FIELD TRTOTIME LABELS(<TIME) JUSTIFY(L)FIELD LITERAL(' ')FIELD TRDESCR LABELS('TRANSACTION','DESCRIPTION')RUN/*

Input

Page 195: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCSC Reports S1B500 System Transaction Security Report

Chapter 3. ALRTVCSC Security File Report (CICS) 3-127

DATE: 03/25/1998 11:07:33 PAGE: 000001 B I M - A L E R T / C I C S

* * SYSTEM TRANSACTION SECURITY INFORMATION * * TRANSACTIONTRAN STATUS ACCESS TIME DESCRIPTION---- ------ ------ ---- -----------ALXP ACTIVE 00:01 / 24:00 BIM-ALERT/VSE MAIN TRANSACTIONAXPT ACTIVE 00:01 / 24:00 BIM-ALERT/VSE ONLINE TESTAX7A DISABLED 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITORAX7B DISABLED 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITORAX7C DISABLED 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITORBIMC ACTIVE 00:01 / 24:00 BIMC TRANSACTIONBIMO ACTIVE 00:01 / 24:00 BIMO TRANSACTIONBIMV ACTIVE 00:01 / 24:00 BIMV TRANSACTIONBMGM SAFE 00:01 / 24:00 MAKE BMGM A SAFE TRANSACTIONCECI ACTIVE 00:01 / 24:00 CICS COMMAND INTERPRETERCEDA ACTIVE 00:01 / 24:00 CICS ONLINE RSRCE DEFINITIONCEDF ACTIVE 00:01 / 24:00 CICS ONLINE DEBUGCEMT ACTIVE 00:01 / 24:00 CICS MASTER TERMINALCSMT ACTIVE 00:01 / 24:00 CICS MASTER TERMINALOPWD ACTIVE 00:01 / 24:00 OPWD TRANSACTION

Output

Page 196: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B510 System Program Security Report Sample ALRTVCSC Reports

3-128 Auditing and Report Writing Guide

S1B510 System Program Security Report

Use the following command statements to produce the program security report shown below:

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * SYSTEM PROGRAM SECURITY INFORMATION * *')REPORT ALRTVCSC LINELEN(80)FIELD PROGNAME LABELS(PROGRAM) JUSTIFY(L)FIELD LITERAL(' ')FIELD PROGSTAT LABELS(STATUS)FIELD LITERAL(' ')FIELD PROGFTIM LABELS(>ACCESS) JUSTIFY(R)FIELD LITERAL(/)FIELD PROGTTIM LABELS(<TIME) JUSTIFY(L)FIELD LITERAL(' ')FIELD PROGDESC LABELS('PROGRAM','DESCRIPTION')RUN/*

DATE: 03/25/1998 11:25:13 PAGE: 000001 B I M - A L E R T / C I C S

* * SYSTEM PROGRAM SECURITY INFORMATION * * PROGRAMPROGRAM STATUS ACCESS TIME DESCRIPTION------- ------ ------ ---- -----------AXP10000 ACTIVE 00:01 / 24:00 BIM-ALERT/VSE MAIN MENUAXP720 ACTIVE 00:01 / 24:00 BIM-ALERT/VSE ONLINE TESTBXP10000 PRELOADED 00:01 / 24:00 COMMAND LEVEL TEST PROGRAMBXP720 PRELOADED 00:01 / 24:00 COMMAND LEVEL TEST PROGRAMPPY29001 ACTIVE 00:01 / 24:00 PAYROLL MASTER UPDATE PROGPPY29021 ACTIVE 00:01 / 24:00 PAYROLL MASTER ADD PROGPPY29041 ACTIVE 00:01 / 24:00 PAYROLL MASTER UPDATE PROGPPY29044 ACTIVE 00:01 / 24:00 PAYROLL MASTER DISPLAY PROGS10000 DISABLED 00:01 / 24:00 BIM-ALERT/CICS MAIN MENU

Input

Output

Page 197: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCSC Reports S1B520 System File Security Report

Chapter 3. ALRTVCSC Security File Report (CICS) 3-129

S1B520 System File Security Report

Use the following command statements to produce the file security report shown below:

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * SYSTEM FILE SECURITY INFORMATION * *')REPORT ALRTVCSC LINELEN(80)FIELD FILENAME LABELS(FILE NAME) JUSTIFY(L)FIELD FILESTAT LABELS(STATUS)FIELD FILEPROC LABELS(PROCESS)FIELD FILEFTIM LABELS(>ACCESS) JUSTIFY(R)FIELD LITERAL(/)FIELD FILETTIM LABELS(<TIME) JUSTIFY(L)FIELD LITERAL(' ')FIELD FILEDESC LABELS('FILE DESCRIPTION') JUSTIFY(L)RUN/*

DATE: 03/25/1998 12:00:52 PAGE: 000001 B I M - A L E R T / C I C S

* * SYSTEM FILE SECURITY INFORMATION * * FILE NAME STATUS PROCESS ACCESS TIME FILE DESCRIPTION ---- ------ ------- ------ ---- ----------------ALERTXP ACTIVE UPDATE 00:01 / 24:00 BIM-ALERT/VSE RULES FILEAXPCTL ACTIVE INQUIRY 00:01 / 24:00 BIM-ALERT/VSE CONTROL FILEAXPLOG1 ACTIVE INQUIRY 00:01 / 24:00 BIM-ALERT/VSE LOG FILES1SAUDT ACTIVE UPDATE 00:01 / 24:00 BIM-ALERT AUDIT FILES1SCTY ACTIVE UPDATE 00:01 / 24:00 BIM-ALERT/CICS RULES FILES1SECLG ACTIVE UPDATE 00:01 / 24:00 BIM-ALERT/CICS LOG FILES1SMS## ACTIVE UPDATE 00:01 / 24:00 BIM-ALERT/CICS MESSAGE FILE

Input

Output

Page 198: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B530 System Map Display Security Report Sample ALRTVCSC Reports

3-130 Auditing and Report Writing Guide

S1B530 System Map Display Security Report

Use the following command statements to produce the map display security report shownbelow:

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * SYSTEM MAP DISPLAY SECURITY INFORMATION * *')REPORT ALRTVCSCFIELD MAPNAME REPCHAR(' ') CTLBREAK(S)FIELD MAPSET REPCHAR(' ') CTLBREAK(S)FIELD MAPNUM REPCHAR(' ') FORMAT(X) LENGTH(7) CTLBREAK(S)FIELD MAPTITLE REPCHAR(' ') JUSTIFY(L) LABELS('<MAP TITLE')FIELD MAPSTAT REPCHAR(' ')FIELD MAPFDNUM FORMAT(X) LENGTH(3)FIELD MAPFDISPFIELD MAPFDSCR JUSTIFY(L) LABELS('<FIELD NAME')SELECT IF RECTYPE EQ C'MP'RUN/*

DATE: 05/12/1998 13:48 PAGE: 000001 B I M - A L E R T / C I C S

* * SYSTEM MAP DISPLAY SECURITY INFORMATION * * MAP MAP MAP MAP MAPSET REFERENCE MAP FLD FLD NAME NAME NUMBER MAP TITLE STATUS NUM DSPL FIELD NAME ---- ------ --------- --------- ------ --- ---- ---------- S#M500 S1M500 0000001 TEST MAP S#M550 ACTIVE 002 YES TEST FIELD 2 005 YES TEST FIELD 5 008 YES TEST FIELD 8 009 YES TEST FIELD 9 010 YES TEST FIELD 10 S#M500 S1M500 0000002 TEST MAP S#M500 ACTIVE 001 YES TEST FIELD 1 002 YES TEST FIELD 2 003 YES TEST FIELD 3 S#M510 S1M510 0000003 TEST MAP S#M510 ACTIVE 001 YES TEST FIELD 1 003 YES TEST FIELD 3 005 YES TEST FIELD 5 S#M510 S1M510 0000004 TEST MAP S#M510 ACTIVE 001 YES TEST FIELD 1 002 YES TEST FIELD 2 003 YES TEST FIELD 3 004 YES TEST FIELD 4 005 YES TEST FIELD 5 S#M510 S1M510 0000005 TEST MAP S#M510 ACTIVE 001 YES TEST FIELD 1 XXXXXX 002 YES TEST FIELD 2 XXXXXX 003 YES TEST FIELD 3 XXXXXX 011 YES TEST FIELD 11 XXXXX 012 YES TEST FIELD 12 XXXXX 013 YES TEST FIELD 13 XXXXX 101 YES TEST FIELD 101 XXXX 102 YES TEST FIELD 102 XXXX 103 YES TEST FIELD 103 XXXX

Input

Output

Page 199: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCSC Reports S1B540 Organizational Information Report

Chapter 3. ALRTVCSC Security File Report (CICS) 3-131

S1B540 Organizational Information Report

Use these statements to produce the following organizational information report:

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * ORGANIZATIONAL INFORMATION * *')REPORT ALRTVCSCSUBTITLE COMPNAME LABEL('COMPANY NAME:') CTLBREAK(P)SUBTITLE COMPANY LABEL(' ID:') LINE(2)FIELD DIVISION JUSTIFY(R) REPCHAR(.) LABELS(NO)FIELD DIVNAME JUSTIFY(L) REPCHAR(.) - LABELS('<DIVISION NAME')FIELD DEPARTMT JUSTIFY(R) REPCHAR(.) LABELS(NO)FIELD DEPTNAME JUSTIFY(L) REPCHAR(.) - LABELS('<DEPARTMENT NAME')FIELD SECTION JUSTIFY(R) REPCHAR(.) LABELS(NO)FIELD SECTNAME JUSTIFY(L) REPCHAR(.) - LABELS('<SECTION NAME')SELECT IF RECTYPE EQ C'LO' AND - DIVISION(1) NE X'00'RUN/*

DATE: 03/25/1998 13:04:17 PAGE: 000001 B I M - A L E R T / C I C S

* * ORGANIZATIONAL INFORMATION * *COMPANY NAME: B I MOYLE ASSOCIATES, INC. ID: BIM DIVISION NAME DEPARTMENT NAME SECTION NAME ------------- --------------- ------------ . . . . . . CLBS BIM OHIO OFFICE . . . . . . DEVL COLUMBUS DEVELOPMENT . . . . . . ALRT BIM-ALERT . . . . FAQS BIM-FAQS . . . . 0000 ( N/A ) . . SUPP COLUMBUS SUPPORT . . . . . . ALRT BIM-ALERT . . . . FAQS BIM-FAQS . . . . 0000 ( N/A ) . . 0000 ( N/A ) . . . . . . 0000 ( N/A ) MPLS BIM MINNEAPOLIS OFFICE . . . . . . ADMN MINNEAPOLIS ADMINISTRATION . . . . . . 0000 ( N/A ) . . DEVL MINNEAPOLIS DEVELOPMENT . . . . . . MVS MVS SYSTEMS . . . . VSE VSE SYSTEMS . . . . 0000 ( N/A ) . . SUPP MINNEAPOLIS SUPPORT . . . . . . 0000 ( N/A ) . . 0000 ( N/A ) . . . . . . 0000 ( N/A ) SNTA BIM CALIFORNIA OFFICE . . . . . . DEVL SANTA ANA DEVELOPMENT . . . . . . EPIC BIM-EPIC/VSE . . . . 0000 ( N/A ) . . SUPP SANTA ANA SUPPORT . . . . . . 0000 ( N/A ) . . 0000 ( N/A ) . . . . . . 0000 ( N/A )

Input

Output

Page 200: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator and Terminal Reports Sample ALRTVCSC Reports

3-132 Auditing and Report Writing Guide

Operator and Terminal Reports

Although it is not possible to generate a report exactly like the standard S1B550 operatorsecurity report, it is possible to get much more specific operator reports using the BIM-ALERT Batch Report Writer.

The following examples show some samples of reports users have requested in the past. Thisis by no means a complete accounting of all the operator reports possible.

The same reports can be produced for terminals rather than operators by specifying the correctalternative fieldnames.

Overview

Page 201: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCSC Reports Operator Security Report - Access Time Report

Chapter 3. ALRTVCSC Security File Report (CICS) 3-133

Operator Security Report - Access Time Report

Use the following command statements to produce the operator security report shown shownon the next page. Note the use of the XFORM command to transform internal time valuesand create the GROUP-ID field. Also note the use of literals in both the SUBTITLE andFIELD command statements.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - ' ' - '* * OPERATOR SECURITY INFORMATION * *' - 'AUTHORIZED TIME REPORT')XFORM TIME (X'00001770' T'MIDNIGHT' X'0083D600' T'MIDNIGHT' - X'00000000' T'.....' X'000000' T'....') - GROUP (C'A' T'A-GROUP' C'B' T'B-GROUP' C'C' T'C-GROUP' - C'D' T'D-GROUP' C'E' T'E-GROUP' C'F' T'F-GROUP' - C'G' T'G-GROUP' C'H' T'H-GROUP' C'I' T'I-GROUP' - C'S' T'S-GROUP' C'T' T'T-GROUP' C'U' T'U-GROUP' - C'V' T'V-GROUP' C'W' T'W-GROUP' C'X' T'X-GROUP' - C'Y' T'Y-GROUP' C'Z' T'Z-GROUP' ELSE T'#-GROUP')REPORT ALRTVCSCSUBTITLE LITERAL('-') LENGTH(132) LINE(1)SUBTITLE LITERAL('-') LENGTH(132) LINE(5)SUBTITLE OPRNAME LABEL(' NAME:') LINE(2) - SORTPRTY(1) CTLBREAK(P)SUBTITLE OPRNAME LABEL(' GROUP-ID:') LINE(3) XFORM(GROUP)SUBTITLE OPRNUMBR LABEL(' USER-ID:') LINE(4) SORTPRTY(2) - CTLBREAK(P)SUBTITLE OPRCNAME LABEL('COMP:') JUSTIFY(C) LINE(2)SUBTITLE OPRVNAME LABEL(' DIV:') JUSTIFY(C) LINE(3)SUBTITLE OPRDNAME LABEL('DEPT:') JUSTIFY(R) LINE(2)SUBTITLE OPRSNAME LABEL('SECT:') JUSTIFY(R) LINE(3) FIELD LITERAL('WEEKDAY:') REPCHAR(' ') FIELD OPSCHDAY JUSTIFY(L) LABELS(NO) LENGTH(30) FILLCHAR(.) FIELD OPSCHFTM XFORM(TIME) JUSTIFY(R) - LABELS(>SCHEDULED,>FROM-TIME) FIELD LITERAL ('TO') FIELD OPSCHTTM XFORM(TIME) JUSTIFY(L) LENGTH(12) - LABELS(<SCHEDULED,<TO-TIME) FIELD LITERAL (' ') FIELD OPTMPEFD XFORM(TIME) LABELS(TEMPORARY,FROM-DATE) FIELD OPTMPEFX XFORM(TIME) LABELS(TEMPORARY,TO-DATE) FIELD LITERAL (' ') FIELD OPTMPFTM XFORM(TIME) JUSTIFY(R) - LABELS(>TEMPORARY,>FROM-TIME) FIELD LITERAL ('TO') FIELD OPTMPTTM XFORM(TIME) JUSTIFY(L) LENGTH(12) - LABELS(<TEMPORARY,<TO-TIME)SELECT IF OPRNAME(1) EQ C'f'RUN/*

Input

Page 202: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Security Report - Access Time Report Sample ALRTVCSC Reports

3-134 Auditing and Report Writing Guide

DATE: 03/25/1998 13:23:07 PAGE: 000001 B I M - A L E R T / C I C S

* * OPERATOR SECURITY INFORMATION * * AUTHORIZED TIME REPORT------------------------------------------------------------------------------------------------------------------------------------ NAME: FROST, JACK COMP: B I MOYLE ASSOCIATES, INC. DEPT: COLUMBUS SUPPORT GROUP-ID: F-GROUP DIV: BIM OHIO OFFICE SECT: BIM-ALERT USER-ID: JACKF------------------------------------------------------------------------------------------------------------------------------------ SCHEDULED SCHEDULED TEMPORARY TEMPORARY TEMPORARY TEMPORARY FROM-TIME TO-TIME FROM-DATE TO-DATE FROM-TIME TO-TIME --------- --------- --------- --------- --------- --------- WEEKDAY: SUNDAY........................ MIDNIGHT TO 00:02 04/01/1998 04/30/1998 MIDNIGHT TO MIDNIGHT MONDAY........................ 07:00 TO MIDNIGHT 04/01/1998 04/30/1998 MIDNIGHT TO MIDNIGHT TUESDAY....................... MIDNIGHT TO MIDNIGHT ..... ..... ..... TO ..... WEDNESDAY..................... MIDNIGHT TO MIDNIGHT ..... ..... ..... TO ..... THURSDAY...................... MIDNIGHT TO MIDNIGHT ..... ..... ..... TO ..... FRIDAY........................ MIDNIGHT TO 15:00 04/01/1998 04/30/1998 MIDNIGHT TO MIDNIGHT SATURDAY...................... MIDNIGHT TO 00:02 04/01/1998 04/30/1998 MIDNIGHT TO MIDNIGHT

Output

Page 203: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCSC Reports Operator Authorization Report

Chapter 3. ALRTVCSC Security File Report (CICS) 3-135

Operator Authorization Report

Use the following command statements to produce the operator report shown on the next page.

Note the use of the XFORM command to transform a single value of a field that already has adefault transformation table.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - '* * OPERATOR INFORMATION * *' - 'AUTHORIZATION LEVELS')XFORM A (X'07010000' T'OPER AUTH')REPORT ALRTVCSCSUBTITLE LITERAL('*') LENGTH(25) LINE(2) JUSTIFY(C)SUBTITLE LITERAL('* *') JUSTIFY(C) LINE(3)SUBTITLE OPRNUMBR CTLBREAK(P) JUSTIFY(C) LINE(3) LABEL('OPERATOR:')SUBTITLE LITERAL('*') LENGTH(25) LINE(4) JUSTIFY(C)FIELD INFOTYPE REPCHAR('"') JUSTIFY(R) XFORM(A)FIELD OPALTRAN MISSCHAR(' ')FIELD OPTRAUTH REPCHAR(' ')FIELD OPTRAUTLFIELD OPPRAUTH REPCHAR(' ')FIELD OPPRAUTLFIELD OPFLAUTH REPCHAR(' ')FIELDS OPFLAUTL OPFLAUTCFIELD OPMPAUTH REPCHAR(' ')FIELD OPMPAUTLRUN/*

DATE: 05/12/1998 13:25 PAGE: 000001 B I M - A L E R T / C I C S * * OPERATOR INFORMATION * * AUTHORIZATION LEVELS

************************* * OPERATOR: FLL * ************************* ALERT OPER TRAN OPER PROGRAM OPER FILE OPER OPER MAP INFO TRAN TRAN AUTH PROG AUTH FILE AUTH FILE MAP AUTH TYPE LIST AUTH LIST AUTH LIST AUTH LIST ACCESS AUTH LIST ---- ----- ---- ---- ---- ------- ---- ---- ------ ---- ---- OPER AUTH NONE ALL . ALL . ALL . . NONE . OPER TRANID AUTH INFO BMGM . . . . " AX7A . . . . " AX7B . . . . " AX7C . . . . " ALXP . . . . " AXPT . . . . OPER PROGRAM AUTH INFO . PPY29001 . . . " . AXP10000 . . . " . S10000 . . . " . AXP720 . . . " . BXP10000 . . . " . BXP720 . . . OPER FILE AUTH INFO . . ALERTXP UPDATE . " . . AXPLOG1 UPDATE . " . . S1SAUDT UPDATE . " . . S1SECLG UPDATE . " . . S1SMS## UPDATE . " . . S1SCTY UPDATE . OPER MAP AUTH INFO . . . . S#M550

Input

Output

Page 204: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Sign-On Report Sample ALRTVCSC Reports

3-136 Auditing and Report Writing Guide

Operator Sign-On Report

Use these statements to produce the following operator report. This report shows all operatorswho have not signed on for more than 30 days.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - '* * OPERATOR INFORMATION * *' - 'LAST SIGNON > 30 DAYS')REPORT ALRTVCSCXFORM NEVER(X'00000000',T'NEVER')FIELDS OPRNUMBR OPRNAME OPRCOMP OPRDIV OPRDEPT OPRSECTFIELD OPRLDATE XFORM(NEVER)SELECT IF OPRLDATE LE C'02/23/1998'RUN/*

DATE: 03/27/1998 06:03:53 PAGE: 000001 B I M - A L E R T / C I C S * * OPERATOR INFORMATION * * LAST SIGNON > 30 DAYS OPER OPERATOR OPER OPER OPER OPER LAST USERID NAME COMP DIV. DEPT SECT SIGNON DATE ------ -------- ---- ---- ---- ---- ----------- A DEFAULT ADMIN 0000 0000 0000 0000 NEVER ADMN FAQS/PCS USER PROFIL 0000 0000 0000 0000 NEVER ALCMAINT ALCMAINT 0000 0000 0000 0000 11/20/1997 AXPMAINT AXPMAINT 0000 0000 0000 0000 NEVER DICKM DICKM 0000 0000 0000 0000 11/13/1997 DICKM2 DICKM2 0000 0000 0000 0000 NEVER ERIC KEHLER, ERIC 0000 0000 0000 0000 01/13/1998 FLL LINTON, FRED 0000 0000 0000 0000 01/13/1998 GOP GOP 0000 0000 0000 0000 NEVER GW001 WASHINGTON, GEORGE 0000 0000 0000 0000 NEVER JACKF FROST, JACK BIM CLBS SUPP ALRT NEVER JAKE JAKE 0000 0000 0000 0000 10/10/1997 JSTECHER STECHER, JIM 0000 0000 0000 0000 NEVER KEF KEF 0000 0000 0000 0000 NEVER KJM KJM 0000 0000 0000 0000 NEVER MODEL MODEL 0000 0000 0000 0000 NEVER MODEL2 MODEL2 0000 0000 0000 0000 NEVER OPER1 OPER1 0000 0000 0000 0000 08/26/1997 OPER13 OPER13 0000 0000 0000 0000 NEVER OPER2 OPER2 0000 0000 0000 0000 07/02/1997 OPER3 OPER3 0000 0000 0000 0000 NEVER OPER4 OPER4 0000 0000 0000 0000 NEVER OPER5 OPER5 0000 0000 0000 0000 NEVER OPER6 OPER6 0000 0000 0000 0000 NEVER PCSMAINT PCSMAINT 0000 0000 0000 0000 NEVER ROBERT ROBERT 0000 0000 0000 0000 NEVER Y2TEST Y2TEST 0000 0000 0000 0000 01/13/1998

Input

Output

Page 205: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

4-1

4 ALRTVVSC Security File Report (VSE)

This chapter describes the ALRTVVSC security file report, which you can use to select anddisplay information from the BIM-ALERT/VSE security file.

Introduction....................................................................................................................4-2General Information...................................................................................................4-2Sample JCL................................................................................................................4-2Input Record Description...........................................................................................4-3Field Information .......................................................................................................4-4

Fieldname List................................................................................................................4-6Common Segment Fields ...........................................................................................4-6User Record Fields ..................................................................................................4-11Jobmask Record Fields ............................................................................................4-15SECID Record Fields ..............................................................................................4-16DASD and Tape Dataset Record Fields...................................................................4-18Resource Record Fields ...........................................................................................4-23Reference Record Field ...........................................................................................4-26Node Information Fields..........................................................................................4-27Remote Submittal Information Fields ......................................................................4-29XPCC Submittal Information Fields........................................................................4-31

Sample ALRTVVSC Report ........................................................................................4-32Introduction .............................................................................................................4-32Logical Table Ruleset Report ..................................................................................4-32

Page 206: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

General Information Introduction

4-2 Auditing and Report Writing Guide

Introduction

General Information

Security information contained in the BIM-ALERT/VSE security file is available for selectionand display in the ALRTVVSC report type.

This report type requires the BIM-ALERT/VSE security file, or a VSAM copy of the file, asinput. It will also accept a sequential tape or disk file of variable-length records as input.

The phase ALRTVVSC is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVVSC reads the input file and formats the data for thereport.

To select user profile information from the security file, use the ALRTVCSC report type,described in Chapter 3, "ALRTVCSC Security File Report (CICS)".

Sample JCL

The following sample JCL can be used to execute any ALRTVVSC report:

// JOB ALRTVVSC BIM-ALERT/VSE security file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL ALERTXP,'ALERT.ALERTXP.V50',,VSAM// EXEC ALRTVREP,SIZE=256K . ./*/&

Report Description

Input Dataset

I/O Module Name

User Profile

Page 207: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 4. ALRTVVSC Security File Report (VSE) 4-3

Input Record Description

Each BIM-ALERT/VSE security file record contains a 68-byte record key and one of severalsubordinate information field types (segments), determined by the contents of the RECTYPEfield in the record key.

The user record defines parameters to construct a task ID as part of the user verificationprocess. User records may or may not be present in the file. They will be present only if theextended functions must be used to handle unusual job submittal where no // ID card is presentin the job stream (RJE, etc.).

Task ID Build Information: Fields (Type 01010000)The data in this segment contains field information of the task ID build parameters for the userrecord.

The jobmask record defines the algorithm to use to assign a SECID to a job based on the taskID. Jobmask records will exist only if the extended functions are necessary to handle submittalprocedures outside BIM-ALERT/VSE's submittal monitors (RJE, etc.).

The SECID record defines all valid SECIDs and their characteristics. See the individualfieldname definitions for more information.

SECID Job Entry Source (Type 04010000)This segment identifies the job entry source information valid for the SECID. It is a variable-occurrence segment. In other words, the segment can occur more than once within the parentSECID information record.

When a fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for each occurrence of the segment inthe input record.

SECID Job Entry Mode (Type 04020000)This segment identifies the job entry mode information valid for the SECID. It is a variable-occurrence segment. In other words, the segment can occur several times within the parentSECID information record.

When a fieldname defined within this segment is included in a FIELD or FIELDS commandstatement, one report output detail line will be generated for each occurrence of the segment inthe input record.

SECID RJENODE Information (Type 04030000)This segment identifies the RJENODE information valid for the SECID.

SECID RJEUID Information (Type 04040000)This segment identifies the RJEUID information valid for the SECID.

Introduction

User Information(Type 01000000)

JobmaskInformation (Type03000000)

SECID Information(Type 04000000)

Page 208: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

4-4 Auditing and Report Writing Guide

The DASD or tape dataset record defines a single dataset name (either generic or specific) anda SECID's authorization to access the dataset.

The resource record defines a single resource (either generic or specific) and a SECID'sauthorization to access the resource.

The cross-reference record is used internally by BIM-ALERT/VSE to associate resource anddataset rulesets with specific SECIDs.

The type C0000000 fields can be selected to produce a report on node name data from thenode name information records.

The type C10x0000 fields can be selected to produce a report of remote submittal data fromthe system control file record.

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default or user specifications. Each data field is selected from a pre-defined list of ALRTVVSC fieldnames.

At report generation time, each fieldname specified is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to each selected fieldname is located, extracted from the physical inputrecord by the ALRTVVSC I/O module, and moved to, or transformed into, the output reportcolumn, using either the default values described in the fieldname entries or those specified bythe user in a FIELD command statement.

The following information is provided for each ALRTVVSC fieldname:

Heading Description

Group Field: YES Indicates that the fieldname being defined is a group fieldname containing several individualfieldnames within the group. The individual fieldnames are listed.• If the group fieldname is specified in the SUBTITLE, FIELD, or FIELDS command

statement, input data represented by all individual fieldnames within the group will beprinted as a single field.

• If the individual fieldnames are specified in a command statement, each fieldname isassigned its own column in the report output detail line.

(continued)

DASD or TapeDatasetInformation (Type05000000)

ResourceInformation (Type06000000)

Cross-ReferenceInformation (Type07000000)

Node Information(Type C0000000)

Remote SubmittalInformation (TypeC1000000)

Field Information

Page 209: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 4. ALRTVVSC Security File Report (VSE) 4-5

Heading Description

Field type Each fieldname is defined as a particular field type. By definition, type 00000000 information ispresent in each input record. Following the type 00000000 common segment information,ALRTVVSC records will contain one subordinate type of field information: type 01000000 to0C10x000, containing information as indicated by the RECTYPE field.

Default label-n Default label information is positioned in the output report, if requested, at the top of each pageof output. Up to three labels can be specified for each field; they will be placed above the reportcolumn reserved for the fieldname.

Occurrences: variable Indicates that the field is defined within a variable-occurrence segment. This fieldname, ifincluded on any FIELD or FIELDS command statement, will generate a report detail line foreach occurrence of the information in the record.

Belongs to group This indicates a higher level group fieldname that can be included on any SUBTITLE, FIELD,or FIELDS command statement to display the data represented by this fieldname.

Input data length Represents the defined length of the data in the input record corresponding to the fieldname. Ifthe length is indicated as variable, then the length of the data field has no pre-defined length, andthe amount of data present is defined in each individual input record.

Input data format Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default output length This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be increased or decreased by the use of the LENGTH keyword on a FIELD commandstatement.

Default output format One of the following output formats is assigned by default for each fieldname; it determines howthe data will appear in the output report:

C Character. The input data is simply moved from the input record to the report detailline. Each non-printable character is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-character hexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is treated as a binarynumber and converted to its decimal equivalent. By default, zoned-decimal formattedoutput fields are zero-suppressed and right-justified in the report column. Users canoverride the field justification value by using the JUSTIFY keyword on the FIELDcommand statement. Zero-suppression can be overridden by specifying NOTRUNCon the FIELD or SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forthin the transformation table shown, or as determined by some other programmedtransformation algorithm, such as is performed on the BIM-ALERT/VSE RECTYPEfield.

Users can override the field output format value by using the FORMAT keyword on the FIELDcommand statement.

Page 210: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

4-6 Auditing and Report Writing Guide

Fieldname List

Common Segment Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the common segment of allinput records and, if specified, will be printed on all detail lines.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label-1: RECORD KEYInput data length: 68Input data format: Hexadecimal (X)Default output data length: 136Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: RECORDDefault label-3: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 6Default output data format: Zoned-decimal (Z)

DSNAME Name of input file dataset from which the report was created. This isespecially useful when you have more than one security file.

Field type: 00000000 - Common segment informationDefault label-1: INPUT DSNAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

(continued)

Page 211: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-7

Field Description

RECTYPE Input record type, which indicates what type of security information iscontained in the security file record.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: TYPEInput data length: 2Input data format: Character (C)Default output length: 13Default output format: Transformed (T)

C'10'...........T'USER 'C'30'...........T'JOBMASK 'C'35'...........T'SPEC-SECID 'C'40'...........T'SECID 'C'50'...........T'DASD 'C'55'...........T'TAPE 'C'60'...........T'RESOURCE 'C'70'...........T'REFERENCE 'C'C0'...........T'NODENAME 'C'C1'...........T'REMOTE SUBMIT'

TABLENUM Logical table number to which this record belongs.

Field type: 00000000 - Common segment informationDefault label-1: TBLDefault label-2: NUMInput data length: 2Input data format: Character (C)Default output data length: 2Default output data format: Character (C)

SERNUM Record serial number.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: SERIALDefault label-3: NUMBERInput data length: 4Input data format: Hexadecimal (X)Default output data length: 8Default output data format: Zoned-decimal (Z)

(continued)

Page 212: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

4-8 Auditing and Report Writing Guide

Field Description

FILECTL File control number, used internally by BIM-ALERT/VSE.

Field type: 00000000 - Common segment informationDefault label-1: FILEDefault label-2: CONTROLDefault label-3: NUMBERInput data length: 4Input data format: Hexadecimal (X)Default output data length: 8Default output data format: Zoned-decimal (Z)

RECSTAT Status of this record.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: STATUSInput data length: 1Input data format: Hexadecimal (C)Default output data length: 8Default output data format: Transformed (T)

C'A'............T'ACTIVE 'C'D'............T'DISABLED'C'M'............T'MONITOR 'C'W'............T'WTO/LOG 'C'L'............T'LOG 'C'T'............T'AUDIT '

RECFLAG Record flag.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: FLAGInput data length: 1Input data format: Hexadecimal (X)Default output data length: 8Default output data format: Transformed (T)

X'80'...........T'NO PASS 'X'40'...........T'INV PWD 'X'20'...........T'INV MEM 'X'00'...........T'NORMAL '

COMMENTS Record descriptive information.

Field type: 00000000 - Common segment informationDefault label-1: COMMENTSInput data length: 30Input data format: Character (C)Default output data length: 30Default output data format: Character (C)

(continued)

Page 213: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-9

Field Description

OPIDLUPD Operator who last updated record.

Field type: 00000000 - Common segment informationDefault label-1: OPIDDefault label-2: LASTDefault label-3: UPDATEInput data length: 3Input data format: Character (C)Default output data length: 3Default output data format: Character (C)

INFOTYPE Information type, which describes the type of information contained in thefield or record.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X)Default output length: 23Default output format: Transformed (T)

X'00000000'.....T'COMMON SEGMENT INFO 'X'01000000'.....T'USER INFO 'X'01010000'.....T'USER TASKID BUILD 'X'01020000'.....T'USER TASKID BUILD 'X'01030000'.....T'USER TASKID BUILD 'X'03000000'.....T'JOBMASK INFO 'X'04000000'.....T'SECID INFO 'X'04010000'.....T'SECID JOB ENTRY SOURCE 'X'04020000'.....T'SECID JOB ENTRY MODE 'X'04030000'.....T'SECID JOB ENTRY RJENODE 'X'04040000'.....T'SECID JOB ENTRY RJEUID 'X'05000000'.....T'DASD/TAPE DATASET INFO 'X'06000000'.....T'RESOURCE INFO 'X'07000000'.....T'REFERENCE INFO 'X'C0000000'.....T'NODENAME INFO 'X'C1000000'.....T'REMOTE SUBMIT CLASS INFO'X'C1010000'.....T'REMOTE SUBMIT SYSID INFO'

(continued)

Page 214: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

4-10 Auditing and Report Writing Guide

Field Description

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: noneInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

INRECNUM Physical input record sequence number, assigned by the ALRTVVSC I/Omodule when the input record is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

Page 215: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-11

User Record Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVVSC input fileuser records (RECTYPE EQ C'10', segment X'01000000'). These fields will be printed onlyon report detail lines with other user record and common segment fieldnames.

Field Description

JOBENFLD Job entry field for user validation.

Field type: 01000000 - User informationDefault label-1: JOBDefault label-2: ENTRYDefault label-3: FIELDInput data length: 1Input data format: Hexadecimal(X)Default output length: 8Default output format: Transformed (T)

X'10'.........T'JOBNAME 'X'20'.........T'POWERJOB'X'30'.........T'USERNAME'X'40'.........T'PASSWORD'X'50'.........T'ACCT 'X'60'.........T'MODE 'X'70'.........T'RJENODE 'X'80'.........T'RJEUID 'X'90'.........T'SOURCE 'X'A0'.........T'USERNAME'X'B0'.........T'PASSWORD'X'00'.........T'UNKNOWN '

JOBENPOS Job entry field validation starting position.

Default label-1: JOBDefault label-2: ENTRYDefault label-2: POSField type: 01000000 - User informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Zoned-decimal (Z)

(continued)

Page 216: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Record Fields Fieldname List

4-12 Auditing and Report Writing Guide

Field Description

JOBENLIT Job entry field validation compare value.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: LITERALField type: 01000000 - User informationInput data length: 16Input data format: Character (P)Default output length: 16Default output format: Character (C)

JOBENLLN Job entry field validation compare length.

Default label-1: J-EDefault label-2: LITDefault label-3: LENField type: 01000000 - User informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Zoned-decimal (Z)

JOBENMOD Job entry mode, which indicates where to get validation information.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: MODEField type: 01000000 - User informationInput data length: 1Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

C'P'.........T'POWER'C'I'.........T'// ID'

JOBENACT Action to take on successful validation.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: ACTIONField type: 01000000 - User informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

(continued)

Page 217: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List User Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-13

Field Description

TSKIDFLD Task ID build parameters: fieldnames.

Default label-1: TASKIDDefault label-2: FIELDField type: 01010000 - User information: task ID buildOccurrences: Variable - up to eight lines of output can be generated ifthis fieldname is specified, representing each field contributing to theconstruction of the task ID.Input data length:1Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

X'10'.........T'JOBNAME 'X'20'.........T'POWERJOB'X'30'.........T'USERNAME'X'40'.........T'PASSWORD'X'50'.........T'ACCT 'X'60'.........T'MODE 'X'70'.........T'RJENODE 'X'80'.........T'RJEUID 'X'90'.........T'SOURCE 'X'A0'.........T'USERNAME'X'B0'.........T'PASSWORD'X'00'.........T'UNKNOWN '

TSKIDFLP Task ID build parameters: position information.Default label-1: TASKIDDefault label-2: FIELDDefault label-3: POSField type: 01010000 - User information: task ID buildOccurrences: Variable - up to eight lines of output can be generated ifthis fieldname is specified, representing each field contributing to theconstruction of the task ID.Input data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Zoned-decimal (Z)

(continued)

Page 218: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Record Fields Fieldname List

4-14 Auditing and Report Writing Guide

Field Description

TSKIDFLL Task ID build parameters: length information.

Default label-1: TASKIDDefault label-2: FIELDDefault label-3: LENGTHField type: 01010000 - User information: task ID buildOccurrences: Variable - up to eight lines of output can be generated ifthis fieldname is specified, representing each field contributing to theconstruction of the task ID.Input data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Zoned-decimal (Z)

TSKIDLIT Task ID literal.

Default label-1: TASKIDDefault label-2: LITERALField type: 01000000 - User informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 219: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Jobmask Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-15

Jobmask Record Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVVSC input filejobmask records (RECTYPE C'30', segment X'03000000'). The fields will be printed only onreport detail lines with other jobmask record and common segment fieldnames.

Field Description

JMSKSEQ Jobmask sequence number.

Default label-1: SEQDefault label-2: NUMField type: 03000000 - Jobmask informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Zoned-decimal (Z)

JMSKACT Action for this jobmask rule.

Default label-1: ACTIONField type: 03000000 - Jobmask informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

JMSKMASK Mask to use for validation.

Default label-1: JOBMASKDefault label-2: MASKField type: 03000000 - Jobmask informationInput data length: 8Input data format: Character (C)Default output length: 16Default output format: Character (C)

JMSKSEC SECID to assign for this task ID.

Default label-1: JOBMASKDefault label-2: BUILDDefault label-3: INFOField type: 03000000 - Jobmask informationInput data length: 8Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 220: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Record Fields Fieldname List

4-16 Auditing and Report Writing Guide

SECID Record Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVVSC input fileSECID records (RECTYPE EQ C'35' or '40', segment X'04000000'). These fields will beprinted only on report detail lines with other SECID record and common segment fieldnames.

Field Description

SECIDMSK SECID this rule defines.

Default label-1: SECIDDefault label-2: MASKField type: 04000000 - SECID informationInput data length: 8Input data format: Character (C)Default output length: 16Default output format: Character (C)

SECIDSEQ Sequence number of this SECID rule, used internally for sorting purposes.

Default label-1: SEQDefault label-2: NUMField type: 04000000 - SECID informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Zoned-decimal (Z)

SECIDPWM Password mode for this SECID.

Default label-1: PSWDDefault label-2: MODEField type: 04000000 - SECID informationInput data length: 1Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

C'P'............T'POWER'C'I'............T'// ID'

(continued)

Page 221: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List SECID Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-17

Field Description

SECIDSRC Valid job sources for this SECID.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: SOURCEField type: 04010000 - SECID source informationOccurrences: Variable - multiple lines of output can be generated if thisfieldname is specified, representing each job entry source defined for thisSECID.Input data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SECIDMOD Valid modes for this SECID.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: MODEField type: 04020000 - SECID mode informationOccurrences: Variable - multiple lines of output can be generated if thisfieldname is specified, representing each job entry mode defined for thisSECID.Input data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SECIDNOD Valid RJENODEs for this SECID.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: RJENODEOccurrences: VariableField type: 04030000 - SECID RJENODE informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SECIDUID Valid RJEUIDs for this SECID.

Default label-1: JOBDefault label-2: ENTRYDefault label-3: RJEUIDOccurrences: VariableField type: 04040000 - SECID RJEUID informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 222: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD and Tape Dataset Record Fields Fieldname List

4-18 Auditing and Report Writing Guide

DASD and Tape Dataset Record Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVVSC input filelocation records (RECTYPE EQ C'50' or C'55', segment X'05000000'). These fields will beprinted only on report detail lines with other dataset record and common segment fieldnames.

Field Description

DASDDSN DASD dataset name.

Default label-1: DASDDefault label-2: DATASETDefault label-3: NAMEField type: 05000000 - DASD or tape dataset informationInput data length: 44Input data format: Character (C)Default output length: 44Default output format: Character (C)

DASDVOL VOLSER on which dataset resides.

Default label-1: DASDDefault label-2: DATASETDefault label-3: VOLSERField type: 05000000 - DASD or tape dataset informationInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

DASDSRK SECID reference record key, used internally to associate SECIDs withresources.

Default label-1: DASDDefault label-2: SECIDDefault label-3: REFKEYField type: 05000000 - DASD or tape dataset informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Zoned-decimal (Z)

(continued)

Page 223: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List DASD and Tape Dataset Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-19

Field Description

DASDAUP DASD authorized program name.

Default label-1: DASDDefault label-2: AUTHDefault label-3: PROGRAMField type: 05000000 - DASD or tape dataset informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

DASDSEC SECID to which this rule applies.

Default label-1: DASDDefault label-2: SECIDField type: 05000000 - DASD or tape dataset informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)

DASDACR Action code for read access.

Default label-1: DASDDefault label-1: READDefault label-1: ACTIONField type: 05000000 - DASD or tape dataset informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

(continued)

Page 224: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD and Tape Dataset Record Fields Fieldname List

4-20 Auditing and Report Writing Guide

Field Description

DASDACU Action code for update access.

Default label-1: DASDDefault label-2: UPDATEDefault label-3: ACTIONField type: 05000000 - DASD or tape dataset informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

DASDACA Action code for alter access.

Default label-1: DASDDefault label-2: ALTERDefault label-3: ACTIONField type: 05000000 - DASD or tape dataset informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

TAPEDSN Tape dataset name.

Default label-1: TAPEDefault label-2: DATASETDefault label-3: NAMEField type: 05000000 - DASD or tape dataset informationInput data length: 44Input data format: Character (C)Default output length: 44Default output format: Character (C)

(continued)

Page 225: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List DASD and Tape Dataset Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-21

Field Description

TAPEVOL Tape dataset volume serial number.

Default label-1: TAPEDefault label-2: DATASETDefault label-3: VOLSERField type: 05000000 - DASD or tape dataset informationInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

TAPESRK SECID reference record key, used internally to associate SECIDs withresources.

Default label-1: TAPEDefault label-2: SECIDDefault label-3: REFKEYField type: 05000000 - DASD or tape dataset informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Zoned-decimal (Z)

TAPESEC Tape SECID.

Default label-1: TAPEDefault label-2: SECIDField type: 05000000 - DASD or tape dataset informationInput data length: 4Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

TAPEAUP Tape authorized program name.

Default label-1: TAPEDefault label-2: AUTHDefault label-3: PROGRAMField type: 05000000 - DASD or tape dataset informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 226: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD and Tape Dataset Record Fields Fieldname List

4-22 Auditing and Report Writing Guide

Field Description

TAPEACR Action code for read access.

Default label-1: TAPEDefault label-2: READDefault label-3: ACTIONField type: 05000000 - DASD or tape dataset informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

TAPEACA Action code for alter access.

Default label-1: TAPEDefault label-2: ALTERDefault label-3: ACTIONField type: 05000000 - DASD or tape dataset informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

Page 227: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Resource Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-23

Resource Record Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statements. These fieldnames are contained in the ALRTVVSC input fileresource records (RECTYPE EQ C'60', segment X'06000000'). These fields will be printedonly on report detail lines with other resource record and common segment fieldnames.

Field Description

RSRCCLS Resource class.

Default label-1: RESOURCEDefault label-2: CLASSField type: 06000000 - Resource informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RSRCNAM Resource name.

Default label-1: RESOURCEDefault label-2: NAMEField type: 06000000 - Resource informationInput data length: 52Input data format: Character (C)Default output length: 52Default output format: Character (C)

RSRCCLB Resource controlled library (YES or NO).

Default label-1: RESDefault label-2: CTLDefault label-3: LIBField type: 06000000 - Resource informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'.........T'YES'C'N'.........T'NO '

(continued)

Page 228: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Record Fields Fieldname List

4-24 Auditing and Report Writing Guide

Field Description

RSRCSRK SECID reference record key, used internally to associate SECIDs withresources.

Default label-1: RESOURCEDefault label-2: REFKEYField type: 06000000 - Resource informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Zoned-decimal (Z)

RSRCSEC Resource SECID.

Default label-1: RESOURCEDefault label-2: SECIDField type: 06000000 - Resource informationInput data length: 4Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

RSRCAUP Resource authorized program name.

Default label-1: RESOURCEDefault label-2: AUTHDefault label-3: PROGRAMField type: 06000000 - Resource informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RSRCACE Action code for execute access.

Default label-1: RESOURCEDefault label-2: EXECDefault label-3: ACTIONField type: 06000000 - Resource informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

(continued)

Page 229: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Resource Record Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-25

Field Description

RSRCACR Action code for read access.

Default label-1: RESOURCEDefault label-2: READDefault label-3: ACTIONField type: 06000000 - Resource informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

RSRCACU Action code for update access.

Default label-1: RESOURCEDefault label-2: UPDATEDefault label-3: ACTIONField type: 06000000 - Resource informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

RSRCACA Action code for alter access.

Default label-1: RESOURCEDefault label-2: ALTERDefault label-3: ACTIONField type: 06000000 - Resource informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'.........T'NONE 'C'C'.........T'CANCEL 'C'W'.........T'WTO/LOG'C'L'.........T'LOG '

Page 230: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Reference Record Field Fieldname List

4-26 Auditing and Report Writing Guide

Reference Record Field

The following fieldname can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statement. This fieldname is contained in the ALRTVVSC input SECIDcross-reference records (RECTYPE EQ C'70', segment X'07000000'). This field will beprinted only on report detail lines with other cross-reference record and common segmentfieldnames.

Field Description

REFSECID SECID associated with this resource.

Belongs to group: REFDefault label-1: SECIDField type: 07000000 - Reference informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 231: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Node Information Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-27

Node Information Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVVSC input nodename information records (RECTYPE EQ C'C0', segment X'C0000000'). These fields will beprinted only on report detail lines with other node information record and common segmentfieldnames.

Field Description

NODENAME Node name.

Default label-1: NODEDefault label-2: NAMEField type: C0000000 - Node name informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPSYSCOD Operating system code.

Default label-1: OPDefault label-2: SYSDefault label-3: CODEField type: C0000000 - Node name informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

ORGTARGT Origin/Target/Both.

Default label-1: ORIGINDefault label-2: ORDefault label-3: TARGETField type: C0000000 - Node name informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

(continued)

Page 232: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Node Information Fields Fieldname List

4-28 Auditing and Report Writing Guide

Field Description

SECDSYS Secured system (Y or N).

Default label-1: SECDefault label-2: SYSField type: C0000000 - Node name informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'.........T'YES'C'N'.........T'NO '

Page 233: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Remote Submittal Information Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-29

Remote Submittal Information Fields

The following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVVSC inputremote submittal information records (RECTYPE EQ C'C1', segment X'C1000000'). Thesefields will be printed only on report detail lines with other remote submittal information recordand common segment fieldnames.

Field Description

REMCLASS Target class.

Default label-1: TARGETDefault label-2: CLASSField type: C1000000 - Remote submit class informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

REMCLSID Type of ID information.

Default label-1: TYPEDefault label-2: OFDefault label-2: IDField type: C1000000 - Remote submit class informationInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'$'.........T'$$ JOB'C'/'.........T'// ID 'C'N'.........T'NONE '

REMSYSID Target SYSID.

Default label-1: TARGETDefault label-2: SYSIDField type: C1000000 - Remote submit class informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

(continued)

Page 234: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Remote Submittal Information Fields Fieldname List

4-30 Auditing and Report Writing Guide

Field Description

REMSIDID Type of ID information.

Default label-1: TYPEDefault label-2: OFDefault label-2: IDField type: C1000000 - Remote submit class informationInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'$'.........T'$$ JOB'C'/'.........T'// ID 'C'N'.........T'NONE '

Page 235: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List XPCC Submittal Information Fields

Chapter 4. ALRTVVSC Security File Report (VSE) 4-31

XPCC Submittal Information FieldsThe following fieldnames can be included in any ALRTVVSC report SUBTITLE, FIELD, orFIELDS command statement. These fieldnames are contained in the ALRTVVSC input nodename information records (RECTYPE EQ C'E0', segment X'E0000000'). These fields will beprinted only on report detail lines with other XPCC submittal information record and commonsegment fieldnames.

Field Description

XPCCAPNM XPCC application name.

Default label-1: XPCCDefault label-2: APPLICATIONDefault label-3: NAMEField type: E0000000 - XPCC submittal informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

XPCCTSNM XPCC task name.

Default label-1: XPCCDefault label-2: TASKDefault label-3: NAMEField type: E0000000 - XPCC submittal informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

XPCCREQS XPCC requirements.

Default label-1: XPCCDefault label-2: REQUIREMENTSField type: E0000000 - XPCC submittal informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 16Default output format: Character (C)

Page 236: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Sample ALRTVVSC Report

4-32 Auditing and Report Writing Guide

Sample ALRTVVSC Report

Introduction

The following sample reports illustrate ways to use the BIM-ALERT/VSE batch report writerto produce reports similar to the predefined batch reports distributed with BIM-ALERT/VSEand detailed in Appendix A, "Additional BIM-ALERT/VSE Reports."

Input statememts of the sample ALRTVVSC reports that follow can be found in the BIM-ALERT installation library in member ALRTVVSC.J.

Logical Table Ruleset Report

The following sample report input illustrates how to print all the record informationconcerning a particular logical table ID contained in the BIM-ALERT/VSE security file.Notice that multiple run statements are included; changing the FIELD or FIELDS commandstatements between the RUN commands results in the different reports shown in the sampleoutput that follows the report input.

// EXEC ALRTVREP,SIZE=256K TITLES 'BIM-ALERT/VSE 5.0A' - ' ' - '*** LOGICAL TABLE RESOURCE REPORT ***' REPORT ALRTVVSC NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('USER RECORDS') LINE(5) JUSTIFY(C) FIELDS JOBENFLD JOBENPOS JOBENLIT - JOBENLLN JOBENMOD RECSTAT - JOBENACT TSKIDFLD TSKIDFLP TSKIDFLL COMMENTS SELECT IF TABLENUM EQ C'B1' AND RECTYPE EQ C'10' RUN

OPTIONS LINELEN(85) REPORT ALRTVVSC NOHDRPAGE NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('JOBMASK RECORDS') LINE(5) JUSTIFY(C) FIELDS JMSKMASK JMSKSEC JMSKACT COMMENTS SELECT IF TABLENUM EQ C'B1' AND RECTYPE EQ C'30' RUN

(continued)

Description

Input

Page 237: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVSC Report Logical Table Ruleset Report

Chapter 4. ALRTVVSC Security File Report (VSE) 4-33

OPTIONS LINELEN(133) REPORT ALRTVVSC NOHDRPAGE NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('SECID RECORDS') LINE(5) JUSTIFY(C) FIELDS SECIDMSK SECIDSEQ SECIDPWM SECIDSRC SECIDMOD SECIDNOD - SECIDUID RECTYPE SELECT IF TABLENUM EQ C'B1' AND - (RECTYPE EQ C'35' OR RECTYPE EQ C'40') RUN

REPORT ALRTVVSC NOHDRPAGE NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('DASD DATASET RECORDS') LINE(5) JUSTIFY(C) FIELDS DASDDSN DASDSEC DASDACR DASDACU DASDACW DASDACA SELECT IF TABLENUM EQ C'B1' AND RECTYPE EQ C'50' RUN

REPORT ALRTVVSC NOHDRPAGE NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('TAPE DATASET RECORDS') LINE(5) JUSTIFY(C) FIELDS TAPEDSN TAPESEC TAPEACR TAPEACU TAPEACW TAPEACA SELECT IF TABLENUM EQ C'B1' AND RECTYPE EQ C'55' RUN

REPORT ALRTVVSC NOHDRPAGE NOTRAILER SUBTITLE LITERAL('****************') LINE(2) JUSTIFY(C) SUBTITLE LITERAL('* *') LINE(3) JUSTIFY(C) SUBTITLE TABLENUM LABEL('TABLE-ID:') LINE(3) JUSTIFY(C) SUBTITLE LITERAL('****************') LINE(4) JUSTIFY(C) SUBTITLE LITERAL('RESOURCE RECORDS') LINE(5) JUSTIFY(C) FIELDS RSRCCLS RSRCNAM RSRCSEC RSRCACE RSRCACR RSRCACU RSRCACA SELECT IF TABLENUM EQ C'B1' AND RECTYPE EQ C'60' RUN/*

Page 238: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Logical Table Ruleset Report Sample ALRTVVSC Report

4-34 Auditing and Report Writing Guide

DATE: 03/25/1998 13:52:40 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** USER RECORDS JOB JOB JOB J-E JOB JOB TASKID TASKID ENTRY ENTRY ENTRY LIT ENTRY RECORD ENTRY TASKID FIELD FIELD FIELD POS LITERAL LEN MODE STATUS ACTION FIELD POS LENGTH COMMENTS ----- ----- ------- --- ----- ------ ------ ------ ------ ------ -------- JOBNAME 3 ASI 3 POWER ACTIVE NONE JOBNAME 1 5 ASI SECURITY__________________

DATE: 03/25/1998 13:52:43 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** JOBMASK RECORDS JOBMASK JOBMASK BUILD MASK PARMS ACTION COMMENTS ------- ------- ------ -------- BGASI ASIBG NONE SECID FOR BG PARTITION F*ASI ASISTAT NONE SECID FOR STATIC PARTITIONS **ASI ASIDYNC NONE SECID FOR DYNAMIC PARTITIONS

DATE: 03/25/1998 13:52:45 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** SECID RECORDS JOB JOB JOB JOB SECID SEQ PSWD ENTRY ENTRY ENTRY ENTRY RECORD MASK NUM MODE SOURCE MODE RJENODE RJEUID TYPE ----- --- ---- ------ ----- ------- ------ ------ DEVELOP 2 // ID * . . . SPEC-SECID DEVELOP 2 // ID . * . . SPEC-SECID DEVELOP 2 // ID . . * . SPEC-SECID DEVELOP 2 // ID . . . * SPEC-SECID OPERATNS 3 // ID * . . . SPEC-SECID OPERATNS 3 // ID . * . . SPEC-SECID OPERATNS 3 // ID . . * . SPEC-SECID OPERATNS 3 // ID . . . * SPEC-SECID SECADMIN 0 // ID * . . . SPEC-SECID SECADMIN 0 // ID . * . . SPEC-SECID SECADMIN 0 // ID . . * . SPEC-SECID SECADMIN 0 // ID . . . * SPEC-SECID ASIBG 0 // ID * . . . SECID ASIBG 0 // ID . ASI . . SECID ASIBG 0 // ID . . * . SECID ASIBG 0 // ID . . . * SECID ASIDYNC 8192 // ID * . . . SECID ASIDYNC 8192 // ID . ASI . . SECID ASIDYNC 8192 // ID . . * . SECID ASIDYNC 8192 // ID . . . * SECID ASISTAT 4096 // ID * . . . SECID ASISTAT 4096 // ID . ASI . . SECID ASISTAT 4096 // ID . . * . SECID ASISTAT 4096 // ID . . . * SECID PROGRAMR 16384 // ID * . . . SECID PROGRAMR 16384 // ID . * . . SECID PROGRAMR 16384 // ID . . * . SECID PROGRAMR 16384 // ID . . . * SECID

(continued)

Output

Page 239: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVSC Report Logical Table Ruleset Report

Chapter 4. ALRTVVSC Security File Report (VSE) 4-35

DATE: 03/25/1998 13:52:46 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** DASD DATASET RECORDS DASD DASD DASD DASD DASD DATASET DASD READ UPDATE WRITE ALTER NAME SECID ACTION ACTION ACTION ACTION ------- ----- ------ ------ ------ ------ ALERT.AXPCTL.V50 SECADMIN WTO/LOG . . . ALERT.AXPCTL.V50 SECADMIN . . . NONE ALERT.AXPCTL.V50 = . . . NONE ALERT=.= SECADMIN . . . NONE ALERT=.= = . . . LOG ALERT=.= OPERATNS . . . NONE =.=.=.=.=.=.=.= SYSA= . . . NONE =.=.=.=.=.=.=.= DEVELOP . . . NONE =.=.=.=.=.=.=.= = NONE . . . =.=.=.=.=.=.=.= = . . . NONE

DATE: 03/25/1998 13:52:48 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** TAPE DATASET RECORDS TAPE TAPE TAPE TAPE TAPE DATASET TAPE READ UPDATE WRITE ALTER NAME SECID ACTION ACTION ACTION ACTION ------- ----- ------ ------ ------ ------ P*.= PROGRAMR NONE . . . P*.= OPERATNS . . . NONE P*.= SYSPROG . . . WTO/LOG P*.= SYSPROG NONE . . .

DATE: 03/25/1998 13:52:50 PAGE: 000001 BIM-ALERT/VSE 5.0A

*** LOGICAL TABLE RESOURCE REPORT ***

**************** * TABLE-ID: B1 * **************** RESOURCE RECORDS RESOURCE RESOURCE RESOURCE RESOURCE RESOURCE RESOURCE RESOURCE EXEC READ UPDATE ALTER CLASS NAME SECID ACTION ACTION ACTION ACTION -------- -------- -------- -------- -------- -------- -------- DITTO COMMAND:NOPEN.DVT = NONE . . . LIBMEM BIMCOL.ALT50A.AXPBR14.PHASE SECADMIN LOG . . . LIBMEM BIMCOL.ALT50A.AXPBR14.PHASE SECADMIN . . . NONE LIBMEM BIMCOL.ALT50A.AXPBR14.PHASE = . NONE . . LIBMEM BIMCOL.RULES50A.ALERTB1.PHASE = . . . WTO/LOG LIBMEM COLSYS6.ALT493.AXPI1.PHASE SECADMIN . . . NONE LIBMEM COLSYS6.ALT493.AXPI1.PHASE SECADMIN WTO/LOG . . . LIBMEM COLSYS6.ALT493.AXPI1.PHASE ASI= NONE . . . LIBMEM COLSYS6.ALT493.=.= SECADMIN . . . NONE LIBMEM COLSYS6.ALT493.=.= OPERATNS NONE . . . LIBMEM COLSYS6.ALT493.=.= = . . . WTO/LOG LIBRARY VSE.BIM.COLUMBUS.LIBRARY:BIMCOL = . . . LOG LIBRARY VSE.BIM.COLUMBUS.LIBRARY:BIMCOL = . NONE . . LIBRARY VSE.BIM.COLUMBUS.LIB6:COLSYS6 = . . . NONE LIBRARY VSE.PRD1.LIBRARY:PRD1 = . . . NONE LIBRARY VSE.PRD2.LIBRARY:PRD2 = . . . NONE LIBRARY VSE.SYSRES.LIBRARY:IJSYSRS = . . . NONE SUBLIB BIMCOL.ALT50A = . . NONE . SUBLIB BIMCOL.ALT50A = . . . WTO/LOG SUBLIB COLSYS6.ALT493 SECADMIN . . . NONE SUBLIB COLSYS6.ALT493 = . NONE . .

Page 240: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Logical Table Ruleset Report Sample ALRTVVSC Report

4-36 Auditing and Report Writing Guide

Page 241: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

5-1

5

ALRTVCVI Violation Log File Report (CICS)

This chapter describes the ALRTVCVI violation log file report, which you can use to selectand display information from the BIM-ALERT/CICS security log file.

Introduction....................................................................................................................5-2General Information...................................................................................................5-2Sample JCL................................................................................................................5-3Input Record Description...........................................................................................5-4Field Information .......................................................................................................5-5

Fieldname List................................................................................................................5-7Common Segment Fields ...........................................................................................5-7Initialization Record Field .......................................................................................5-10Sign-On and Sign-Off Record Fields .......................................................................5-11Violation Record Fields...........................................................................................5-15

Sample ALRTVCVI Reports .......................................................................................5-20Introduction .............................................................................................................5-20S1B190 Security Violation Report ..........................................................................5-20S1B192 Security Violation Report ..........................................................................5-22

Page 242: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

General Information Introduction

5-2 Auditing and Report Writing Guide

Introduction

General Information

BIM-ALERT/CICS initialization messages, sign-on and sign-off information, and securityviolation information contained in the BIM-ALERT/CICS log file is available for selectionand display in the ALRTVCVI report type.

Dataset Description

BIM-ALERT/CICSsecurity log file

This report type requires the BIM-ALERT/CICS security log file,or a VSAM copy of the file, as input. The security log filecontains all the initialization, sign-on and sign-off, and violationinformation.

BIM-ALERT/CICSVSAM security file

This report type also requires access to the BIM-ALERT/CICSVSAM security file. The dataset must be specified on a // DLBLS1SCTY,... statement.

The phase ALRTVCVI is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVCVI reads the input file and formats the data for thereport.

Report Description

Input Datasets

I/O Module Name

Page 243: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Sample JCL

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-3

Sample JCL

The following sample JCL can be used to execute any ALRTVCVI report:

// JOB ALRTVCVI BIM-ALERT/CICS log file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// EXEC ALRTVREP,SIZE=256K . ./*/&

Page 244: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

5-4 Auditing and Report Writing Guide

Input Record Description

Each BIM-ALERT/CICS log file record contains a nine-byte record key (segment type00000000) and one of three subordinate segment types, determined by the contents of theRECTYPE field in the record key.

The initialization information record contains a single BIM-ALERT/CICS initializationmessage. The fields defined within this segment are referred to as having a field type of'01000000'.

The BIM-ALERT/CICS sign-on record contains information relating to a single BIM-ALERT/CICS operator sign-on or sign-off event. The fields defined within this segment arereferred to as having a field type of '02000000'.

The BIM-ALERT/CICS Security violation record contains information relating to a singleBIM-ALERT/CICS security violation event. The fields defined within this segment arereferred to as having a field type of '03000000'.

Introduction

BIM-ALERT/CICSInitializationInformation(Segment Type01000000)

BIM-ALERT/CICSSign-OnInformation(Segment Type02000000)

BIM-ALERT/CICSSecurity ViolationInformation(Segment Type03000000)

Page 245: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Field Information

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-5

Field Information

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default or user specifications. Each data field is selected from a pre-defined list of ALRTVCVI fieldnames.

At report generation time, each fieldname specified is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to each selected fieldname is located and extracted from the physical inputrecord by the ALRTVCVI I/O module and moved to, or transformed into, the output reportcolumn, using either the default values described in the fieldname entries below or thosespecified by the user in a FIELD command statement.

The following information is provided for each ALRTVCVI fieldname (if applicable):

Heading Description

Group Field: YES Indicates that the fieldname being defined is a group fieldname containing several individualfieldnames within the group. The individual ALRTVCVI fieldnames are listed.• If a group fieldname is specified on a FIELD or FIELDS command statement, input data

represented by all individual fieldnames within the group will be printed in a single outputcolumn.

• If the individual fieldname is specified on a FIELD or FIELDS command statement, eachfieldname is assigned its own column in the report output detail line.

Field type Defines which particular segment type the fieldname belongs to. A segment is a subordinate groupor class of data within a record. In the case of the security log file, there are really three types ofrecords:• Initialization messages• Sign-on and sign-off records• Security violations

Each of these record types represents a segment. In addition, each of the three record types containssome data which is present in all types (for example, the record key). This common data is alsoconsidered a segment in addition to the three distinct record types.

By definition, then, segment type 00 information is present in every input record. Following thesegment type 00 information, ALRTVCVI records will contain one subordinate segment type, 01-03,containing information as indicated by the RECTYPE field.

Default label-n: Defines the default label information which is positioned at the top of each column header on theoutput page, if requested. Up to three labels can be specified for each field, and will be placed abovethe report column reserved for the fieldname.

(continued)

Page 246: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Information Introduction

5-6 Auditing and Report Writing Guide

Heading Description

Belongs to group Indicates a higher level group fieldname which can be specified on a FIELD or FIELDS commandstatement to display the data represented by this fieldname.

Input data length Represents the defined length of the data in the input record corresponding to the fieldname.

Input data format Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default outputlength

This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be overridden using the LENGTH keyword on a FIELD command statement.

Default outputformat

One of the following output formats is assigned by default for each fieldname; it determines how thedata will appear in the output report:

C Character. The input data is simply moved from the input record to the report detail line.Each non-printable character is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-characterhexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is taken as a binary numberand converted to its decimal equivalent. By default, zoned-decimal formatted outputfields are zero-suppressed and right-justified in the report column. Users can override thefield justification value by using the JUSTIFY keyword on the FIELD commandstatement. Zero-suppression can be overridden by specifying NOTRUNC on the FIELDor SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forth inthe transformation table shown or as determined by some other programmedtransformation algorithm.

Users can override the field output format value by using the FORMAT keyword on the FIELDcommand statement.

Page 247: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-7

Fieldname List

Common Segment Fields

The following fieldnames can be included in any ALRTVCVI report FIELD, FIELDS, orSUBTITLE command statements. These fieldnames are contained in the common segment ofall BIM-ALERT/CICS security log file input records and will be printed on all detail lineswhen appropriate.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label-1: RECORD KEYInput data length: 1Input data format: Hexadecimal (X)Default output data length: 2Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: RECORDDefault label-3: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 6Default output data format: Zoned decimal (Z)

DSNAME Input file dataset name.

Field type: 00000000 - Common segment informationDefault label-1: INPUT DSNAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

(continued)

Page 248: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

5-8 Auditing and Report Writing Guide

Field Description

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: noneInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned decimal (Z)

INRECNUM Physical input record sequence number, assigned by the ALRTVCVI I/Omodule when the input record is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned decimal (Z)

INFOTYPE Fieldname or record segment type, which indicates to which segment afieldname belongs.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 19Default output format: Transformed (T)

X'00000000'.....T'COMMON SEGMENT INFO'X'01000000'.....T'INITIALIZATION INFO'X'02000000'.....T'SIGNON/SIGNOFF INFO'X'03000000'.....T'VIOLATION INFO '

RECTYPE Input record type, which indicates what type of segment information iscontained in the record.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: TYPEInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'1'............T'INITIALIZATION'C'2'............T'SIGNON-SIGNOFF'C'3'............T'VIOLATION'

(continued)

Page 249: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-9

Field Description

SYSDATE Creation date, part of the record key, representing the date the record wascreated.

Field type: 00000000 - Common segment informationDefault label-1: CREATIONDefault label-2: DATEInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCB46BC'.......T'01/01/1998' (or user-defined DATEFORM)

SYSTIMEB System time - binary, part of the record key,representing the time the record was created.

Field type: 00000000 - Common segment informationDefault label-1: CREATIONDefault label-2: TIMEInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'00001770'.....T' 00:30 ' (or user-defined TIMEFORM)

SYSTIME System time, which represents the time the violation occurred.

Field type: 00000000 - Common segment informationDefault label-1: SYSTEMDefault label-2: LOGDefault label-3: TIMEInput data length: 4Input data format: Packed-decimal (P)Default output length: 8Default output format: Transformed (T)X'0142739F'.....T' 14:27 ' (or user-defined TIMEFORM)

Page 250: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Initialization Record Field Fieldname List

5-10 Auditing and Report Writing Guide

Initialization Record Field

The following fieldname can be included in any ALRTVCVI report FIELD, FIELDS, orSUBTITLE command statements. This fieldname is contained in the ALRTVCVI securitylog file initialization records (RECTYPE EQ C'1', segment X'01000000'). This field will beprinted only on report detail lines with other initialization record and base segmentfieldnames.

Field Description

INITMESG BIM-ALERT/CICS initialization message.

Field type: 01000000 - Initialization informationDefault label-1: INITIALIZATIONDefault label-2: MESSAGEInput data length: 42Input data format: Character (C)Default output length: 42Default output format: Character (C)

Page 251: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Sign-On and Sign-Off Record Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-11

Sign-On and Sign-Off Record Fields

The following fieldnames can be included in any ALRTVCVI report FIELD, FIELDS, orSUBTITLE command statements. These fieldnames are contained in the ALRTVCVIsecurity log file sign-on and sign-off records (RECTYPE EQ C'2', segment X'02000000').These fields will be printed only on report detail lines with other sign-on and sign-off recordand base segment fieldnames.

Field Description

SGNTRMID Sign-on and sign-off terminal ID.

Default label-1: TERMDefault label-2: IDField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SGNADMIN Administrator number.

Default label-1: ADMINDefault label-2: NUMBERField type: 02000000 - Sign-on or sign-off informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

SGNPHONE Phone number to be called if violations are detected at this terminal.

Default label-1: TERMINALDefault label-2: PHONEDefault label-3: NUMBERField type: 02000000 - Sign-on or sign-off informationInput data length: 10Input data format: Character (C)Default output length: 14Default output format: Transformed (T)

C'6129332885'...T'(612) 933-2885

(continued)

Page 252: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sign-On and Sign-Off Record Fields Fieldname List

5-12 Auditing and Report Writing Guide

Field Description

SGNLOCAT Sign-on or sign-off location code.

Group field: YesDefault label-1: LOCATIONField type: 02000000 - Sign-on or sign-off informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

SGNCOMP Company number.

Belongs to group: SGNLOCATDefault label-1: COMPDefault label-2: CODEField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SGNDIVSN Division number.

Belongs to group: SGNLOCATDefault label-1: DIV.Default label-2: CODEField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SGNDEPT Department number.

Belongs to group: SGNLOCATDefault label-1: DEPTDefault label-2: CODEField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 253: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Sign-On and Sign-Off Record Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-13

Field Description

SGNSECT Section number.

Belongs to group: SGNLOCATDefault label-1: SECTDefault label-2: CODEField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SGNCNAME Company name.

Default label-1: COMPANY NAMEField type: 02000000 - Sign-on or sign-off informationInput data length: 4Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

SGNVNAME Division name.

Default label-1: DIVISION NAMEField type: 02000000 - Sign-on or sign-off informationInput data length: 8Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

SGNDNAME Department name.

Default label-1: DEPARTMENT NAMEField type: 02000000 - Sign-on or sign-off informationInput data length: 12Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

SGNSNAME Section name.

Default label-1: SECTION NAMEField type: 02000000 - Sign-on or sign-off informationInput data length: 16Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

(continued)

Page 254: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sign-On and Sign-Off Record Fields Fieldname List

5-14 Auditing and Report Writing Guide

Field Description

SGNOPER User ID.

Default label-1: OPERATORDefault label-2: NUMBERField type: 02000000 - Sign-on or sign-off informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: C

SGNOPNAM Name.

Default label-1: OPERATORDefault label-2: NAMEField type: 02000000 - Sign-on or sign-off informationInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

SGNCODE Sign-on or sign-off code, which indicates what type of activity was beingattempted.

Default label-1: SGNDefault label-2: CODEField type: 02000000 - Sign-on or sign-off informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

SIGNONMG Sign-on or sign-off message.

Default label-1: SIGN-ON/SIGN-OFFDefault label-2: MESSAGEField type: 02000000 - Sign-on or sign-off informationInput data length: 50Input data format: Character (C)Default output length: 50Default output format: Character (C)

Page 255: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Violation Record Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-15

Violation Record Fields

The following fieldnames can be included in any ALRTVCVI report FIELD, FIELDS, orSUBTITLE command statements. These fieldnames are contained in the ALRTVCVIsecurity log file violation records (RECTYPE EQ C'3', segment X'03000000'). These fieldswill be printed only on report detail lines with other violation record and base segmentfieldnames.

Field Description

TERMINAL Terminal from which violation occurred.

Default label-1: CICSDefault label-2: TERMDefault label-3: IDField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

ADMINSTR Adminstrator who owns terminal or operator committing the violation.

Default label-1: ADMINDefault label-2: NUMBERField type: 03000000 - Security violation informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

TERMPHON Phone number to be called if violations are detected at this terminal.

Default label-1: TERMINALDefault label-2: PHONEDefault label-3: NUMBERField type: 03000000 - Security violation informationInput data length: 10Input data format: Character (C)Default output length: 14Default output format: Transformed (T)

C'6129332885'...T'(612) 933-2885

(continued)

Page 256: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Violation Record Fields Fieldname List

5-16 Auditing and Report Writing Guide

Field Description

LOCATION Location code.

Group field: YesDefault label-1: LOCATIONField type: 03000000 - Security violation informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

COMPANY Company number.

Belongs to group: LOCATIONDefault label-1: COMPDefault label-2: CODEField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

DIVISION Division number.

Belongs to group: LOCATIONDefault label-1: DIV.Default label-2: CODEField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

DEPARTMT Department number.

Belongs to group: LOCATIONDefault label-1: DEPTDefault label-2: CODEField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 257: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Violation Record Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-17

Field Description

SECTION Section number.

Belongs to group: LOCATIONDefault label-1: SECTDefault label-1: DEPTDefault label-2: CODEField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

COMPNAME Company name.

Default label-1: COMPANY NAMEField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

DIVNAME Division name.

Default label-1: DIVISION NAMEField type: 03000000 - Security violation informationInput data length: 8Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

DEPTNAME Department name.

Default label-1: DEPARTMENT NAMEField type: 03000000 - Security violation informationInput data length: 12Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

SECTNAME Section name.

Default label-1: SECTION NAMEField type: 03000000 - Security violation informationInput data length: 16Input data format: Character (C)Default output length: 35Default output format: Transformed (T) - user-defined location

(continued)

Page 258: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Violation Record Fields Fieldname List

5-18 Auditing and Report Writing Guide

Field Description

OPERNUM User ID of operator committing violation.

Default label-1: USERIDField type: 03000000 - Security violation informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

OPERNAME Name.

Default label-1: USER NAMEField type: 03000000 - Security violation informationInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

VIOLATEC Violation code.

Default label-1: VIOLDefault label-2: CODEField type: 03000000 - Security violation informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

DESCRIPT Violation description message.

Default label-1: VIOLATIONDefault label-2: DESCRIPTIONField type: 03000000 - Security violation informationInput data length: 50Input data format: Character (C)Default output length: 50Default output format: Character (C)

(continued)

Page 259: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Violation Record Fields

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-19

Field Description

SYSTEMID CICS SYSID in which violation occurred.

Default label-1: VIOLDefault label-2: SYSTEMDefault label-3: IDField type: 03000000 - Security violation informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

MONITRSW Monitor mode log switch.

Default label-1: MONITORDefault label-2: MODEDefault label-3: LOG SWITCHField type: 03000000 - Security violation informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal-display (X)

Page 260: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Sample ALRTVCVI Reports

5-20 Auditing and Report Writing Guide

Sample ALRTVCVI Reports

Introduction

The following sample reports illustrate ways to make use of the ALRTVREP batch reportwriter program to produce reports similar to the batch reports distributed with BIM-ALERT/CICS and described in Appendix B, "Additional BIM-ALERT/CICS Reports".

The input statements of the sample ALRTVCVI reports that follow can be found in the BIM-ALERT installation library in member ALRTVCVI.J.

S1B190 Security Violation Report

Use the following command statements to produce the Security Violation Report shown on thenext page.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - '* * SECURITY VIOLATION REPORT * *')REPORT ALRTVCVI TIMEFORM(HH,:,MM,:,SS)SUBTITLE COMPANY LABEL(' COMPANY:') LINE(2)SUBTITLE DEPARTMT LABEL('DEPARTMENT:') LINE(2) JUSTIFY(R)SUBTITLE DIVISION LABEL('DIVISION:') LINE(3)SUBTITLE SECTION LABEL('SECTION:') LINE(3) JUSTIFY(R)FIELD SYSDATE LABEL(DATE) JUSTIFY(L) REPCHAR(") SORTPRTY(1)FIELD SYSTIME LABEL(TIME) SORTPRTY(2)FIELD TERMINAL LABEL(TERMINAL)FIELD TERMPHON LABEL(TELEPHONE) LENGTH(15)FIELD OPERNUM LABEL('USER ID') JUSTIFY(L)FIELD OPERNAME LABEL('USER NAME') JUSTIFY(L)FIELD DESCRIPT LABEL('VIOLATION DESCR') JUSTIFY(L)SELECT IF RECTYPE EQ C'3'RUN/*

Input

Page 261: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCVI Reports S1B190 Security Violation Report

Chapter 5. ALRTVCVI Violation Log File Report (CICS) 5-21

DATE: 03/25/1998 14:13:29 PAGE: 000006 B I M - A L E R T / C I C S * * SECURITY VIOLATION REPORT * *

COMPANY: B I MOYLE ASSOCIATES, INC. DEPARTMENT: 0000DIVISION: 0000 SECTION: 0000 DATE TIME TERMINAL TELEPHONE USER ID USER NAME VIOLATION DESCR ---- ---- -------- --------- ------- --------- --------------- 01/13/1998 10:16:18 BC32 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 10:23:39 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 10:47:39 BC32 (000) 000-0000 FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 11:37:24 BC33 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 11:37:37 BC33 (000) 000-0000 Y2TEST Y2TEST INCORRECT OPERATOR SECURITY CODE ENTERED " 12:08:09 BC32 (000) 000-0000 FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 12:09:09 BC33 (000) 000-0000 Y2TEST Y2TEST - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 14:00:14 BC22 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 14:29:20 BC32 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 14:37:44 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 15:44:02 BC22 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 16:23:57 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 16:27:54 BC32 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - 01/14/1998 07:15:03 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 10:55:58 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 14:04:05 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 15:14:10 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 01/15/1998 06:26:30 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 12:09:33 BC22 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 12:46:05 BC32 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 13:34:57 BC32 (000) 000-0000 FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 14:02:27 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 01/16/1998 06:02:56 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 09:54:51 BC22 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 01/20/1998 08:55:49 BC32 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 09:02:04 BC43 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 09:02:18 BC43 (000) 000-0000 ROBERT ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED " 09:02:26 BC43 (000) 000-0000 **** . INCORRECT OPERATOR NUMBER ENTERED " 09:02:40 BC43 (000) 000-0000 ROBERT ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED " 09:03:33 BC43 (000) 000-0000 **** . - MAXIMUM CONSECUTIVE VIOLATIONS DETECTED - " 09:06:52 BC43 (000) 000-0000 ROBERT ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS - " 09:07:13 BC43 (000) 000-0000 ROBERT ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS - " 09:42:55 BC32 (000) 000-0000 FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 10:34:27 BC23 (000) 000-0000 ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 10:43:38 TR93 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 10:43:55 TR93 (000) 000-0000 JSTECHER STECHER, JIM INCORRECT OPERATOR SECURITY CODE ENTERED " 11:19:02 TR93 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 11:19:06 TR93 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 12:41:28 BC13 (000) 000-0000 ASOMAINT ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 12:48:28 TR93 (000) 000-0000 JSTECHER STECHER, JIM - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 12:53:16 BC42 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 12:58:44 BC43 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 13:07:40 BC43 (000) 000-0000 **** . - OPERATOR NOT SIGNED ON - " 14:17:35 BC13 (000) 000-0000 ASOMAINT ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED - " 14:23:33 BC42 (000) 000-0000 ROBERT ROBERT - OPERATOR INACTIVE TIME LIMIT EXCEEDED -

Output

Page 262: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B192 Security Violation Report Sample ALRTVCVI Reports

5-22 Auditing and Report Writing Guide

S1B192 Security Violation Report

Use the following command statements to produce a security violation report that contains thesame information as S1B192. Although the extracted information will not be formatted in thesame style as the previous S1B192 report, the same information is included.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / C I C S' - '* * ATTEMPTED SECURITY VIOLATIONS * *')REPORT ALRTVCVI TIMEFORM(HH,:,MM) DATEFORM(MM,/,DD,/,YYYY)FIELD SYSTIME LENGTH(5)FIELDS SYSDATE TERMINAL ADMINSTRFIELD SYSTEMID LABEL(CICS,SYST,ID)FIELDS COMPANY DIVISION DEPARTMT SECTION OPERNUM DESCRIPTSELECT IF RECTYPE EQ C'3'RUN/*

DATE: 03/25/1998 14:19:13 PAGE: 000001 B I M - A L E R T / C I C S * * ATTEMPTED SECURITY VIOLATIONS * * SYSTEM CICS CICS LOG CREATION TERM ADMIN SYST COMP DIV. DEPT SECT OPERATOR VIOLATION TIME DATE ID NUMBER ID CODE CODE CODE CODE NUMBER DESCRIPTION ------ -------- ---- ------ ---- ---- ---- ---- ---- -------- ----------- 12:08 01/13/1998 BC32 A TEST 0000 0000 0000 0000 FLL - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 12:09 01/13/1998 BC33 ERIC TEST 0000 0000 0000 0000 Y2TEST - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 14:00 01/13/1998 BC22 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 14:29 01/13/1998 BC32 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 14:37 01/13/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 15:44 01/13/1998 BC22 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 16:23 01/13/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 16:27 01/13/1998 BC32 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 07:15 01/14/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 10:55 01/14/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 14:04 01/14/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 15:14 01/14/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 06:26 01/15/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 12:09 01/15/1998 BC22 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 12:46 01/15/1998 BC32 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 13:34 01/15/1998 BC32 A TEST 0000 0000 0000 0000 FLL - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 14:02 01/15/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 06:02 01/16/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 09:54 01/16/1998 BC22 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 08:55 01/20/1998 BC32 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 09:02 01/20/1998 BC43 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 09:02 01/20/1998 BC43 A TEST 0000 0000 0000 0000 ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED 09:02 01/20/1998 BC43 A TEST 0000 0000 0000 0000 **** INCORRECT OPERATOR NUMBER ENTERED 09:02 01/20/1998 BC43 A TEST 0000 0000 0000 0000 ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED 09:03 01/20/1998 BC43 A TEST 0000 0000 0000 0000 **** - MAXIMUM CONSECUTIVE VIOLATIONS DETECTED - 09:06 01/20/1998 BC43 A TEST 0000 0000 0000 0000 ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS - 09:07 01/20/1998 BC43 A TEST 0000 0000 0000 0000 ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS - 09:42 01/20/1998 BC32 A TEST 0000 0000 0000 0000 FLL - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 10:34 01/20/1998 BC23 A TEST 0000 0000 0000 0000 ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 10:43 01/20/1998 TR93 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 10:43 01/20/1998 TR93 ERIC TEST 0000 0000 0000 0000 JSTECHER INCORRECT OPERATOR SECURITY CODE ENTERED 11:19 01/20/1998 TR93 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 11:19 01/20/1998 TR93 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 12:41 01/20/1998 BC13 FLL TEST 0000 0000 0000 0000 ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 12:48 01/20/1998 TR93 ERIC TEST 0000 0000 0000 0000 JSTECHER - OPERATOR INACTIVE TIME LIMIT EXCEEDED - 12:53 01/20/1998 BC42 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 12:58 01/20/1998 BC43 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 13:07 01/20/1998 BC43 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 15:57 01/21/1998 BC32 FLL TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 16:27 01/21/1998 BC13 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 16:28 01/21/1998 BC12 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON - 16:55 01/21/1998 BC42 A TEST 0000 0000 0000 0000 **** - OPERATOR NOT SIGNED ON -

Input

Output

Page 263: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

6-1

6

ALRTVVVI Violation Log File Report (VSE)

This chapter describes the ALRTVVVI violation log file report, which you can use to selectand display violation, audit, logging, and monitor messages from the BIM-ALERT/VSEsecurity log file and, optionally, from the BIM-ALERT/CICS security log or from non-VSEsystems.

Introduction....................................................................................................................6-2General Information...................................................................................................6-2Sample JCL................................................................................................................6-3Input Record Description...........................................................................................6-4Field Information .......................................................................................................6-5

Fieldname List................................................................................................................6-7Common Segment Fields ...........................................................................................6-7Access Check Information .......................................................................................6-11

Sample ALRTVVVI Reports .......................................................................................6-31Introduction .............................................................................................................6-31Dataset Name Report ...............................................................................................6-31User Entry Report ....................................................................................................6-33Resource Class Report .............................................................................................6-34SECID/User Dataset Summary Report ....................................................................6-36SECID/User Resource Summary Report .................................................................6-37

Page 264: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

General Information Introduction

6-2 Auditing and Report Writing Guide

Introduction

General Information

ALRTVVVI contains all information regarding violation, audit, logging, and monitormessages produced by BIM-ALERT/VSE. All data contained in the BIM-ALERT/VSEsecurity log file AXPLOG1 is available for selection and display in the ALRTVVVI reporttype.

Dataset Description

BIM-ALERT/VSEsecurity log file

The ALRTVVVI report type requires either the current BIM-ALERT/VSE security log file (AXPLOG1) or an archived BIM-ALERT/VSE security log file (AXPLOG3) (tape or disk), or aVSAM copy of one of these files, as input. The security log filecontains all the violation, audit, logging, and monitor information.

ALRTVVVI assumes a default blocksize of 4096.

If the input file is a VSAM file, the report writer first issues an openfor a KSDS file. This will cause a VSAM open error of X'A0' to belogged on the operator console if the file is ESDS rather than KSDS.However, the report writer will recognize the error, issue an open foran ESDS file, and continue processing.

BIM-ALERT/VSEsecurity file

The ALRTVVVI report type also requires access to the current BIM-ALERT/VSE VSAM security file. This file contains user profileinformation not included in the security log file that is used by theBIM-ALERT Batch Report Writer to improve report clarity. Thedataset must be specified on a // DLBL ALERTXP,... statement.

The phase ALRTVVVI is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVVVI reads the input file and formats the data for thereport.

Introduction

Input Datasets

I/O Module Name

Page 265: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Sample JCL

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-3

Sample JCL

The following sample JCL can be used to execute any ALRTVVVI report:

// JOB ALRTVVVI BIM-ALERT/VSE log file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL AXPLOG1,'ALERT.AXPLOG1.V50',,VSAM <== for current log file// DLBL ALERTXP,'ALERT.ALERTXP.V50',,VSAM <== sec. file// DLBL AXPLOG3,'ALERT.AXPLOG3.V50',,VSAM <== for disk archive// EXEC ALRTVREP,SIZE=256K . ./*/&

Page 266: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

6-4 Auditing and Report Writing Guide

Input Record Description

Each BIM-ALERT/VSE log file record contains a 16-byte record key (segment type00000000) and at least one subordinate segment type that contains the log record data.

The common segment contains data which is available in all records. It is available to beprinted on any ALRTVVVI report.

The actual access check information is contained in this subordinate segment. These arevariable-occurrence segments, with the number of segments contained in any given log recordbeing dependent upon the type of event that caused the log record to be written.

These segments are contained in log records relating to resource access authorization logrecords. The data in these segments define the type of data logged and the name of theresource.

These segments contain information used by the FILEDUMP command to produce ahexadecimal and character dump listing of the data in the BIM-ALERT/VSE security log file.

Introduction

Common Segment(Type 00000000)

Access CheckInformation (Type88000000)

Access CheckSegments (Type88010000)

Record DumpInformation (TypeFF000000)

Page 267: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Field Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-5

Field Information

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default or user specifications. Each data field is selected from a pre-defined list of ALRTVVVI fieldnames.

At report generation time, each fieldname specified is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to each selected fieldname is located, extracted from the physical inputrecord by the ALRTVVVI I/O module, and moved to, or transformed into, the output reportcolumn, using either the default values described in the fieldname entries or those specified bythe user in a FIELD command statement.

The following information is provided for each ALRTVVVI fieldname (if applicable):

Heading Description

Group Field: YES Indicates that the fieldname being defined is a group fieldname, containing several individualfieldnames within the group. The individual ALRTVVVI fieldnames are listed. If a groupfieldname is specified on a FIELD or FIELDS command statement, input data represented by allindividual fieldnames in the group will be printed in a single output column. If the individualfieldname is specified on a FIELD or FIELDS command statement, each fieldname is assignedits own column in the report output detail line.

Field type: Defines to which particular segment type the fieldname belongs. A segment is a subordinategroup or class of data within a record. There are two segment types contained in the BIM-ALERT/VSE security log file:• The data contained in the key of the record.

• The actual access authorization check data. This segment is further subdivided into userverification data and resource authorization data.

Default label-n: Defines the default label information, which, if requested, is positioned at the top of each columnheader on the output page. Up to three labels can be specified for each field; they will be placedabove the report column reserved for the fieldname.

Belongs to group: Indicates a higher level group fieldname which can be specified on a FIELD or FIELDScommand statement to display the data represented by this fieldname.

Input data length: Represents the defined length of the data in the input record corresponding to the fieldname.

(continued)

Page 268: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Information Introduction

6-6 Auditing and Report Writing Guide

Heading Description

Input data format: Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default output length: This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be overridden by using the LENGTH keyword on a FIELD command statement.

Default output format: One of the following output formats is assigned by default for each fieldname; it determines howthe data will appear in the output report:

C Character. The input data is simply moved from the input record to the report detailline. Each non-printable character is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-characterhexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is taken as a binarynumber and converted to its decimal equivalent. By default, zoned-decimal formattedoutput fields are zero-suppressed and right-justified in the report column. Users canoverride the field justification value by using the JUSTIFY keyword on the FIELDcommand statement. Zero-suppression can be overridden by specifying NOTRUNCon the FIELD or SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forthin the transformation table shown, or as determined by some other programmedtransformation algorithm defined by the user.

To override the field output format value, use the FORMAT keyword on the FIELD commandstatement.

Page 269: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-7

Fieldname List

Common Segment Fields

The following fieldnames can be included in any ALRTVVVI report FIELD, FIELDS, orSUBTITLE command statements. These fieldnames are contained in the common segment ofall BIM-ALERT/VSE security log file input records and will be printed on all detail lineswhen appropriate.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label-1: RECORD KEYInput data length: 16Input data format: Hexadecimal (X)Default output data length: 32Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 4Default output data format: Hexadecimal (X)

DSNAME Input file dataset name.

Field type: 00000000 - Common segment informationDefault label-1: INPUT DSNAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: NoneInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned decimal (Z)

(continued)

Page 270: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

6-8 Auditing and Report Writing Guide

Field Description

INRECNUM Physical input record sequence number, assigned by the ALRTVVVI I/Omodule when the input record is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned decimal (Z)

INFOTYPE Fieldname or record segment type, which indicates to which segment afieldname belongs.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 23Default output format: Transformed (T)

X'00000000'.........T'COMMON SEGMENT INFO 'X'88000000'.........T'ACCESS CHECK INFO 'X'88010000'.........T'ACCESS CHECK FIELD INFO'X'FF000000'.........T'RECORD DUMP INFO '

RECTYPE Record type.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: TYPEInput data length: 1Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)

X'58'.........T'ACCESS-CHK'

(continued)

Page 271: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-9

Field Description

SYSDATE Binary data representing the date the record was created.

Field type: 00000000 - Common segment informationDefault label-1: SYSTEMDefault label-2: DATEInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

SYSTIME Binary data representing the time the record was created.

Field type: 00000000 - Common segment informationDefault label-1: SYSTEMDefault label-2: TIMEInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'AFCC04BA' T' 08:25 ' (or user-defined TIMEFORM)

SERIALNO Record serial number of the log record.

Field type: 00000000 - Common segment informationDefault label-1: SERIALDefault label-2: NUMBERInput data length: 4Input data format: Hexadecimal (X)Default output length: 6Default output format: Zoned-decimal (Z)

CPUID CPU serial number.

Field type: 00000000 - Common segment informationDefault label-1: CPU IDInput data length: 8Input data format: Hexadecimal (X)Default output length: 16Default output format: Hexadecimal (X)

(continued)

Page 272: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

6-10 Auditing and Report Writing Guide

Field Description

ROUTING Record routing qualifier.

Default label-1: ROUTINGDefault label-2: QUALIFIERField type: 00000000 - Common segment informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 16Default output format: Transformed (T)

X'80'.........T'LOG FILE 'X'40'.........T'OPER CONS 'X'20'.........T'TRUNCATED 'X'A0'.........T'LOG FILE (TRUNC)'X'60'.........T'OPR CONS (TRUNC)'X'C0'.........T'LOG/CONSOLE '

Page 273: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-11

Access Check Information

The following fieldnames can be included in any ALRTVVVI report FIELD, FIELDS, orSUBTITLE command statements. These fieldnames are contained in the ALRTVVVIsecurity log file access check records (segment X'88000000').

Field Description

VIOLATN Violation code.

Default label-1: VIOLATIONDefault label-2: CODEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 16Default output format: Transformed (T)

X'80'...........T'ACCESS VIOLATION'X'40'...........T'SECID UNKNOWN 'X'20'...........T'MONITOR MODE 'X'A0'...........T'ACCESS VIOL(MON)'X'60'...........T'SECID UNKN(MON) 'X'E0'...........T'AC VIO/SEC UN(M)'

EVENTYPE Signifies whether record is user verification event or resource accessauthorization event.

Default label-1: EVENTDefault label-2: TYPEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 15Default output format: Transformed (T)

X'01'...........T'USER-VERIFICATN 'X'02'...........T'RESOURCE-ACCESS 'X'03'...........T'USER AUTHENTICATION'X'04'...........T'SIGNON CICS/NON-VSE'

ACCESSTP Type of resource access check.

Default label-1: ACCESSDefault label-2: TYPEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 13Default output format: Transformed (T)

X'00'...........T'DSNAME-CHK 'X'02'...........T'OTHER-RES-CHK'

(continued)

Page 274: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-12 Auditing and Report Writing Guide

Field Description

EVENTSEC SECID of job that caused event.

Default label-1: EVENTDefault label-2: SECIDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SECIDNAM User name associated with SECID.

Default label-1: SECIDDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 30Default output format: Transformed (T)

RULENMBR Serial number of rules table record that caused event.

Default label-1: RULESDefault label-2: SERIALDefault label-3: NUMBERField type: 88000000 - Access check informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Hexadecimal (X)

(continued)

Page 275: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-13

Field Description

REASON Log event reason code.

Default label-1: LOGDefault label-2: REASONDefault label-3: CODEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 15Default output format: Transformed (T)

X'01'...........T'USER ACTION 'X'02'...........T'JOBMASK ACTION 'X'05'...........T'SECID ACTION 'X'06'...........T'BAD SOURCE 'X'07'...........T'BAD PASSWORD 'X'08'...........T'BAD MODE 'X'09'...........T'BAD RJENODE 'X'0A'...........T'BAD RJEUSER 'X'0B'...........T'SECID ENTRY ACT 'X'0C'...........T'UPR EXPIRE WARN 'X'0D'...........T'REM SUB NOT ALLOWED 'X'13'...........T'PROTECT ALL 'X'15'...........T'DATASET ACTION 'X'17'...........T'DATASET RULE 'X'18'...........T'DS USER ACTION 'X'19'...........T'OVERRIDE JOB 'X'1A'...........T'DITTO EXEC FAIL 'X'1C'...........T'RESOURCE ACTION 'X'1D'...........T'RESOURCE RULE 'X'1E'...........T'RESOURCE USER ACTION'X'1F'...........T'NO SECID FOUND 'X'20'...........T'MONITOR ACTION 'X'21'...........T'RES NOT DEFINED 'X'22'...........T'LOGEXEC 'X'23'...........T'RULE AUDIT ACT 'X'24'...........T'SECID AUDIT ACT 'X'25'...........T'USERID AUDIT ACTION 'X'26'...........T'MONITOR IND RULE 'X'27'...........T'MONITOR IND SECID 'X'28'...........T'MONITOR IND UPR 'X'29'...........T'NOT AUTH - CNTL LIB 'X'2C'...........T'NOT AUTH PGM 'X'2D'...........T'PGM NOT FROM CNTLIB '

(continued)

Page 276: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-14 Auditing and Report Writing Guide

Field Description

TABLEID Online table number used to create rules.

Default label-1: TABLEDefault label-2: IDField type: 88000000 - Access check informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

TABLDATE Date that the rules table was assembled.

Default label-1: TABLEDefault label-2: ASSEMBLYDefault label-3: DATEField type: 88000000 - Access check informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

TABLTIME Time that the rules table was assembled.

Default label-1: TABLEDefault label-2: ASSEMBLYDefault label-3: TIMEField type: 88000000 - Access check informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Transformed (T)X'AFCBB7AD'.....T' 08:25 ' (or user-defined TIMEFORM)

PARTINID Partition ID where job was running.

Default label-1: PTNDefault label-2: IDField type: 88000000 - Access check informationInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

Page 277: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-15

Field Description

POWERJB# POWER job number of job causing event.

Default label-1: POWERDefault label-2: JOBDefault label-3: NBRField type: 88000000 - Access check informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned-decimal (Z)

SUBMITYP Submittal mechanism.

Default label-1: SUBMITDefault label-2: TYPEField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'C'............T'CMS 'C'I'............T'ICCF 'C'V'............T'VOLLIE'C'J'............T'JCLMAN'C'G'............T'GSERV 'C'M'............T'OTHER '

LOGONTYP Logon source.

Default label-1: LOGONDefault label-2: SOURCEField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'C'............T'CMS 'C'I'............T'ICCF 'C'O'............T'CICS OP 'C'A'............T'ALERTC OP'C'M'............T'OTHER '

(continued)

Page 278: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-16 Auditing and Report Writing Guide

Field Description

PROGRAM Program name.

Default label-1: PROGRAMDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

IDCDUSER ID card user ID.

Default label-1: ID-CARDDefault label-2: USERIDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

POWERJOB POWER job name.

Default label-1: POWERDefault label-2: JOBNAMEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

JOBNAME VSE job name, obtained from // JOB card.

Default label-1: JOB NAMEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 279: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-17

Field Description

ENTRYSOR Source from which job entered system.

Default label-1: ENTRYDefault label-2: SOURCEField type: 88000000 - Access check informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 4Default output format: Hexadecimal (X)

ENTRYMOD Mode by which job entered system.

Default label-1: ENTRYDefault label-2: MODEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RJEUSRID RJE user who submitted the job.

Default label-1: RJEDefault label-2: USERDefault label-3: IDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RJENODID RJE node from which job entered the system.

Default label-1: RJEDefault label-2: NODEDefault label-3: IDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 280: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-18 Auditing and Report Writing Guide

Field Description

USERTID Task ID of job causing event.

Default label-1: VIOLDefault label-2: TIDField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

AXPS2RTN AXPS2 return code.

Default label-1: AXPS2Default label-2: RETNDefault label-3: CODEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

SUPVSRTN Supervisor return code.

Default label-1: SUPVDefault label-2: RETNDefault label-3: CODEField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

AXPS2VER AXPS2 version number.

Default label-1: AXPS2Default label-2: VERSIONDefault label-3: NUMBERField type: 88000000 - Access check informationInput data length: 4Input data format: Hexadecimal (X)Default output length: 8Default output format: Hexadecimal (X)

(continued)

Page 281: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-19

Field Description

POWERPWD POWER password for job.

Default label-1: POWERDefault label-2: PASSWORDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

POWERUSR POWER USER= parameter for job.

Default label-1: POWERDefault label-2: USERIDField type: 88000000 - Access check informationInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

IDCDPASS ID card password.

Default label-1: ID CARDDefault label-2: PASSWORDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USEACUSR User authentication actual user ID (purported).

Default label-1: ACTUALDefault label-2: USERIDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 282: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-20 Auditing and Report Writing Guide

Field Description

EXECCLB Execute from controlled library (YES or NO).

Default label-1: EXCDefault label-2: CTLDefault label-3: LIBField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

CLBOPRTN Controlled library operation (YES or NO).

Default label-1: CTLDefault label-2: LIBDefault label-3: OPRField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USRAUCLB User authorized for controlled library (YES or NO).

Default label-1: USRDefault label-2: AUTDefault label-3: CLBField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

SYSTEMID System ID (CPU ID or GMF name).

Default label-1: SYSTEMDefault label-2: IDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 283: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-21

Field Description

OPSYSTEM Operating system.

Default label-1: OPERATINGDefault label-2: SYSTEMField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

EXECPGM Executed program.

Default label-1: EXECUTEDDefault label-2: PROGRAMField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

EXECLIB Executed library.

Default label-1: EXECUTEDDefault label-2: LIBRARYField type: 88000000 - Access check informationInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

EXECSUB Executed sublibrary.

Default label-1: EXECUTEDDefault label-2: SUBLIBField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

APPLICN Application name.

Default label-1: APPLICATIONDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 284: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-22 Auditing and Report Writing Guide

Field Description

USRNAME User name.

Default label-1: USERDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

ADMIN Administrator user ID.

Default label-1: ADMINDefault label-2: USERIDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TERMID Terminal ID.

Default label-1: TERMDefault label-2: IDField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

CICSYSID CICS system ID.

Default label-1: CICSDefault label-2: SYSIDField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

COMPCODE Company code.

Default label-1: COMPDefault label-2: CODEField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 285: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-23

Field Description

DIVNCODE Division code.

Default label-1: DIVNDefault label-2: CODEField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

DEPTCODE Department code.

Default label-1: DEPTDefault label-2: CODEField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SECTCODE Section code.

Default label-1: SECTDefault label-2: CODEField type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

REASDESC Reason description.

Default label-1: REASONDefault label-2: DESCRIPTIONField type: 88000000 - Access check informationInput data length: 50Input data format: Character (C)Default output length: 50Default output format: Character (C)

(continued)

Page 286: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-24 Auditing and Report Writing Guide

Field Description

DSTYPE Type of dataset being accessed.

Default label-1: DATASETDefault label-2: TYPEField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 4Default output format: Transformed (T)

C'D'............T'DISK'C'T'............T'TAPE'

DATASET Name of dataset being accessed.

Default label-1: DATASETDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 44Input data format: Character (C)Default output length: 44Default output format: Character (C)

VOLSER VOLSER on which dataset resides.

Default label-1: VOLSERField type: 88000000 - Access check informationInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

REQACC Access level requested.

Default label-1: REQSTDDefault label-2: ACCESSField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 7Default output format: Transformed (T)

X'80'...........T'ALTER 'X'40'...........T'CONTROL'X'20'...........T'UPDATE 'X'10'...........T'READ 'X'08'...........T'NONE 'X'04'...........T'EXEC 'X'FF'...........T'UNKNOWN'

(continued)

Page 287: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-25

Field Description

AUTHACC Access level authorized.

Default label-1: AUTHDefault label-2: ACCESSField type: 88000000 - Access check informationInput data length: 1Input data format: Hexadecimal (X)Default output length: 7Default output format: Transformed (T)

X'80'...........T'ALTER 'X'40'...........T'CONTROL'X'20'...........T'UPDATE 'X'10'...........T'READ 'X'08'...........T'NONE 'X'04'...........T'EXEC 'X'FF'...........T'UNKNOWN'

RESNAME Other resource name requested.

Default label-1: RESOURCEDefault label-2: NAMEField type: 88000000 - Access check informationInput data length: 52Input data format: Character (C)Default output length: 52Default output format: Character (C)

RCLASS Resource class.

Default label-1: RESOURCEDefault label-2: CLASSField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESACUSR Resource access actual user ID (purported).

Default label-1: ACTUALDefault label-2: USERIDField type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 288: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-26 Auditing and Report Writing Guide

Field Description

REXECCLB Execute from controlled library (YES or NO).

Default label-1: EXCDefault label-2: CTLDefault label-3: LIBField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

RCLBOPRT Controlled library operation (YES or NO).

Default label-1: CTLDefault label-2: LIBDefault label-3: OPRField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

RUSRAUCL User authorized for controlled library (YES or NO).

Default label-1: USRDefault label-2: AUTDefault label-3: CLBField type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

RSYSTMID System ID (CPU ID or GMF name).

Default label-1: SYSTEMDefault label-2: ID Field type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 289: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-27

Field Description

ROPSYSTEM Operating system.

Default label-1: OPERATINGDefault label-2: SYSTEM Field type: 88000000 - Access check informationInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

REXECPGM Executed program.

Default label-1: EXECUTEDDefault label-2: PROGRAM Field type: 88000000 - Access check informationInput data length: 23Input data format: Character (C)Default output length: 23Default output format: Character (C)

RAPPLICN Application name.

Default label-1: APPLICATIONDefault label-2: NAME Field type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RUSRNAME User name.

Default label-1: USERDefault label-2: NAME Field type: 88000000 - Access check informationInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

RADMIN Administrator user ID.

Default label-1: ADMINDefault label-2: USERID Field type: 88000000 - Access check informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 290: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-28 Auditing and Report Writing Guide

Field Description

RTERMID Terminal ID.

Default label-1: TERMDefault label-2: ID Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RCICSYID CICS system ID.

Default label-1: CICSDefault label-2: SYSID Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RCOMPCOD Company code.

Default label-1: COMPDefault label-2: CODE Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RDIVNCOD Division code.

Default label-1: DIVNDefault label-2: CODE Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RDEPTCOD Department code.

Default label-1: DEPTDefault label-2: CODE Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 291: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Access Check Information

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-29

Field Description

RSECTCOD Section code.

Default label-1: SECTDefault label-2: CODE Field type: 88000000 - Access check informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RREASDSC Reason description.

Default label-1: REASONDefault label-2: DESCRIPTION Field type: 88000000 - Access check informationInput data length: 50Input data format: Character (C)Default output length: 50Default output format: Character (C)

DATATYPE Access check data field description.

Default label-1: DATADefault label-2: TYPEField type: 88010000 - Access check field informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 16Default output format: Transformed (T)

X'0107'.........T'POWER PASSWORD 'X'0109'.........T'// ID PASSWORD 'X'010A'.........T'POWER USER= PARM'X'010B'.........T'ACTUAL USERID 'X'0201'.........T'DATASET NAME 'X'0202'.........T'REQUESTED ACCESS'X'0203'.........T'AUTHORIZD ACCESS'X'0205'.........T'REQUESTED VOLUME'X'0206'.........T'RESOURCE CLASS 'X'0207'.........T'RESOURCE NAME 'X'0209'.........T'ACTUAL USERID '

(continued)

Page 292: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Access Check Information Fieldname List

6-30 Auditing and Report Writing Guide

Field Description

DATAVALU Access check data field value.

Default label-1: DATADefault label-2: FIELDDefault label-3: VALUEField type: 88010000 - Access check field informationInput data length: 60Input data format: Character (C)Default output length: 60Default output format: Character (C)t

OFFSET Input record offset value.

Default label-1: NoneField type: FF000000 - Record dump informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 4Default output format: Hexadecimal (X)

RECORD Input record 32-byte segment.

Default label-1: NoneField type: FF000000 - Record dump informationInput data length: 34Input data format: Hexadecimal (X)Default output length: 72Default output format: Transformed (T)

Page 293: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVVI Reports Introduction

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-31

Sample ALRTVVVI Reports

Introduction

The following sample reports illustrate ways to use the BIM-ALERT/VSE batch report writerto produce reports similar to the predefined batch reports distributed with BIM-ALERT/VSEand detailed in Chapter 5 of the BIM-ALERT Installation and Operations Guide.

Input statements of the sample ALRTVVVI reports that follow can be found in the BIM-ALERT installation library in member ALRTVVVI.J.

Dataset Name Report

Use the following command statements to produce the Dataset Name Report, which follows.The report is similar to the pre-defined Dataset Name Report supplied with BIM-ALERT/VSE.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / V S E' - ' ' - '*** DATASET NAME REPORT ***')XFORM NAVAIL(X'00000000',T'N/A')REPORT ALRTVVVISUBTITLE DATASET LABEL('DATASET NAME:') LINE(2) SORTPRTY(1) - CTLBREAK(P)SUBTITLE VOLSER LABEL('VOLSER: ') LINE(2) SORTPRTY(2) - JUSTIFY(C) XFORM(NAVAIL)FIELDS EVENTSEC JOBNAMEFIELD REQACC LENGTH(3) LABELS('REQ','ACC')FIELD AUTHACC LENGTH(3) LABELS('ALL','ACC')FIELD ENTRYSOR LENGTH(4) LABELS('SRCE')FIELDS SYSDATE SYSTIME - TABLEID TABLDATE TABLTIME PARTINID PROGRAM REASON - VIOLATN SERIALNOSELECT IF EVENTYPE EQ X'02' AND ACCESSTP EQ X'00'RUN/*

Input

Page 294: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Dataset Name Report Sample ALRTVVVI Reports

6-32 Auditing and Report Writing Guide

DATE: 03/25/1998 15:11:26 PAGE: 000001 B I M - A L E R T / V S E

*** DATASET NAME REPORT ***

DATASET NAME: $$$.IJSYSPH VOLSER: . TABLE TABLE LOG EVENT REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN PROGRAM REASON VIOLATION SERIAL SECID JOB NAME ACC ACC SRCE DATE TIME ID DATE TIME ID NAME CODE CODE NUMBER ----- -------- --- --- ---- ------ ------ ----- -------- -------- --- ------- ------ --------- ------SECADMIN I17201C UPD REA 000C 03/25/1998 15:00 B1 03/24/1998 09:53 BG FCOBOL DATASET RULE ACCESS-VIOL(MON) 20415SECADMIN I17201C UPD REA 000C 03/25/1998 15:01 B1 03/24/1998 09:53 FB LIBR DATASET RULE ACCESS-VIOL(MON) 20419

DATE: 03/25/1998 15:11:26 PAGE: 000002 B I M - A L E R T / V S E

*** DATASET NAME REPORT ***

DATASET NAME: VSE.BIM.COLUMBUS.EVT.EVENTS.BACKUP VOLSER: FBA001 TABLE TABLE LOG EVENT REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN PROGRAM REASON VIOLATION SERIAL SECID JOB NAME ACC ACC SRCE DATE TIME ID DATE TIME ID NAME CODE CODE NUMBER ----- -------- --- --- ---- ------ ------ ----- -------- -------- --- ------- ------ --------- ------OPERATNS PCSEVBR ALT REA 0999 03/25/1998 02:34 B1 03/24/1998 09:53 F5 PCSEVBR DATASET RULE ACCESS-VIOL(MON) 20405

DATE: 03/25/1998 15:11:26 PAGE: 000003 B I M - A L E R T / V S E

*** DATASET NAME REPORT ***

DATASET NAME: 1FB.IJSYSPH VOLSER: . TABLE TABLE LOG EVENT REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN PROGRAM REASON VIOLATION SERIAL SECID JOB NAME ACC ACC SRCE DATE TIME ID DATE TIME ID NAME CODE CODE NUMBER ----- -------- --- --- ---- ------ ------ ----- -------- -------- --- ------- ------ --------- ------SECADMIN I17201C UPD ALT 000C 03/25/1998 15:01 B1 03/24/1998 09:53 FB NO NAME DS USER ACTION MONITOR MODE 20418SECADMIN I17201C ALT ALT 000C 03/25/1998 15:01 B1 03/24/1998 09:53 FB ASMA90 DS USER ACTION MONITOR MODE 20417SECADMIN I17201C ALT ALT 000C 03/25/1998 15:01 B1 03/24/1998 09:53 FB NO NAME DS USER ACTION MONITOR MODE 20416

DATE: 03/25/1998 15:11:26 PAGE: 000004 B I M - A L E R T / V S E

*** DATASET NAME REPORT ***

DATASET NAME: 1F5.SORTWK1 VOLSER: EPV400 TABLE TABLE LOG EVENT REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN PROGRAM REASON VIOLATION SERIAL SECID JOB NAME ACC ACC SRCE DATE TIME ID DATE TIME ID NAME CODE CODE NUMBER ----- -------- --- --- ---- ------ ------ ----- -------- -------- --- ------- ------ --------- ------SECADMIN ALRTVREP ALT REA 0000 03/25/1998 15:11 B1 03/24/1998 09:53 F5 ALRTVREP DATASET RULE ACCESS-VIOL(MON) 20424SECADMIN ALRTVREP ALT REA 0000 03/25/1998 15:02 B1 03/24/1998 09:53 F5 ALRTVREP DATASET RULE ACCESS-VIOL(MON) 20420SECADMIN ALRTVREP ALT REA 0000 03/25/1998 14:38 B1 03/24/1998 09:53 F5 ALRTVREP DATASET RULE ACCESS-VIOL(MON) 20414

Output

Page 295: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVVI Reports User Entry Report

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-33

User Entry Report

Use the following command statements to produce the User Entry Report, which follows. Thereport is similar to the pre-defined User Entry Report supplied with BIM-ALERT/VSE.

// EXEC ALRTVREP,SIZE=256KTITLES ('B I M - A L E R T / V S E' - ' ' - '*** USER ENTRY REPORT ***')XFORM NAVAIL(X'40',T'N/A')REPORT ALRTVVVISUBTITLE EVENTSEC LABEL('SECID: ') LINE(2) SORTPRTY(1) - CTLBREAK(P)SUBTITLE IDCDUSER LABEL('USERID: ') LINE(2) SORTPRTY(2) - JUSTIFY(C)SUBTITLE LOGONTYP LABEL('LOGON: ') LINE(3) XFORM(NAVAIL)SUBTITLE SUBMITYP LABEL('SUBMIT: ') LINE(3) XFORM(NAVAIL) - JUSTIFY(C)FIELD POWERJOB SORTPRTY(3) CTLBREAK(S)FIELD POWERJB# SORTPRTY(4) REPCHAR(' ')FIELD JOBNAMEFIELD SYSDATE SORTPRTY(5) SORTSEQ(AS) REPCHAR('.')FIELDS SYSTIME TABLEID TABLDATE TABLTIME - PARTINID REASON VIOLATN SERIALNOSELECT IF EVENTYPE EQ X'01'RUN/*

DATE: 03/26/1998 06:09:01 PAGE: 000001 B I M - A L E R T / V S E

*** USER ENTRY REPORT ***

SECID: UNKNOWN USERID: PGLOGON: L SUBMIT: S POWER TABLE TABLE LOG POWER JOB SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN REASON VIOLATION SERIAL JOB NAME NBR JOB NAME DATE TIME ID DATE TIME ID CODE CODE NUMBER -------- ----- -------- ------ ------ ----- -------- -------- --- ------ --------- ------ SRVTRACE 30977 SRVTRACE 03/18/1998 10:01 B1 01/22/1998 06:01 BG REM SUB NOT ALLOWED AC VIO/SEC UN(M) 19919 SRVTRACE 31681 SRVTRACE 03/19/1998 15:15 B1 01/22/1998 06:01 BG REM SUB NOT ALLOWED AC VIO/SEC UN(M) 20073 STDLABEL 31786 STDLABEL 03/20/1998 13:01 B1 01/22/1998 06:01 C2 REM SUB NOT ALLOWED AC VIO/SEC UN(M) 20218 VSE1CICS 30374 VSE1CICS 03/11/1998 05:08 B1 01/22/1998 06:01 F4 REM SUB NOT ALLOWED AC VIO/SEC UN(M) 19764 VSE1CICS 30681 VSE1CICS 03/17/1998 05:19 B1 01/22/1998 06:01 F4 REM SUB NOT ALLOWED AC VIO/SEC UN(M) 19822

DATE: 03/26/1998 06:09:01 PAGE: 000002 B I M - A L E R T / V S E

*** USER ENTRY REPORT ***

SECID: UNKNOWN USERID: AXPMAINTLOGON: CMS SUBMIT: CMS POWER TABLE TABLE LOG POWER JOB SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY PTN REASON VIOLATION SERIAL JOB NAME NBR JOB NAME DATE TIME ID DATE TIME ID CODE CODE NUMBER -------- ----- -------- ------ ------ ----- -------- -------- --- ------ --------- ------ CALR50A 754 CALR50A 03/26/1998 05:17 B1 03/25/1998 15:41 BG SECID ENTRY ACT SECID-UNKN(MON) 20448 PCSERPT 747 PCSERPT 03/26/1998 00:00 B1 03/25/1998 15:41 BG SECID ENTRY ACT SECID-UNKN(MON) 20439 PCSERPT 903 PCSERPT 03/27/1998 00:00 B1 03/26/1998 05:17 BG SECID ENTRY ACT SECID-UNKN(MON) 20606 PCSEVRP 875 PCSEVRP 03/26/1998 15:05 B1 03/26/1998 05:17 BG SECID ENTRY ACT SECID-UNKN(MON) 20579 SCFL50A 836 SCFL50A 03/26/1998 07:17 B1 03/26/1998 05:17 BG SECID ENTRY ACT SECID-UNKN(MON) 20528 WORKDATA 877 PAYROLL 03/26/1998 15:11 B1 03/26/1998 05:17 BG SECID ENTRY ACT SECID-UNKN(MON) 20583

Input

Output

Page 296: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Class Report Sample ALRTVVVI Reports

6-34 Auditing and Report Writing Guide

Resource Class Report

Use the following command statements to produce the Resource Class Report, which follows.The report is similar to the pre-defined Resource Class Report supplied with BIM-ALERT/VSE.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVVI INFILE(AXPLOG3) TITLES 'B I M - A L E R T / V S E' - ' ' - '*** RESOURCE CLASS REPORT ***' SUBTITLE RCLASS LABEL('RESOURCE CLASS:') LINE(2) SORTPRTY(1)- CTLBREAK(P) FIELD RESNAME SORTPRTY(2) JUSTIFY(L) LENGTH(42) FIELD EVENTSEC JUSTIFY(L) FIELD IDCDUSER JUSTIFY(L) FIELD JOBNAME JUSTIFY(L) FIELD REQACC LENGTH(3) LABELS('REQ','ACC') FIELD AUTHACC LENGTH(3) LABELS('ALL','ACC') FIELD SYSDATE SORTPRTY(3) FIELD SYSTIME SORTPRTY(4) FIELDS TABLEID TABLDATE TABLTIME FIELD VIOLATN FORMAT(X) SELECT IF EVENTYPE EQ X'02' AND ACCESSTP EQ X'02' RUN/*

Input

Page 297: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVVI Reports Resource Class Report

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-35

DATE: 04/16/1998 06:21:25 PAGE: 000001 B I M - A L E R T / V S E

*** RESOURCE CLASS REPORT ***

RESOURCE CLASS: DITTO TABLE TABLE RESOURCE EVENT ID-CARD REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY VIOLATION NAME SECID USERID JOB NAME ACC ACC DATE TIME ID DATE TIME CODE -------- ----- ------- -------- --- --- ------ ------ ----- -------- -------- ---------COMMAND:NOPEN.DVT SECADMIN EKEHLER DITTO EXE EXE 04/13/1998 08:44 B1 04/10/1998 08:16 20COMMAND:NOPEN.DVT SECADMIN EKEHLER DITTO EXE EXE 04/13/1998 08:48 B1 04/13/1998 08:47 20COMMAND:NOPEN.DVT UNKNOWN NO-USER DITTO EXE NON 04/13/1998 08:51 B1 04/13/1998 08:47 E0COMMAND:NOPEN.DVT SECADMIN ERIC DITEERIC EXE EXE 04/13/1998 09:06 B1 04/13/1998 08:47 20

DATE: 04/16/1998 06:21:25 PAGE: 000002 B I M - A L E R T / V S E

*** RESOURCE CLASS REPORT ***

RESOURCE CLASS: LIBMEM TABLE TABLE RESOURCE EVENT ID-CARD REQ ALL SYSTEM SYSTEM TABLE ASSEMBLY ASSEMBLY VIOLATION NAME SECID USERID JOB NAME ACC ACC DATE TIME ID DATE TIME CODE -------- ----- ------- -------- --- --- ------ ------ ----- -------- -------- ---------BIMCOL.ALT50A.AXP.A SECADMIN KEN CATMAC50 UPD UPD 04/13/1998 11:14 B1 04/13/1998 08:47 20BIMCOL.ALT50A.AXP.A SECADMIN KEN CATMAC50 ALT UPD 04/13/1998 11:14 B1 04/13/1998 08:47 A0BIMCOL.ALT50A.AXPBR14.PHASE SECADMIN EKEHLER AXPHP6X EXE EXE 04/15/1998 09:10 B1 04/13/1998 08:47 20BIMCOL.ALT50A.AXPBR14.PHASE SECADMIN EKEHLER AXPHP6X EXE EXE 04/15/1998 13:12 B1 04/15/1998 13:07 20BIMCOL.ALT50A.AXPCNVT.PHASE UNKNOWN PG VSE1CICS EXE NON 04/10/1998 04:05 B1 04/08/1998 04:52 E0BIMCOL.ALT50A.AXPCNVT.PHASE UNKNOWN PG VSE1CICS EXE NON 04/13/1998 08:41 B1 04/10/1998 08:16 E0BIMCOL.ALT50A.AXPCNVT.PHASE UNKNOWN PG VSE1CICS EXE NON 04/15/1998 03:32 B1 04/13/1998 08:47 E0BIMCOL.ALT50A.AXPCNVT.PHASE UNKNOWN R000 VSE1CICS EXE NON 04/15/1998 13:07 B1 04/13/1998 08:47 E0BIMCOL.ALT50A.AXPHDT1.PHASE SECADMIN EKEHLER DITTO EXE REA 04/13/1998 08:44 B1 04/10/1998 08:16 20BIMCOL.ALT50A.AXPHDT1.PHASE UNKNOWN NO-USER DITTO EXE NON 04/13/1998 08:51 B1 04/13/1998 08:47 E0BIMCOL.ALT50A.AXPHDT8.PHASE SECADMIN EKEHLER DITTO EXE REA 04/13/1998 08:44 B1 04/10/1998 08:16 20BIMCOL.ALT50A.AXPHDT8.PHASE UNKNOWN NO-USER DITTO EXE NON 04/13/1998 08:51 B1 04/13/1998 08:47 E0BIMCOL.ALT50A.AXPHJ4.PHASE UNKNOWN NO-USER JCLSCHED EXE NON 04/10/1998 10:00 B1 04/10/1998 08:16 E0BIMCOL.ALT50A.AXPHJ4.PHASE UNKNOWN NO-USER JCLSCHED EXE NON 04/14/1998 16:08 B1 04/13/1998 08:47 E0BIMCOL.ALT50A.AXPHP6.PHASE ASISTAT NO-USER F1ASI EXE NON 04/10/1998 03:37 B1 04/08/1998 04:52 A0BIMCOL.ALT50A.AXPHP6D.PHASE ASISTAT NO-USER F1ASI EXE NON 04/15/1998 13:07 B1 04/13/1998 08:47 A0BIMCOL.ALT50A.AXPI1.PHASE UNKNOWN EXP-USER CALR50A EXE NON 04/10/1998 04:05 B1 04/08/1998 04:52 E0BIMCOL.ALT50A.AXPI1.PHASE UNKNOWN UNK-USER CALR50A EXE NON 04/10/1998 04:11 B1 04/10/1998 04:05 E0BIMCOL.ALT50A.AXPI10C.PHASE ASIBG FORSEC BGASI EXE NON 04/10/1998 03:36 B1 04/08/1998 04:52 A0BIMCOL.ALT50A.AXPI10C.PHASE ASIBG FORSEC BGASI EXE NON 04/14/1998 15:20 B1 04/13/1998 08:47 A0

Output

Page 298: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID/User Dataset Summary Report Sample ALRTVVVI Reports

6-36 Auditing and Report Writing Guide

SECID/User Dataset Summary Report

Use the following command statements to produce a report that shows all dataset accesseslogged for a particular SECID or user. The report produced is shown below.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVVI XFORM NAVAIL(X'40',T'N/A') TITLES 'B I M - A L E R T / V S E' - ' ' - '*** SECID/USER DATASET ACCESS ***' SUBTITLE EVENTSEC LABEL('SECID: ') LINE(2) SORTPRTY(1)- CTLBREAK(P) SUBTITLE IDCDUSER LABEL('USERID: ') LINE(2) SORTPRTY(2) - JUSTIFY(C) SUBTITLE LOGONTYP LABEL('LOGON: ') LINE(3) XFORM(NAVAIL) SUBTITLE SUBMITYP LABEL('SUBMIT: ') LINE(3) XFORM(NAVAIL) - JUSTIFY(C) FIELD POWERJOB SORTPRTY(3) CTLBREAK(S) FIELD POWERJB# SORTPRTY(4) REPCHAR(' ') FIELD JOBNAME FIELD SYSDATE SORTPRTY(5) SORTSEQ(AS) REPCHAR('.') FIELDS SYSTIME PARTINID DSTYPE DATASET PROGRAM FIELD REQACC LENGTH(3) LABELS('REQ','ACC') FIELD AUTHACC LENGTH(3) LABELS('ALL','ACC') SELECT IF EVENTYPE EQ X'02' AND ACCESSTP EQ X'00' RUN/*

DATE: 03/26/1998 05:49:39 PAGE: 000001 B I M - A L E R T / V S E

*** SECID/USER DATASET ACCESS ***

SECID: OPERATNS USERID: ADMNLOGON: CMS SUBMIT: JCLMAN POWER POWER JOB SYSTEM SYSTEM PTN PROGRAM REQ ALL JOB NAME NBR JOB NAME DATE TIME ID DATASET TYPE DATASET NAME NAME ACC ACC -------- ----- -------- ------ ------ --- ------------ ------------ ------- --- --- GSPDSU 749 GSPDSU 03/26/1998 02:30 F6 DISK VSE.BIM.COLUMBUS.MON.BACKUP GSPDSU ALT REA GSPDSU 750 GSPDSU . 02:32 F5 DISK VSE.BIM.COLUMBUS.VIO.BACKUP GSPDSU ALT REA GSPDSU 751 GSPDSU . 02:33 F5 DISK VSE.BIM.COLUMBUS.EVT.BACKUP GSPDSU ALT REA PCSEVBR 752 PCSEVBR 03/26/1998 02:34 F5 DISK VSE.BIM.COLUMBUS.EVT.EVENTS.BACKUP PCSEVBR ALT REA

DATE: 03/26/1998 05:49:39 PAGE: 000002 B I M - A L E R T / V S E

*** SECID/USER DATASET ACCESS ***

SECID: UNKNOWN USERID: UNK-USERLOGON: Y SUBMIT: OTHER POWER POWER JOB SYSTEM SYSTEM PTN PROGRAM REQ ALL JOB NAME NBR JOB NAME DATE TIME ID DATASET TYPE DATASET NAME NAME ACC ACC -------- ----- -------- ------ ------ --- ------------ ------------ ------- --- --- CALR50A 754 CALR50A 03/26/1998 05:17 BG DISK ALERT.XP.RULEST.TO.ASSEMBLE AXPU002 UPD ALT CALR50A CALR50A . 05:17 BG DISK ALERT.S1SCTY.V50 AXPU002 REA ALT

Input

Output

Page 299: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVVI Reports SECID/User Resource Summary Report

Chapter 6. ALRTVVVI Violation Log File Report (VSE) 6-37

SECID/User Resource Summary Report

Use the following command statements to produce a report similar to that given on thefollowing two pages. The report shows all resource accesses logged for a particularSECID/user. This report is similar to the pre-defined SECID/USER Job Summary Reportsupplied with BIM-ALERT/VSE.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVVI XFORM NAVAIL(X'40',T'N/A') TITLES 'B I M - A L E R T / V S E' - ' ' - '*** SECID/USER RESOURCE ACCESS ***' SUBTITLE EVENTSEC LABEL('SECID: ') LINE(2) SORTPRTY(1) - CTLBREAK(P) SUBTITLE IDCDUSER LABEL('USERID: ') LINE(2) SORTPRTY(2) - JUSTIFY(C) SUBTITLE LOGONTYP LABEL('LOGON: ') LINE(3) XFORM(NAVAIL) SUBTITLE SUBMITYP LABEL('SUBMIT: ') LINE(3) XFORM(NAVAIL) - JUSTIFY(C) FIELD POWERJOB SORTPRTY(3) CTLBREAK(S) FIELD POWERJB# SORTPRTY(4) REPCHAR(' ') FIELD JOBNAME FIELD SYSDATE SORTPRTY(5) SORTSEQ(AS) REPCHAR('.') FIELDS SYSTIME PARTINID RCLASS RESNAME PROGRAM FIELD REQACC LENGTH(3) LABELS('REQ','ACC') FIELD AUTHACC LENGTH(3) LABELS('ALL','ACC') SELECT IF EVENTYPE EQ X'02' AND ACCESSTP EQ X'02' RUN/*

Input

Page 300: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID/User Resource Summary Report Sample ALRTVVVI Reports

6-38 Auditing and Report Writing Guide

DATE: 03/26/1998 14:55:54 PAGE: 000001 B I M - A L E R T / V S E

*** SECID/USER RESOURCE ACCESS ***

SECID: SECADMIN USERID: EKEHLERLOGON: CMS SUBMIT: CMS POWER POWER JOB SYSTEM SYSTEM PTN RESOURCE RESOURCE PROGRAM REQ ALL JOB NAME NBR JOB NAME DATE TIME ID CLASS NAME NAME ACC ACC -------- ----- -------- ------ ------ --- -------- -------- ------- --- --- ALERT50A 842 ALERT50A 03/26/1998 07:29 FB EXECUTE AXPL7 NO NAME EXE EXE AXPB001 839 AXPB001 03/26/1998 07:19 BG EXECUTE AXPB001 NO NAME EXE EXE AXPB001 AXPB001 . 07:19 BG LIBMEM BIMCOL.RULES50A.ALERTB1.PHASE AXPB001 EXE ALT AXPL11 843 AXPL11 03/26/1998 07:36 C2 EXECUTE AXPL11 NO NAME EXE EXE S1B190A 846 S1B190A 03/26/1998 08:23 BG EXECUTE SORT NO NAME EXE EXE S1B190A 850 S1B190A . 12:19 BG EXECUTE SORT NO NAME EXE EXE S1B190A 851 S1B190A . 12:20 BG EXECUTE SORT NO NAME EXE EXE S1B190A S1B190A . 12:20 BG EXECUTE S1B190 NO NAME EXE EXE S1B500 853 S1B500 03/26/1998 12:36 BG EXECUTE S1B500 NO NAME EXE EXE S1B510 854 S1B510 03/26/1998 12:42 BG EXECUTE S1B510 NO NAME EXE EXE S1B520 855 S1B520 03/26/1998 12:49 BG EXECUTE S1B520 NO NAME EXE EXE S1B540 856 S1B540 03/26/1998 12:56 BG EXECUTE S1B540 NO NAME EXE EXE S1B550 857 S1B550 03/26/1998 13:03 F5 EXECUTE S1B550 NO NAME EXE EXE S1B550 858 S1B550 . 13:05 F5 EXECUTE S1B550 NO NAME EXE EXE S1B560 859 S1B560 03/26/1998 13:23 FB EXECUTE S1B560 NO NAME EXE EXE S1B560 861 S1B560 . 13:56 FB EXECUTE S1B560 NO NAME EXE EXE S1SCTY 862 S1SCTY 03/26/1998 14:41 FB EXECUTE IDCAMS NO NAME EXE EXE ALRTVREP 865 ALRTVREP 03/26/1998 14:55 F5 EXECUTE ALRTVREP NO NAME EXE EXE AXPHJ19 816 AXPHJ19 03/26/1998 05:35 FB LIBMEM BIMCOL.ALT50A.AXPHJ19.OBJ LIBR UPD UPD AXPHJ19 AXPHJ19 . 05:35 FB LIBMEM BIMCOL.ALT50A.MSAUSRX.PHASE $LNKEDT UPD UPD AXPHJ19 AXPHJ19 . 05:35 FB LIBMEM BIMCOL.ALT50A.MSAUSRX.PHASE $LNKEDT UPD UPD AXPHJ19 AXPHJ19 . 05:35 FB LIBMEM BIMCOL.AXPOBJ.AXPHJ19.OBJ LIBR UPD UPD AXPHJ19 AXPHJ19 . 05:35 FB LIBMEM BIMCOL.AXPOBJ.AXPHJ19.OBJ LIBR UPD UPD AXPHJ19 AXPHJ19 . 05:35 FB LIBMEM BIMCOL.ALT50A.AXPHJ19.OBJ LIBR UPD UPD AXPHJ19D 820 AXPHJ19D 03/26/1998 05:37 FB LIBMEM BIMCOL.AXPOBJ.AXPHJ19D.OBJ LIBR UPD UPD AXPHJ19D AXPHJ19D . 05:37 FB LIBMEM BIMCOL.ALT50A.AXPHJ19D.PHASE $LNKEDT UPD UPD AXPHJ19D AXPHJ19D . 05:37 FB LIBMEM BIMCOL.AXPOBJ.AXPHJ19D.OBJ LIBR ALT UPD AXPHJ19D AXPHJ19D . 05:37 FB LIBMEM BIMCOL.ALT50A.AXPHJ19D.PHASE $LNKEDT UPD UPD AXPHJ19D AXPHJ19D . 05:37 FB LIBMEM BIMCOL.ALT50A.AXPHJ19E.PHASE $LNKEDT UPD UPD

Output

Page 301: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

7-1

7

ALRTVCAU Audit File Report

This chapter describes the ALRTVCAU audit file report, which you can use to select anddisplay information from the BIM-ALERT/CICS audit file, as well as user profile informationfrom the BIM-ALERT/VSE audit file.

Introduction....................................................................................................................7-3General Information...................................................................................................7-3Sample JCL................................................................................................................7-3Input Record Description...........................................................................................7-4Field Information .......................................................................................................7-7

Fieldname List................................................................................................................7-9Common Segment Fields ...........................................................................................7-9System Options and Parameter Fields......................................................................7-14Terminal and Operator Profile Fields ......................................................................7-32Secured Resource Fields..........................................................................................7-50Secured Resource Authorization Fields ...................................................................7-65Activation and Deactivation Fields..........................................................................7-68Administrator Maintenance Fields...........................................................................7-71Location Information Fields ....................................................................................7-74Password Change Field............................................................................................7-77Program Refresh Fields ...........................................................................................7-78Optional Zap Fields .................................................................................................7-79Record Dump Information.......................................................................................7-80

Sample ALRTVCAU Reports......................................................................................7-81Introduction .............................................................................................................7-81System Options Update Report................................................................................7-81System Parameter Change Report............................................................................7-83

Page 302: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

7-2 Auditing and Report Writing Guide

System Parameter Update Report ............................................................................7-84Global Terminal/Operator Parameter Change Report..............................................7-85Resource Name Update Report................................................................................7-87Resource Update Report ..........................................................................................7-89Resource Activation and Deactivation Report .........................................................7-91Administrator Change Activity Report ....................................................................7-92Location Change Report ..........................................................................................7-94Operator Profile Change Report ..............................................................................7-95

Page 303: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction General Information

Chapter 7. ALRTVCAU Audit File Report 7-3

Introduction

General Information

Information contained in the BIM-ALERT/CICS audit file is available for selection anddisplay in the ALRTVCAU report type. This information includes changes made to systemoptions and parameters, operator and terminal system parameters, and operator and terminalprofiles. The audit file also includes information about the addition or updating of securedresource definitions, activation and deactivation activity, and changes to administrativeownership of resources.

You can also use the ALRTVCAU report type to select user profile information that relate tothe batch security profile fields.

This report type requires the BIM-ALERT/CICS audit file, or a VSAM copy of the file, asinput. It also accepts a sequential tape or disk file with variable-length records as input.

The phase ALRTVCAU is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVCAU reads the input file and formats the data for thereport.

Sample JCL

The following sample JCL can be used to execute any ALRTVCAU report:

// JOB ALRTVCAU BIM-ALERT/CICS audit file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL S1SAUDT,'ALERT.S1SAUDT.V50',,VSAM// EXEC ALRTVREP,SIZE=256K . ./*/&

Report Description

Input Dataset

I/O Module Name

Page 304: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

7-4 Auditing and Report Writing Guide

Input Record Description

Each BIM-ALERT/CICS audit file record contains an 18-byte record key and one of severalsubordinate information field types (segments), determined by the contents of the RECTYPEfield contained in the common segment of the record.

The common segment contains control information about the record and is contained in everyrecord type.

The 01000000 segment contains all information regarding changes to the system options(UPOP or UCOP), system parameters (UPAR), or terminal or operator system parameters(UTOP).

System Options Or Parameter Lists (Type 01010000)The 01010000 segment fields can be used to produce a report of all before and after dataconcerning the system options, system parameters, or terminal or operator system parameters.

System Option Values (Type 01020000)The type 01020000 fields allow you to select and report on specific system options (forexample, Operator Transaction Security) logged as a result of running UPOP or UCOP.

System Parameter Values (Type 01030000)The type 01030000 fields allow you to select and report on specific system parameters (forexample, Maximum Violations) logged as a result of running UPAR to update the systemparameters.

Terminal or Operator Parameter Values (Type 01040000)The type 01040000 fields allow you to select and report on specific terminal and operatorparameters (for example, Post-Sign-On Program) logged as a result of running UTOP toupdate terminal or operator parameters.

The type 02000000 fields can be used to produce a listing of all the terminal or operatorprofiles that have been changed, either via the online panels or via the batch file updateutilities.

Terminal Or Operator Data List (Type 02010000)The type 02010000 fields produce a complete listing of all before and after data for each fieldin the terminal or operator record that was logged as a result of online changes or batch utilityupdates.

Terminal Or Operator Data Fields (Type 02020000)The type 02020000 fields allow you to select and report on specific terminal and operator datafields (for example, the Inactive Time Limit field) logged as a result of updates made via theonline panels or the batch utility update programs S1U550 and S1U560.

Introduction

CommonInformation (Type00000000)

System Options orParameterInformation (Type01000000)

Terminal orOperatorMaintenance (Type02000000)

Page 305: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 7. ALRTVCAU Audit File Report 7-5

User Profile Data Fields (Type 02030000)The type 02030000 fields allow you to select and report on specific operator profile datafields logged as a result of updates made via the online panels or the batch utility updateprogram S1U550.

The type 03000000 fields can be used to produce a listing of all the secured resourcedefinitions that have been added or updated via the online panels.

Secured Resource Information List (Type 03010000)The type 03010000 fields produce a complete listing of all before and after data for each fieldin the secured resource (transaction, program, file, or map) record.

Secured Resource Field Values (Type 03020000)The type 03020000 fields allow you to select and report on specific data fields (for example,the Access Time field) in a secured resource record.

Restricted Map Field Information (Type 03030000)The type 03030000 fields allow you to select and report on specified map field definitions inthe restricted map records.

Field Resource Field Values for Files (Type 03040000)The type 03040000 fields allow you to select and print the data that makes up the fieldresource definitions for files.

Field Resource Segments for Files (Type 03040100)The type 03040100 fields allow you to select and print the data that makes up the segments ina field resource definition for a file.

Field Resource Field Values for Maps (Type 03050000)The type 03050000 fields allow you to select and print the data that makes up the fieldresource definitions for maps.

Field Resource Segments for Maps (Type 03050100)The type 03050100 fields allow you to select and print the data that makes up the segments ina field resource definition for a map.

The type 04000000 fields can be used to produce a listing of all resources (transactions,programs, files, maps, or field resources) added to or deleted from any terminal or operatorprofile.

Secured Resource Authorization Lists (Type 04010000)The type 04010000 fields allow you to produce reports showing all resources added to ordeleted from terminals and operators.

The type 05000000 fields show a global list of all activation or deactivation activity.

Activate Or Deactivate Data Fields (Type 05010000)The type 05010000 fields can be used to tailor activation or deactivation reports to specificresource types or specific resources.

Secured ResourceUpdate (Type03000000)

Secured ResourceAuthorizationInformation Type04000000

Activate OrDeactivateInformation (Type05000000)

Page 306: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

7-6 Auditing and Report Writing Guide

The type 06000000 fields can be used to produce a global report of the types of resourcesswitched between administrators (terminals or operators), and the type of operation beingperformed (change or reclaim).

Administrator Maintenance Information (Type 06010000)The type 06010000 fields can be used to produce detailed reports about specific operators orterminals being switched from administrator to administrator.

The type 07000000 fields can be used to produce a global report of all location recordmaintenance.

Location ID Information List (Type 07010000)The type 07010000 fields can be used to select and report on updates made to specificlocation records.

Location ID Field Values (Type 07020000)The type 07020000 fields produce a complete listing of all before and after data for each fieldin the location records.

The type 08000000 fields can be used to produce reports logged as a result of the OPWDoptional transaction.

The type 09000000 fields can be used to produce reports containing the data logged as a resultof the REFR transaction to NEWCOPY monitors, user exits, or logos.

The optional zap information segment contains data regarding the dynamic installation andremoval of optional zaps using VERS.

The type FF000000 fields are used to produce the FILEDUMP listing of the audit file records.

AdministratorMaintenanceInformation (Type06000000)

Location IDMaintenance (Type07000000)

Password ChangeInformation (Type08000000)

Program RefreshInformation (Type09000000)

Optional ZapInformation (Type0A000000)

Record DumpInformation (TypeFF000000)

Page 307: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Field Information

Chapter 7. ALRTVCAU Audit File Report 7-7

Field Information

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default, or user, specifications. Each data field is selected from a pre-defined list of ALRTVCAU fieldnames.

At report generation time, each fieldname specified is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to the selected fieldname is located, extracted from the physical inputrecord by the ALRTVCAU I/O module, and moved to, or transformed into, the output reportcolumn, using either the default values described in the fieldname entries below or asspecified by the user in a FIELD command statement.

The following information is provided for each ALRTVCAU fieldname:

Heading Description

Group Field: YES Indicates that the fieldname being defined is a group fieldname containing several individualfieldnames within the group. The individual fieldnames are listed.

If the group fieldname is specified in the SUBTITLE, FIELD, or FIELDS command statement,input data represented by all individual fieldnames within the group will be printed as a singlefield.

If the individual fieldnames are specified in a command statement, each fieldname is assigned itsown column in the report output detail line.

Field type Each fieldname is defined as a particular field type. By definition, type 00000000 information ispresent in every input record. Following the type 00000000 common segment information,ALRTVCAU records will contain one subordinate type of field information, containinginformation as indicated by the RECTYPE field.

Default label-n Default label information is positioned in the output report, if requested, at the top of each page ofoutput. Up to three labels can be specified for each field, and will be placed above the reportcolumn reserved for the fieldname

Occurrences: variable Indicates that the field is defined within a variable-occurrence segment. This fieldname, ifincluded on any FIELD or FIELDS command statement, will generate a report detail line forevery occurrence of the information in the record.

Belongs to group: Indicates a higher level group fieldname which can be included on any SUBTITLE, FIELD, orFIELDS command statement to display the data represented by this fieldname.

Input data length: Represents the defined length of the data in the input record corresponding to the fieldname. Ifthe length is indicated as variable, then the length of the data field has no pre-defined length, andthe amount of data present is defined in each individual input record.

(continued)

Page 308: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Information Introduction

7-8 Auditing and Report Writing Guide

Heading Description

Input data format Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default output length This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be increased or decreased by using the LENGTH keyword on a FIELD commandstatement.

Default output format One of the following output formats is assigned by default for each fieldname; it determines howthe data will appear in the output report.

C Character. The input data is simply moved from the input record to the report detailline. Each non-printable character is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-characterhexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is treated as a binarynumber and converted to its decimal equivalent. By default, zoned-decimal formattedoutput fields are zero-suppressed and right-justified in the report column. Users canoverride the field justification value by using the JUSTIFY keyword on the FIELDcommand statement. Zero-suppression can be overridden by specifying NOTRUNCon the FIELD or SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forthin the transformation table shown, or as determined by some other programmedtransformation algorithm, such as that performed on the BIM-ALERT/CICSTERMPHON field.

Users can override the field output format value by using the FORMAT keyword on the FIELDcommand statement.

Page 309: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 7. ALRTVCAU Audit File Report 7-9

Fieldname List

Common Segment Fields

The following field names can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the common segment ofall input records and will be printed on all detail lines when appropriate.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label RECORD KEYInput data length: 18Input data format: Hexadecimal (X)Default output data length: 36Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: RECORDDefault label-3: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 6Default output data format: Zoned-decimal (Z)

DSNAME Input file dataset name.

Field type: 00000000 - Common segment informationDefault label-1: INPUT DSNAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

(continued)

Page 310: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

7-10 Auditing and Report Writing Guide

Heading Description

INFOTYPE Information type, which describes the type of information contained in the field or record.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X)Default output length: 25Default output format: Transformed (T)X'00000000'..T'COMMON SEGMENT INFO 'X'01000000'..T'SYSTEM OPTION/PARM CHANGE'X'01010000'..T'SYSTEM OPTION/PARM LIST 'X'01020000'..T'SYSTEM OPTION VALUES 'X'01030000'..T'SYSTEM PARAMETER VALUES 'X'01040000'..T'TERM/OPER PARM VALUES 'X'02000000'..T'TERM/OPER MAINTENANCE 'X'02010000'..T'TERM/OPER DATA LIST 'X'02020000'..T'TERM/OPER DATA FIELDS 'X'02030000'..T'USERID DATA FIELDS 'X'03000000'..T'SECURED RESOURCE UPDATE 'X'03010000'..T'SEC'D RESRC INFO LIST 'X'03020000'..T'SEC'D RESRC FIELD VALUES 'X'03030000'..T'RESTRICTED MAP FIELD INFO'X'03040000'..T'FIELD RESOURCE FIELD VALU'

X'03040100'.T'FIELD RESOURCE SEGMENTS 'X'04000000'.T'SEC'D RSRC AUTHORIZATION 'X'04010000'.T'SEC'D RSRC AUTHORIZATION 'X'05000000'.T'ACTIVATE-DEACTIVATE INFO 'X'05010000'.T'ACTIVATE-DEACTIVATE INFO 'X'06000000'.T'ADMINISTRATOR MAINT INFO 'X'06010000'.T'ADMINISTRATOR MAINT INFO 'X'07000000'.T'LOCATION ID MAINTENANCE 'X'07010000'.T'LOCATION ID INFO LIST 'X'07020000'.T'LOCATION ID FIELD VALUES 'X'08000000'.T'PASSWORD CHG FIELD 'X'09000000'.T'PROGRAM REFRESH INFO 'X'0A000000'.T'OPTIONAL ZAP INFORMATION 'X'FF000000'.T'RECORD DUMP INFORMATION '

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: NoneInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

INRECNUM Physical input record sequence number, assigned by the ALRTVCAU I/O module when the inputrecord is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

DATE Date change was made.

Field type: 00000000 - Common segment informationDefault label-1: DATEInput data length: 4Input data format: Hexidecimal (X)Default output data length: 10Default output data format: Transformed (T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

(continued)

Page 311: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 7. ALRTVCAU Audit File Report 7-11

Heading Description

TIME Time change was made.

Field type: 00000000 - Common segment informationDefault label-1: TIMEInput data length: 4Input data format: Packed decimal (P)Default output data length: 5Default output data format: Transformed (T)X'AFCBB7AD'.....T' 08:25 ' (or user-defined TIMEFORM)

SYSTEMID CICS SYSID where change was made.

Field type: 00000000 - Common segment informationDefault label-1: SYS-IDInput data length: 8Input data format: Character (C)Default output data length: 8Default output data format: Character (C)

ADMINAME Name of administrator or subadministrator who made the change.

Field type: 00000000 - Common segment informationDefault label-1: ADMINISTRATORDefault label-1: NAMEInput data length: 20Input data format: Character (C)Default output data length: 20Default output data format: Character (C)

ADMINID User ID of administrator or subadministrator who made the change.

Field type: 00000000 - Common segment informationDefault label-1: ADMINISTRDefault label-2: IDInput data length: 9Input data format: Character (C)Default output data length: 9Default output data format: Character (C)

TRANID BIM-ALERT function executed to make the change.

Field type: 00000000 - Common segment informationDefault label-1: TRANDefault label-1: IDInput data length: 4Input data format: Character (C)Default output data length: 4Default output data format: Character (C)

(continued)

Page 312: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

7-12 Auditing and Report Writing Guide

Heading Description

TRANTYPE BIM-ALERT audit transaction type.

Field type: 00000000 - Common segment informationDefault label-1: AUDITDefault label-2 TRANSACTIONDefault label-3: TYPEInput data length: 4Input data format: Character (C)Default output data length: 9Default output data format: Transformed (T)C'UCOP'.....T'PARM 'C'UPOP'.....T'PARM 'C'UPAR'.....T'PARM 'C'UTOP'.....T'PARM 'C'ATSI'.....T'TERMOPER 'C'ATSB'.....T'TERMOPER 'C'UTSI'.....T'TERMOPER 'C'UTSB'.....T'TERMOPER 'C'AOSI'.....T'TERMOPER 'C'AOSB'.....T'TERMOPER 'C'UOSI'.....T'TERMOPER 'C'UOSB'.....T'TERMOPER 'C'ASTR'.....T'RESOURCE 'C'USTR'.....T'RESOURCE 'C'ASPR'.....T'RESOURCE 'C'USPR'.....T'RESOURCE 'C'ASFL'.....T'RESOURCE 'C'USFL'.....T'RESOURCE 'C'AFIL'.....T'ACTIVATE 'C'DFIL'.....T'ACTIVATE 'C'ASMP'.....T'RESOURCE 'C'USMP'.....T'RESOURCE 'C'ASFF'.....T'RESOURCE 'C'USFF'.....T'RESOURCE 'C'ASFM'.....T'RESOURCE 'C'USFM'.....T'RESOURCE 'C'ATTR'.....T'AUTHORIZE'C'ATTB'.....T'AUTHORIZE'C'UTTR'.....T'AUTHORIZE'C'UTTB'.....T'AUTHORIZE'C'ATPR'.....T'AUTHORIZE'C'ATPB'.....T'AUTHORIZE'C'UTPR'.....T'AUTHORIZE'C'UTPB'.....T'AUTHORIZE'C'ATFL'.....T'AUTHORIZE'C'ATFB'.....T'AUTHORIZE'C'UTFL'.....T'AUTHORIZE'C'UTFB'.....T'AUTHORIZE'C'ATMP'.....T'AUTHORIZE'C'ATMB'.....T'AUTHORIZE'C'UTMP'.....T'AUTHORIZE'C'UTMB'.....T'AUTHORIZE'C'ATFS'.....T'AUTHORIZE'C'UTFS'.....T'AUTHORIZE'C'AAUP'.....T'ADD OPRID'C'UAUP'.....T'UPD OPRID'

C'DAUP'.....T'MASS RETR'C'AOPR'.....T'AUTHORIZE'C'AOPB'.....T'AUTHORIZE'C'UOPR'.....T'AUTHORIZE'C'UOPB'.....T'AUTHORIZE'C'AOFL'.....T'AUTHORIZE'C'AOFB'.....T'AUTHORIZE'C'UOFL'.....T'AUTHORIZE'C'UOFB'.....T'AUTHORIZE'C'AOMP'.....T'AUTHORIZE'C'AOMB'.....T'AUTHORIZE'C'UOMP'.....T'AUTHORIZE'C'UOMB'.....T'AUTHORIZE'C'AOFS'.....T'AUTHORIZE'C'UOFS'.....T'AUTHORIZE'C'ATRN'.....T'ACTIVATE 'C'DTRN'.....T'ACTIVATE 'C'APRG'.....T'ACTIVATE 'C'DPRG'.....T'ACTIVATE 'C'AOTR'.....T'AUTHORIZE'C'AOTB'.....T'AUTHORIZE'C'UOTR'.....T'AUTHORIZE'C'UOTB'.....T'AUTHORIZE'C'AMAP'.....T'ACTIVATE 'C'DMAP'.....T'ACTIVATE 'C'ACTT'.....T'ACTIVATE 'C'DATM'.....T'ACTIVATE 'C'ACTO'.....T'ACTIVATE 'C'DAOP'.....T'ACTIVATE 'C'AFLD'.....T'ACTIVATE 'C'DFLD'.....T'ACTIVATE 'C'ADCT'.....T'ADMIN 'C'ADRT'.....T'ADMIN 'C'ADCO'.....T'ADMIN 'C'ADRO'.....T'ADMIN 'C'ACOM'.....T'LOCATION 'C'UCOM'.....T'LOCATION 'C'ADIV'.....T'LOCATION 'C'UDIV'.....T'LOCATION 'C'ADPT'.....T'LOCATION 'C'UDPT'.....T'LOCATION 'C'ASCT'.....T'LOCATION 'C'USCT'.....T'LOCATION 'C'OPWD'.....T'PASSWORD 'C'REFR'.....T'REFRESH 'C'VERS'.....T'OPTZAP '

(continued)

Page 313: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 7. ALRTVCAU Audit File Report 7-13

Heading Description

TRANDESC Audit record description.

Field type: 00000000 - Common segment informationDefault label-1: AUDITDefault label-2: TRANSACTIONDefault label-3: DESCRIPTIONInput data length: 4Input data format: Character (C)Default output length: 24Default output format: Transformed (T)C'UCOP'...T'UPDATE CURRENT OPTIONS 'C'UPOP'...T'UPDATE PERMANENT OPTIONS'C'UPAR'...T'UPDATE SYSTEM PARMS 'C'UTOP'...T'UPDATE TERM/OPER PARMS 'C'ATSI'...T'ADD TERMINAL ID 'C'ATSB'...T'ADD TERMINAL ID 'C'UTSI'...T'UPDATE TERMINAL ID 'C'UTSB'...T'UPDATE TERMINAL ID 'C'ASTR'...T'ADD SECURED TRANID 'C'USTR'...T'UPDATE SECURED TRANID 'C'ASPR'...T'ADD SECURED PROGRAM 'C'USPR'...T'UPDATE SECURED PROGRAM 'C'ASFL'...T'ADD SECURED FILE 'C'USFL'...T'UPDATE SECURED FILE 'C'ASMP'...T'ADD SECURED MAP 'C'USMP'...T'UPDATE SECURED MAP 'C'ATTR'...T'ADD TERMINAL TRANID 'C'ATTB'...T'ADD TERMINAL TRANID 'C'UTTR'...T'DELETE TERMINAL TRANID 'C'UTTB'...T'DELETE TERMINAL TRANID 'C'ATPR'...T'ADD TERMINAL PROGRAM 'C'ATPB'...T'ADD TERMINAL PROGRAM 'C'UTPR'...T'DELETE TERMINAL PROGRAM 'C'UTPB'...T'DELETE TERMINAL PROGRAM 'C'ATFL'...T'ADD TERMINAL FILE 'C'ATFB'...T'ADD TERMINAL FILE 'C'UTFL'...T'DELETE TERMINAL FILE 'C'UTFB'...T'DELETE TERMINAL FILE 'C'ATMP'...T'ADD TERMINAL MAP 'C'ATMB'...T'ADD TERMINAL MAP 'C'UTMP'...T'DELETE TERMINAL MAP 'C'UTMB'...T'DELETE TERMINAL MAP 'C'AOTR'...T'ADD OPERATOR TRANID 'C'AOTB'...T'ADD OPERATOR TRANID 'C'UOTR'...T'DELETE OPERATOR TRANID 'C'UOTB'...T'DELETE OPERATOR TRANID 'C'AAUP'...T'ADD OPERATOR ID 'C'AAUB'...T'ADD OPERATOR ID 'C'UAUB'...T'UPDATE OPERATOR ID '

C'AOPR'...T'ADD OPERATOR PROGRAM 'C'AOPB'...T'ADD OPERATOR PROGRAM 'C'UOPR'...T'DELETE OPERATOR PROGRAM 'C'UOPB'...T'DELETE OPERATOR PROGRAM 'C'AOFL'...T'ADD OPERATOR FILE 'C'AOFB'...T'ADD OPERATOR FILE 'C'UOFL'...T'DELETE OPERATOR FILE 'C'UOFB'...T'DELETE OPERATOR FILE 'C'AOMP'...T'ADD OPERATOR MAP 'C'AOMB'...T'ADD OPERATOR MAP 'C'UTMP'...T'DELETE OPERATOR MAP 'C'UTMB'...T'DELETE OPERATOR MAP 'C'ATRN'...T'ACTIVATE TRANSACTION 'C'DTRN'...T'DEACTIVATE TRANSACTION 'C'APRG'...T'ACTIVATE PROGRAM 'C'DPRG'...T'DEACTIVATE PROGRAM 'C'AFIL'...T'ACTIVATE FILE 'C'DFIL'...T'DEACTIVATE FILE 'C'AMAP'...T'ACTIVATE MAP 'C'DMAP'...T'DEACTIVATE MAP 'C'ACTT'...T'ACTIVATE TERMINAL 'C'DATM'...T'DEACTIVATE TERMINAL 'C'ACTO'...T'ACTIVATE OPERATOR 'C'DAOP'...T'DEACTIVATE OPERATOR 'C'ADCT'...T'CHANGE TERMINAL ADMIN 'C'ADRT'...T'RECLAIM TERMINAL ADMIN 'C'ADCO'...T'CHANGE OPERATOR ADMIN 'C'ADRO'...T'RECLAIM OPERATOR ADMIN 'C'ACOM'...T'ADD COMPANY 'C'UCOM'...T'UPDATE COMPANY 'C'ADIV'...T'ADD DIVISION 'C'UDIV'...T'UPDATE DIVISION 'C'ADPT'...T'ADD DEPARTMENT 'C'UDPT'...T'UPDATE DEPARTMENT 'C'ASCT'...T'ADD SECTION 'C'USCT'...T'UPDATE SECTION 'C'OPWD'...T'OPER PSWD CHANGE 'C'REFR'...T'PROGRAM REFRESH 'C'VERS'...T'OPTIONAL ZAP UPDATE 'C'UAUP'...T'UPDATE OPERATOR ID '

Page 314: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-14 Auditing and Report Writing Guide

System Options and Parameter Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile security option, system parameter, or terminal or operator parameter records (segmentX'010x0000'). These fields will be printed only on report detail lines with other segment01xxxxxx record and common segment fieldnames.

Field Description

PARMTYPE Parameter type (sysopt, sysparm, or term or oper).

Field type: 01000000 - System options or parameter changeDefault label-1: PARAMETERDefault label-2: TYPEInput data length: 1Input data format: Hexadecimal (X)Default output length: 21Default output format: Transformed (T)X'01'...........T'SYSTEM OPTION 'X'02'...........T'SYSTEM PARAMETER 'X'03'...........T'TERM/OPER SYSTEM PARM'

PARMCHGI System parameter immediate changes.

Default label-1: CHGDefault label-2: IMMField type: 01000000 - System options or parameter changeInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)C'Y'............T'YES'C'N'............T'NO '

PARMFLAG Indicates before or after data value.

Default label-1: BEFOREDefault label-2: /AFTERField type: 01000000 - System options or parameter changeInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)C' '............T'N/A 'C'B'............T'BEFORE'C'A'............T'AFTER '

(continued)

Page 315: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-15

Heading Description

PARMCURR Option changes current or permanent.

Default label-1: CURRENTDefault label-2: ORDefault label-3: PERMANENTField type: 01000000 - System options or parameter changeInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)C'C'............T'CURRENT 'C'P'............T'PERMANENT'

The 01010000 segment fields will produce a report containing all the before and after valueslogged as a result of updating the system options (UCOP or UPOP), system parameters(UPAR), or the system terminal or operator parameters (UTOP).

Field Description

PARMVALB Security parameter value before update.

Default label-1: BEFOREField type: 01010000 - System options or parameter listInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

PARMVALA Security parameter value after update.

Default label-1: AFTERField type: 01010000 - System options or parameter listInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

(continued)

System OptionsParameter List

Page 316: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-16 Auditing and Report Writing Guide

Heading Description

PARMVALD Security parameter description.Default label-1: SECURITYDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 01010000 - System options or parameter listInput data length: 1Input data format: Character (C)Default output length: 26Default output format: Transformed (T)X'01'...........T'SYSTEM TRAN SECURITY 'X'02'...........T'SYSTEM PROG SECURITY 'X'03'...........T'SYSTEM FILE SECURITY 'X'04'...........T'OPERATOR TRAN SECURITY 'X'05'...........T'OPERATOR PROG SECURITY 'X'06'...........T'OPERATOR FILE SECURITY 'X'07'...........T'OPERATOR MAP SECURITY 'X'08'...........T'TERMINAL TRAN SECURITY 'X'09'...........T'TERMINAL PROG SECURITY 'X'0A'...........T'TERMINAL FILE SECURITY 'X'0B'...........T'TERMINAL MAP SECURITY 'X'0C'...........T'VIOLATION AUDITING 'X'0D'...........T'TERMINAL SCHEDULING 'X'0E'...........T'PRODUCT CODE 'X'0F'...........T'MAXIMUM VIOLATIONS 'X'10'...........T'CONSECUTIVE VIOLATIONS 'X'11'...........T'CONTROL SUFFIX 'X'12'...........T'EXTRA ENTRIES 'X'13'...........T'USER EXITS 'X'14'...........T'DYNAMIC TERMINALS 'X'15'...........T'DUMMY TERMINAL 'X'17'...........T'NEW CODE NOTIFICATION 'X'18'...........T'ASSIGNED BY ALERT 'X'19'...........T'SECURE ALL TERMINALS 'X'1A'...........T'SECURE ALL TRANSACTIONS 'X'1B'...........T'SECURE ALL PROGRAMS 'X'1C'...........T'SECURE ALL FILES 'X'1D'...........T'FORCE DELAY TIME 'X'1E'...........T'IF FORCED DISPLAY 'X'1F'...........T'OPER STAT/MAX VIOL 'X'20'...........T'GROUP STAT/MAX VIOL 'X'21'...........T'SIGNON MESSAGE DELAY 'X'22'...........T'UNSEC TERM PROGRAM 'X'23'...........T'CONSOLE VIOL DISPLAY 'X'24'...........T'DATE FORMAT 'X'25'...........T'TERM LOGO NAME 'X'26'...........T'TERM LOG OPTION 'X'27'...........T'TERM SIGNON PROGRAM 'X'28'...........T'TERM SIGNOFF PROGRAM 'X'29'...........T'TERM SCTY CODE PERIOD 'X'2A'...........T'TERM SCTY CODE MASK 'X'2B'...........T'TERM PRINT PROFILE 'X'2C'...........T'TERM DEFAULT AUTH 'X'2D'...........T'TERM SCTY CODE HIST 'X'2E'...........T'TERM MESSAGE FILE 'X'2F'...........T'OPER LOG OPTION 'X'30'...........T'OPER SIGNON PROGRAM 'X'31'...........T'OPER SIGNOFF PROGRAM 'X'32'...........T'OPER PASSWORD PERIOD 'X'33'...........T'OPER PASSWORD MASK 'X'34'...........T'OPER PRINT PROFILE 'X'35'...........T'OPER DEFAULT AUTH 'X'36'...........T'OPER PASSWORD HISTORY 'X'37'...........T'OPER EXTERNAL SECURITY '

(continued)

Page 317: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-17

The 01020000 segment fields allow you to produce a report by selecting specific systemoptions.

Field Description

SYTRANSC System transaction security option.

Default label-1: SYSDefault label-1: TRANDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

SYPROGSC System program security option.

Default label-1: SYSDefault label-1: PROGDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

SYFILESC System file security option.

Default label-1: SYSDefault label-2: FILEDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

(continued)

System OptionsValues

Page 318: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-18 Auditing and Report Writing Guide

Field Description

TMTRANSC Terminal transaction security option.

Default label-1: TERMDefault label-2: TRANDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

TMPROGSC Terminal program security option.

Default label-1: TERMDefault label-2: PROGDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

TMFILESC Terminal file security option.

Default label-1: TERMDefault label-2: FILEDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

(continued)

Page 319: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-19

Field Description

TMMAPSEC Terminal map security option.

Default label-1: TERMDefault label-2: MAPDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

TMFLDSEC Terminal field security option.

Default label-1: TERMDefault label-2: FIELDDefault label-3: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

OPTRANSC Operator transaction security option.

Default label-1: OPERDefault label-1: TRANDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

(continued)

Page 320: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-20 Auditing and Report Writing Guide

Field Description

OPPROGSC Operator program security option.

Default label-1: OPERDefault label-1: PROGDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

OPFILESC Operator file security option.

Default label-1: OPERDefault label-1: FILEDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

OPMAPSEC Operator map security option.

Default label-1: OPERDefault label-1: MAPDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

OPFLDSEC Operator field security option.

Default label-1: OPERDefault label-1: FIELDDefault label-1: SCTYField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

(continued)

Page 321: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-21

Field Description

VIOLAUDT Violation auditing option.

Default label-1: VIOLDefault label-1: AUDTField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

TERMSCHD Terminal scheduling option.

Default label-1: TERMDefault label-1: SCHDField type: 01020000 - System option valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Transformed (T)X'00'...........T'OFF'X'FF'...........T'ON '

The type 01030000 segment fields allow you to produce a report by selecting specific systemparameter fields. This type of report can be used to track very specific changes in systemsecurity parameter values.

Field Description

MAXVIOLA Maximum violations.

Default label-1: MAXDefault label-2: VIOField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

System ParameterValues

Page 322: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-22 Auditing and Report Writing Guide

Field Description

MAXCONSC Maximum consecutive violations.

Default label-1: MAXDefault label-2: CONDefault label-3: ATTField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

CTRLSUFX Control suffix number.

Default label-1: SDefault label-2: FDefault label-3: #Field type: 01030000 - System parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

EXTRAENT Number of extra entries.

Default label-1: EXTDefault label-2: ENTField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

USEREXIT User exits required.

Default label-1: USRDefault label-2: EXTDefault label-3: REQField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 323: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-23

Field Description

DYNATERM Dynamic terminal number.

Default label-1: DYNAMDefault label-2: TERMSField type: 01030000 - System parameter valuesInput data length: 5Input data format: Character (C)Default output length: 5Default output format: Character (C)

DUMMYTRM Dummy terminal name.

Default label-1: DUMMDefault label-2: TERMField type: 01030000 - System parameter valuesInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

NEWCODEN New code notification limit.

Default label-1: NEWDefault label-2: CDEDefault label-3: NTFField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

AGENCODE Codes to be assigned by BIM-ALERT/CICS.

Default label-1: ALTDefault label-2: GENDefault label-3: CDEField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 324: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-24 Auditing and Report Writing Guide

Field Description

ALLTERMS All terminals to be secured.

Default label-1: ALLDefault label-2: TRMDefault label-3: SECField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

ALLTRANS All transactions to be secured.

Default label-1: ALLDefault label-2: TRNDefault label-3: SECField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

ALLPROGS All programs to be secured.

Default label-1: ALLDefault label-2: PRGDefault label-3: SECField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

ALLFILES All files to be secured.

Default label-1: ALLDefault label-2: FILDefault label-3: SECField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 325: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-25

Field Description

FORCEDEL Second level timeout delay value.

Default label-1: FORCEDefault label-2: DELAYDefault label-3: TIMEField type: 01030000 - System parameter valuesInput data length: 4Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

FORCEDSP If forced display transaction.

Default label-1: FORCDefault label-2: DISPDefault label-3: TRANField type: 01030000 - System parameter valuesInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

OSTATMAX Operator status after maximum violations.

Default label-1: OPDefault label-2: STDefault label-3: MXField type: 01030000 - System parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

GSTATMAX Group operator status after maximum violations.

Default label-1: GPDefault label-2: STDefault label-3: MXField type: 01030000 - System parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

(continued)

Page 326: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-26 Auditing and Report Writing Guide

Field Description

MSGDELAY Sign-on message delay in seconds.

Default label-1: SNDefault label-2: MSDefault label-3: DLField type: 01030000 - System parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

UNSECTRM Unsecured terminal program.

Default label-1: UNSECUREDDefault label-2: TERMINALDefault label-3: PROGRAMField type: 01030000 - System parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

DATEFORM Date format.

Default label-1: DTDefault label-2: FMField type: 01030000 - System parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

CONSVIOL Display violations on console.

Default label-1: CONDefault label-2: VIODefault label-3: DSPField type: 01030000 - System parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

Page 327: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-27

The type 01040000 segment fields allow you to produce a report by selecting specific terminalor operator fields maintained by the UTOP transaction. This type of report can be used totrack very specific changes in global terminal or operator system security parameter values.

Field Description

TLOGONAM Terminal logo name.

Default label-1: TERMINALDefault label-2: LOGODefault label-3: NAMEField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TLOGOPTN Log terminal sign-on or sign-off records.

Default label-1: TRMDefault label-2: LOGDefault label-3: OPTField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

TSONPROG Terminal post-sign-on program.

Default label-1: TERMINALDefault label-2: SIGN-ONDefault label-3: PROGRAMField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TSOFPROG Terminal post-sign-off program.

Default label-1: TERMINALDefault label-2: SIGN-OFFDefault label-3: PROGRAMField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Terminal andOperator ParameterValues

Page 328: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-28 Auditing and Report Writing Guide

Field Description

TSCODPER Terminal password period in days.

Default label-1: TRMDefault label-2: SCDDefault label-3: PERField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

TSCODMSK Terminal password mask.

Default label-1: TERMINALDefault label-2: SCTYCODEDefault label-3: MASKField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TPRTPROF Authorization to print terminal profiles.

Default label-1: TRMDefault label-2: PRTDefault label-3: PRFField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

TDEFAUTH Terminal default authority.

Default label-1: TRMDefault label-2: DEFDefault label-3: AUTField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 329: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-29

Field Description

TSCODHST Terminal password history.

Default label-1: TMDefault label-2: SCDefault label-3: HSField type: 01040000 - Terminal or operator parameter valuesInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

TMSGFILE Default message file.

Default label-1: TERMINALDefault label-2: MESSAGEDefault label-3: FILEField type: 01040000 - Terminal or operator parameter valuesInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

OLOGOPTN Log operator sign-on or sign-off records.

Default label-1: OPRDefault label-2: LOGDefault label-3: OPTField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OSONPROG Operator post-sign-on program.

Default label-1: OPERATORDefault label-2: SIGN-ONDefault label-3: PROGRAMField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 330: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options and Parameter Fields Fieldname List

7-30 Auditing and Report Writing Guide

Field Description

OSOFPROG Operator post-sign-off program.

Default label-1: OPERATORDefault label-2: SIGN-OFFDefault label-3: PROGRAMField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OSCODPER Operator password period in days.

Default label-1: OPRDefault label-2: SCDDefault label-3: PERField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OSCODMSK Operator password mask.

Default label-1: OPERATORDefault label-2: SCTYCODEDefault label-3: MASKField type: 01040000 - Terminal or operator parameter valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

OPRTPROF Authorization to print operator profiles.

Default label-1: OPRDefault label-2: PRTDefault label-3: PRFField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 331: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List System Options and Parameter Fields

Chapter 7. ALRTVCAU Audit File Report 7-31

Field Description

ODEFAUTH Operator default authority.

Default label-1: OPRDefault label-2: DEFDefault label-3: AUTField type: 01040000 - Terminal or operator parameter valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

OSCODHST Operator password history.

Default label-1: OPDefault label-2: SCDefault label-3: HSField type: 01040000 - Terminal or operator parameter valuesInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

OEXTSCTY Operator external security option.

Default label-1: OPDefault label-2: EXDefault label-3: SCField type: 01040000 - Terminal or operator parameter valuesInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

Page 332: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-32 Auditing and Report Writing Guide

Terminal and Operator Profile Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile terminal or operator security profile records (segment X'020x0000'). These fields will beprinted only on report detail lines with other segment 02xxxxxx record and common segmentfieldnames.

Field Description

TMOPMODE Mode of action (online or batch).

Default label-1: ONLINEDefault label-2: ORDefault label-3: BATCHField type: 02000000 - Terminal or operator maintenanceInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)C'B'............T'BATCH 'C'O'............T'ONLINE'

TMOPACTN Type of action (add or update).

Default label-1: ADDDefault label-2: ORDefault label-3: UPDATEField type: 02000000 - Terminal or operator maintenanceInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)C'A'............T'ADD 'C'U'............T'UPDATE'

TMOPTYPE Type of update (terminal or operator).

Default label-1: TERMINALDefault label-2: ORDefault label-3: OPERATORField type: 02000000 - Terminal or operator maintenanceInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)C'T'............T'TERMINAL'C'O'............T'OPERATOR'

(continued)

Page 333: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-33

Field Description

TMOPNAME ID of terminal or operator affected.

Default label-1: NAMEField type: 02000000 - Terminal or operator maintenanceInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

Page 334: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-34 Auditing and Report Writing Guide

The 02010000 segment fields will produce a report containing all the before and after valueslogged as a result of updating or adding a terminal (ATSI, UTSI, or ATSB) or operator(AAUP, UAUP, or AAUB) profile.

Field Description

TMOPARMD Terminal or operator parameter description.

Default label-1: TERM/OPERDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 02010000 - Terminal or operator data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 19Default output format: Transformed (T)X'01'...........T'LOGO SUFFIX 'X'02'...........T'TELEPHONE NUMBER 'X'03'...........T'TIME DIFFERENTIAL 'X'04'...........T'TERM SIGN-ON EXEMPT'X'05'...........T'OPER SIGN-ON EXEMPT'X'06'...........T'VIOLATION TERMINAL 'X'07'...........T'VIOLATION PRINTER 'X'08'...........T'OPERATOR NAME 'X'09'...........T'PRIMARY TERMINAL 'X'0A'...........T'ALERT TERMINAL 1 'X'0B'...........T'ALERT TERMINAL 2 'X'0C'...........T'MODEL 'X'0D'...........T'ADMINISTRATOR 'X'0E'...........T'MESSAGE SUFFIX 'X'0F'...........T'TERMINAL GROUP 'X'10'...........T'COMPANY 'X'11'...........T'DIVISION 'X'12'...........T'DEPARTMENT 'X'13'...........T'SECTION 'X'14'...........T'STATUS 'X'15'...........T'PASSWORD 'X'16'...........T'PASSWORD EFF. DATE 'X'17'...........T'NEW PASSWORD 'X'18'...........T'NEW-CODE EFF. DATE 'X'19'...........T'PROCESS TYPE 'X'1A'...........T'INACTIVE TIME LIMIT'X'1B'...........T'SCHEDULED FROM-TIME'X'1C'...........T'SCHEDULED TO-TIME 'X'1D'...........T'TEMPORARY FROM-TIME'X'1E'...........T'TEMPORARY TO-TIME 'X'1F'...........T'TEMPORARY FROM-DATE'X'20'...........T'TEMPORARY TO-DATE '

(continued)

Terminal andOperator Data List

Page 335: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-35

Field Description

TMOPARMB Terminal or operator parameter value before update.

Default label-1: BEFOREField type: 02010000 - Terminal or operator data listInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

TMOPARMA Terminal or operator parameter value after update.

Default label-1: AFTERField type: 02010000 - Terminal or operator data listInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

TMOPSDAY Terminal or operator parameter day of the week.

Default label-1: DAYField type: 02010000 - Terminal or operator data listInput data length: 1Input data format: Character (C)Default output length: 10Default output format: Transformed (T)C'1'............T'SUNDAY 'C'2'............T'MONDAY 'C'3'............T'TUESDAY 'C'4'............T'WEDNESDAY 'C'5'............T'THURSDAY 'C'6'............T'FRIDAY 'C'7'............T'SATURDAY '

Page 336: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-36 Auditing and Report Writing Guide

The 02020000 segment fields allow you to produce a report showing changes to specific fieldsin a terminal or operator profile.

Field Description

TMOPFLAG Indicates before or after data value.

Default label-1: BEFOREDefault label-2: /AFTERField type: 02020000 - Terminal or operator data fieldsInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)C' '............T'N/A 'C'B'............T'BEFORE'C'A'............T'AFTER '

TMOPMODL Terminal or operator used as model.

Default label-1: MODELField type: 02020000 - Terminal or operator data fieldsInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

TMOPADMN Administrator who owns this terminal or operator.

Default label-1: ADMINSTRField type: 02020000 - Terminal or operator data fieldsInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

TMOPMSGF Message suffix for this terminal or operator.

Default label-1: MSDefault label-2: SFField type: 02020000 - Terminal or operator data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

Terminal andOperator DataFields

Page 337: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-37

Field Description

TMOPGRP Group to which this terminal belongs.

Default label-1: TERMDefault label-2: GRPField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPCOMP Company to which this terminal or operator belongs.

Default label-1: COMPField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPDIVN Division to which this terminal or operator belongs.

Default label-1: DIV.Field type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPDEPT Department to which this terminal or operator belongs.

Default label-1: DEPTField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPSECT Section to which this terminal or operator belongs.

Default label-1: SECTField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 338: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-38 Auditing and Report Writing Guide

Field Description

TMOPSTAT Status of this terminal or operator.

Default label-1: STATUSField type: 02020000 - Terminal or operator data fieldsInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)C'A'............T'ACTIVE 'C'D'............T'DISABLED 'C'P'............T'PRELOADED'C'V'............T'SUSPENDED'C'K'............T'KEEP '

TMOPSCOD Terminal or operator security code.

Default label-1: SECURITYDefault label-2: CODEField type: 02020000 - Terminal or operator data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TMOPSEFD Terminal or operator security code effective date.

Default label-1: SECURITYDefault label-2: CODEDefault label-3: EFF-DATEField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed(T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

TMOPNCOD Terminal or operator new security code.

Default label-1: NEWDefault label-2: SECURITYDefault label-3: CODEField type: 02020000 - Terminal or operator data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 339: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-39

Field Description

TMOPNEFD Terminal or operator new security code effective date.

Default label-1: NEWDefault label-2: SCTYCODEDefault label-3: EFF-DATEField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed(T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

TMOPROCT Terminal or operator process type.

Default label-1: PRDefault label-2: TPField type: 02020000 - Terminal or operator data fieldsInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)C'I'............T'INQUIRY 'C'U'............T'UPDATE '

TMOPITLM Terminal or operator inactive time limit.

Default label-1: INACDefault label-2: TIMEDefault label-3: LIMField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

TMOPTERM Terminal ID.

Default label-1: TERMField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 340: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-40 Auditing and Report Writing Guide

Field Description

TMOPLOGO Terminal logo suffix.

Default label-1: TMDefault label-2: LGDefault label-3: SFField type: 02020000 - Terminal or operator data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

TMOPHONE Terminal telephone number.

Default label-1: TERMINALDefault label-2: TELEPHONEDefault label-3: NUMBERField type: 02020000 - Terminal or operator data fieldsInput data length: 10Input data format: Character (C)Default output length: 14Default output format: Transformed (T)

TMOPTDIF Terminal time difference.

Default label-1: TERMDefault label-2: TIMEDefault label-3: DIFFField type: 02020000 - Terminal or operator data fieldsInput data length: 2Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

TMOPTSXP Terminal sign-on exemption.

Default label-1: TRMDefault label-2: SGNDefault label-3: EXMField type: 02020000 - Terminal or operator data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)C'Y'............T'YES'C'N'............T'NO '

(continued)

Page 341: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-41

Field Description

TMOPOSXP Terminal operator sign-on exemption.

Default label-1: OPRDefault label-2: SGNDefault label-3: EXMField type: 02020000 - Terminal or operator data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO 'C'O'............T'OPT'

TMOPVIOT Terminal violation reporting terminal.

Default label-1: VIOLDefault label-2: REPTDefault label-3: TERMField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPVIOP Terminal violation reporting printer.

Default label-1: VIOLDefault label-2: REPTDefault label-3: PRTRField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPERID User ID.

Default label-1: OPERATORDefault label-2: IDField type: 02020000 - Terminal or operator data fieldsInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

(continued)

Page 342: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-42 Auditing and Report Writing Guide

Field Description

TMOPERNM Name.

Default label-1: USER NAMEField type: 02020000 - Terminal or operator data fieldsInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

TMOPDEVC Operator's primary terminal.

Default label-1: OPERDefault label-2: PRIMDefault label-3: DEVCField type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPALT1 Operator's alternate terminal-1 (or alt-group3).

Default label-1: OPERDefault label-2: ALTDefault label-3: TRM1Field type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

TMOPALT2 Operator's alternate terminal-2 (or alt-group2).

Default label-1: OPERDefault label-2: ALTDefault label-3: TRM2Field type: 02020000 - Terminal or operator data fieldsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

Page 343: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-43

The 02030000 segment fields allow you to produce a report showing changes to specific fieldsin a user ID profile.

Field Description

USERSUB1 Submit user ID 1.

Default label-1: SUBMITDefault label-2: USERID-1Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERSUB2 Submit user ID 2.

Default label-1: SUBMITDefault label-2: USERID-2Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERSUB3 Submit user ID 3.

Default label-1: SUBMITDefault label-2: USERID-3Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERTBL1 Table one number.

Default label-1: TABLE-1Default label-2: NUMBERField type: 02030000 - User ID data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

(continued)

User ID Data Fields

Page 344: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-44 Auditing and Report Writing Guide

Field Description

USERTBL2 Table two number.

Default label-1: TABLE-2Default label-2: NUMBERField type: 02030000 - User ID data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

USERTBL3 Table three number.

Default label-1: TABLE-3Default label-2: NUMBERField type: 02030000 - User ID data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

USERTBL4 Table four number.

Default label-1: TABLE-4Default label-2: NUMBERField type: 02030000 - User ID data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

USERTBL5 Table five number.

Default label-1: TABLE-5Default label-2: NUMBERField type: 02030000 - User ID data fieldsInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

USERSEC1 SECID 1.

Default label-1: SECID-1Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 345: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-45

Field Description

USERSEC2 SECID 2.

Default label-1: SECID-2Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERSEC3 SECID 3.

Default label-1: SECID-3Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERSEC4 SECID 4.

Default label-1: SECID-4Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERSEC5 SECID 5.

Default label-1: SECID-5Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERIUID IUI ID.

Default label-1: IUI-IDField type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 346: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-46 Auditing and Report Writing Guide

Field Description

USERIUPW IUI password.

Default label-1: IUIDefault label-2: PASSWDField type: 02030000 - User ID data fieldsInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

USEREXSC External security (YES or NO).

Default label-1: EXTERNALDefault label-2: SECURITYField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USEREXMD External security model.

Default label-1: EXTERNALDefault label-2: SECURITYDefault label-3: MODELField type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERPWS Personal workstation (YES or NO).

Default label-1: PWSField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

(continued)

Page 347: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-47

Field Description

USERREM Remote submission (YES or NO).

Default label-1: REMField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USERACT Action.

Default label-1: ACTIONField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

USERMON Monitor code.

Default label-1: MONITORDefault label-2: CODEField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

USERCON Master console (YES or NO).

Default label-1: CONField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

(continued)

Page 348: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Terminal and Operator Profile Fields Fieldname List

7-48 Auditing and Report Writing Guide

Field Description

USERCLB Controlled library (YES or NO).

Default label-1: CLBField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USEREXID External ID.

Default label-1: EXTERNALDefault label-2: IDField type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERUPST User profile status.

Default label-1: UPDefault label-2: STATField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE 'C'D'............T'DISABLED 'C'P'............T'PRELOADED'C'V'............T'SUSPENDED'C'K'............T'KEEP '

USERUDAT User-defined data.

Default label-1: USERDefault label-2: DATAField type: 02030000 - User ID data fieldsInput data length: 10Input data format: Character (C)Default output length: 10Default output format: Character (C)

(continued)

Page 349: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Terminal and Operator Profile Fields

Chapter 7. ALRTVCAU Audit File Report 7-49

Field Description

USERUDA2 User-defined data 2.

Default label-1: USERDefault label-2: DATA 2Field type: 02030000 - User ID data fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USERCICS CICS user (YES or NO).

Default label-1: CICSField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USERBAT Batch user (YES or NO).

Default label-1: BATCHField type: 02030000 - User ID data fieldsInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

USERBEXP Batch user expire date

Default label-1: BATCHDefault label-1: EXP-DATEField type: 02030000 - User ID data fieldsInput data length: 4Input data format: Hexidecimal (X)Default output length: 10Default output format: Transformed (T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

Page 350: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-50 Auditing and Report Writing Guide

Secured Resource Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile resource update records (segment X'030x0000'). These fields will be printed only onreport detail lines with other resource update record and common segment fieldnames.

Field Description

RESCTYPE Resource type (transaction, program, file, map, or field).

Default label-1: RESOURCEDefault label-2: TYPEField type: 03000000 - Secured resource updateInput data length: 2Input data format: Character (C)Default output length: 11Default output format: Transformed (T)

C'TR'...........T'TRANSACTION'C'PR'...........T'PROGRAM 'C'FF'...........T'FIELD 'C'FL'...........T'FILE 'C'MP'...........T'MAP '

RESCACTN Type of action (add or update).

Default label-1: ADDDefault label-2: ORDefault label-3: UPDATEField type: 03000000 - Secured resource updateInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'............T'ADD 'C'U'............T'UPDATE'

Page 351: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-51

The 03010000 segment records can be used to produce a report showing all before and afterinformation logged as a result of adding or updating any resource (transaction, program, file,or map) data with the online panels.

Field Description

RESPARMD Resource parameter description.

Default label-1: RESOURCEDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 03010000 - Secured resource information listInput data length: 1Input data format: Hexadecimal (X)Default output length: 21Default output format: Transformed (T)

X'01'......'NAME 'X'02'......'STATUS 'X'03'......'DESCRIPTION 'X'04'......'TRANSACTION FROM-TIME 'X'05'......'TRANSACTION TO-TIME 'X'06'......'PROGRAM FROM-TIME 'X'07'......'PROGRAM TO-TIME 'X'08'......'FILE FROM-TIME 'X'09'......'FILE TO-TIME 'X'0A'......'FILE ACCESS LEVEL 'X'0B'......'MAP FIELD NUMBER 'X'0C'......'MAP FIELD DISPLAY 'X'0D'......'MAP FIELD TITLE 'X'0E'......'FIELD REAL RESOURCE 'X'0F'......'FIELD RECORD FORMAT 'X'10'......'FIELD ADD ACTION 'X'11'......'FIELD BROWSE ACTION 'X'12'......'FIELD BROWSE RETURN CODE'X'13'......'FIELD BROWSE RECORD POS 'X'14'......'FIELD DELETE ACTION 'X'15'......'FIELD READ ACTION 'X'16'......'FIELD READ RETURN CODE 'X'17'......'FIELD READ RECORD POS'N 'X'18'......'FIELD UPDATE ACTION 'X'19'......'NUMBER OF SEGMENTS 'X'1A'......'FIELD DESCRIPTION 'X'1B'......'DATA POSITION 'X'1C'......'DATA LENGTH 'X'1D'......'DATA FORMAT 'X'1E'......'COMPARE OPERATOR 'X'1F'......'LOGICAL CONNECTOR 'X'20'......'DATA VALUE 'X'21'......'DATA VALUE 2 '

(continued)

Secured ResourceInformation List

Page 352: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-52 Auditing and Report Writing Guide

Field Description

RESPARMB Resource parameter value before update.

Default label-1: BEFOREField type: 03010000 - Secured resource information listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

RESPARMA Resource parameter value after update.

Default label-1: AFTERField type: 03010000 - Secured resource information listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

The 03020000 segment information can be used to produce reports about specific fields thatcan be updated in the resource records.

Field Description

RESCFLAG Indicates before or after data value.

Default label-1: BEFOREDefault label-2: /AFTERField type: 03020000 - Secured resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C' '............T'N/A 'C'B'............T'BEFORE'C'A'............T'AFTER '

RESCNAME Resource name.

Default label-1: RESOURCEDefault label-2: NAMEField type: 03020000 - Secured resource field valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Secured ResourceField Values

Page 353: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-53

Field Description

RESCTRAN Transaction ID.

Default label-1: TRANDefault label-2: IDField type: 03020000 - Secured resource field valuesInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RESCPROG Program name.

Default label-1: PROGRAMDefault label-2: NAMEField type: 03020000 - Secured resource field valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESCFILE File name.

Default label-1: FILEDefault label-2: NAMEField type: 03020000 - Secured resource field valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESCMAP Map name.

Default label-1: MAPDefault label-2: NAMEField type: 03020000 - Secured resource field valuesInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

RESMPSET Mapset name.

Default label-1: MAPSETDefault label-2: NAMEField type: 03020000 - Secured resource field valuesInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

(continued)

Page 354: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-54 Auditing and Report Writing Guide

Field Description

RESMPREF Map reference number.

Default label-1: MAPDefault label-2: REFDefault label-3: NUMField type: 03020000 - Secured resource field valuesInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

RESDESCR Resource description.

Default label-1: DESCRIPTIONField type: 03020000 - Secured resource field valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

RESCSTAT Resource status.

Default label-1: STATUSField type: 03020000 - Secured resource field valuesInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'A'............T'ACTIVE 'C'D'............T'DISABLED 'C'P'............T'PRELOADED'C'M'............T'MONITOR 'C'S'............T'SAFE '

RESFRTIM Resource "from" time.

Default label-1: FROMDefault label-2: TIMEField type: 03020000 - Secured resource field valuesInput data length: 4Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

(continued)

Page 355: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-55

Field Description

RESTOTIM Resource "to" time.

Default label-1: TODefault label-2: TIMEField type: 03020000 - Secured resource field valuesInput data length: 4Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

RESCFLAC File access level.

Default label-1: INQUIRYDefault label-2: ORDefault label-3: UPDATEField type: 03020000 - Secured resource field valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'I'............T'INQUIRY'C'U'............T'UPDATE '

RESFDRES Field resource name.

Default label-1: FIELDDefault label-2: RESOURCEDefault label-3: NAMEField type: 03020000 - Secured resource field valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESRNAME Real resource.

Default label-1: FIELDDefault label-2: REALDefault label-3: RESOURCEField type: 03020000 - Secured resource field valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 356: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-56 Auditing and Report Writing Guide

Field Description

RESMAPF# Map field number.

Default label-1: MAPDefault label-2: FLDDefault label-3: NBRField type: 03020000 - Secured resource field valuesInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

RESMAPFD Map field display indicator.

Default label-1: MAPDefault label-2: FLDDefault label-3: DSPField type: 03020000 - Secured resource field valuesInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'............T'YES'C'N'............T'NO '

RESMAPFT Map field title.

Default label-1: MAPDefault label-2: FIELDDefault label-3: TITLEField type: 03020000 - Secured resource field valuesInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

Page 357: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-57

The type 03040000 fields allow you to select and print the data that makes up the fieldresource definitions for files. The type 03040100 fields allow you to select and print the datathat makes up the segments in a field resource definition for a file.

Field Description

RESFRFMT Field record format.

Default label-1: FIELDDefault label-2: RECORDDefault label-3: FORMATField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'F'......'FIXED 'C'V'......'VARIABLE'

RESFAACT Field ADD action.

Default label-1: FIELDDefault label-2: ADDDefault label-3: ACTIONField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'......'ALLOW 'C'R'......'RETURN CODE'C'V'......'VIOLATION '

RESFBACT Field BROWSE action.

Default label-1: FIELDDefault label-2: BROWSEDefault label-3: ACTIONField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'......'ALLOW 'C'R'......'RETURN CODE'C'V'......'VIOLATION '

(continued)

Field ResourceField Values forFiles

Page 358: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-58 Auditing and Report Writing Guide

Field Description

RESFBRET Field BROWSE return code.

Default label-1: FIELDDefault label-2: BROWSEDefault label-3: RET-CDField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

RESFBRPO Field BROWSE record position.

Default label-1: FIELDDefault label-2: BROWSEDefault label-3: REC-POField type: 03040000 - Field resource field valuesInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

RESFRACT Field DELETE action.

Default label-1: FIELDDefault label-2: DELETEDefault label-3: ACTIONField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'.....'ALLOW 'C'R'.....'RETURN CODE'C'V'.....'VIOLATION '

RESFDACT Field READ action.

Default label-1: FIELDDefault label-2: READDefault label-3: ACTIONField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'.....'ALLOW 'C'R'.....'RETURN CODE'C'V'.....'VIOLATION '

(continued)

Page 359: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-59

Field Description

RESFRRET Field READ return code.

Default label-1: FIELDDefault label-2: READDefault label-3: RET-CDField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Hexadecimal (X)

RESFRRPO Field READ record position.

Default label-1: FIELDDefault label-2: READDefault label-3: REC-POField type: 03040000 - Field resource field valuesInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

RESFUACT Field UPDATE-1: FIELDDefault label-2: UPDATEDefault label-3: ACTIONField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'.....'ALLOW 'C'R'.....'RETURN CODE'C'V'.....'VIOLATION '

RESF#SEG Number of segments.

Default label-1: NUMDefault label-2: OFDefault label-3: SEGSField type: 03040000 - Field resource field valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 1Default output format: Zoned decimal (Z)

(continued)

Page 360: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-60 Auditing and Report Writing Guide

Field Description

RESFDESC Field description.

Default label-1: FIELDDefault label-2: DESCRIPTIONField type: 03040100 - Field resource segmentsInput data length: 15Input data format: Character (C)Default output length: 15Default output format: Character (C)

RESFDPOS Data position.

Default label-1: DATADefault label-2: POSITIONField type: 03040100 - Field resource segmentsInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

RESFDLEN Data length.

Default label-1: DATADefault label-2: LENGTHField type: 03040100 - Field resourcesegmentsInput data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

RESFDFMT Data format.

Default label-1: DATADefault label-2: FORMATField type: 03040100 - Field resource segmentsInput data length: 1Input data format: Character (C)Default output length: 11Default output format: Character (C)

C'C'.....'CHARACTER 'C'P'.....'PACKED 'C'X'.....'HEXADECIMAL'

(continued)

Page 361: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-61

Field Description

RESFDCOM Compare operator.

Default label-1: COMPAREDefault label-2: OPERATORField type: 03040100 - Field resource segmentsInput data length: 1Input data format: Hexadecimal (X)Default output length: 11Default output format: Character (C)

X'C3'.....'CHARACTER 'X'D7'.....'PACKED 'X'E7'.....'HEXADECIMAL'

RESFCONN Logical connector.

Default label-1: LOGICALDefault label-2: CONNECTORField type: 03040100 - Field resource segmentsInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Character (C)

X'80'.....'AND'X'40'.....'OR'

RESFVALU Data value.

Default label-1: DATADefault label-2: VALUEField type: 03040100 - Field resource segmentsInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

RESFVAL2 Data value 2.

Default label-1: DATADefault label-2: VALUEField type: 03040100 - Field resource segmentsInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

(continued)

Page 362: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-62 Auditing and Report Writing Guide

The type 03050000 fields allow you to select and print the data that makes up the fieldresource definitions for maps. The type 03050100 fields allow you to select and print the datathat makes up the segments in a field resource definition for a map.

Field Description

RESMMSET Field mapset name.

Default label-1: FIELDDefault label-2: MAPSETDefault label-3: NAMEField type: 03050000 - Field resource segmentsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESM#SEG Number of segments.

Default label-1: NUMDefault label-2: OFDefault label-3: SEGSField type: 03050000Input data length: 1Input data format: Hexadecimal (X)Default output length: 1Default output format: Zoned decimal (Z)

RESMDESC Field description.

Default label-1: FIELDDefault label-2: DESCRIPTIONField type: 03050100Input data length: 15Input data format: Character (C)Default output length: 15Default output format: Character (C)

RESMROW Field row.

Default label-1: FLDDefault label-2: ROWField type: 03050100Input data length: 1Input data format: Hexadecimal (X)Default output length: 2Default output format: Zoned decimal (Z)

(continued)

Field ResourceField Values forMaps

Page 363: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Fields

Chapter 7. ALRTVCAU Audit File Report 7-63

Field Description

RESMCOL Field column.

Default label-1: FLDDefault label-2: COLField type: 03050100Input data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Zoned decimal (Z)

RESMDLEN Data length.

Default label-1: DATADefault label-2: LENGTHField type: 03050100Input data length: 2Input data format: Hexadecimal (X)Default output length: 5Default output format: Zoned decimal (Z)

RESMDCOM Compare operator.

Default label-1: COMPAREDefault label-2: OPERATORField type: 03050100Input data length: 1Input data format: Hexadecimal (X)Default output length: 11Default output format: Character (C)

X'C3'.....'CHARACTER 'X'D7'.....'PACKED 'X'E7'.....'HEXADECIMAL'

RESMCONN Logical connector.

Default label-1: LOGICALDefault label-2: CONNECTORField type: 03050100 - Field resource segmentsInput data length: 1Input data format: Hexadecimal (X)Default output length: 3Default output format: Character (C)

X'80'.....'AND'X'40'.....'OR'

(continued)

Page 364: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Fields Fieldname List

7-64 Auditing and Report Writing Guide

Field Description

RESMVALU Data value.

Default label-1: DATADefault label-2: VALUEField type: 03050100 - Field resource segmentsInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

RESMVAL2 Data value 2.

Default label-1: DATADefault label-2: VALUEField type: 03050100 - Field resource segmentsInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 365: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Authorization Fields

Chapter 7. ALRTVCAU Audit File Report 7-65

Secured Resource Authorization Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile secured resource authorization records (segment X'040x0000'). These fields will beprinted only on report detail lines with other secured resource authorization and commonsegment fieldnames.

Field Description

AUTHIDTP Type of ID affected (terminal or operator).

Default label-1: TERMINALDefault label-2: ORDefault label-3: OPERATORField type: 04000000 - Secured Resource AuthorizationInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'O'............T'OPERATOR'C'T'............T'TERMINAL'

AUTHMODE Mode of update (batch or online).

Default label-1: NoneField type: 04000000 - Secured Resource AuthorizationInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'B'............T'BATCH 'C'O'............T'ONLINE'

AUTHTYPE Type of resource (transaction, program, file, map, or field).

Default label-1: RESOURCEDefault label-2: TYPEField type: 04000000 - Secured Resource AuthorizationInput data length: 2Input data format: Character (C)Default output length: 11Default output format: Transformed (T)

C'TR'............T'TRANSACTION'C'PR'............T'PROGRAM 'C'FL'............T'FILE 'C'FS' ...........T'FIELD 'C'MP'............T'MAP '

(continued)

Page 366: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Secured Resource Authorization Fields Fieldname List

7-66 Auditing and Report Writing Guide

Field Description

AUTHACT Type of action (add or delete).

Default label-1: ADDDefault label-2: ORDefault label-3: DELETEField type: 04000000 - Secured Resource AuthorizationInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'............T'ADD 'C'U'............T'DELETE'

The 04010000 segment records can be used to produce more specific reports concerningadding resources to or deleting resources from operators and terminals.

Field Description

AUTHID ID of terminal or operator affected.

Default label-1: UPDATEDDefault label-2: IDField type: 04010000 - Secured resource authorization listsInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

AUTHOPER Name of operator affected.

Default label-1: OPERATORDefault label-2: NAMEField type: 04010000 - Secured resource authorization listsInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

(continued)

Secured ResourceAuthorization Lists

Page 367: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Secured Resource Authorization Fields

Chapter 7. ALRTVCAU Audit File Report 7-67

Field Description

AUTHLIST List of resources updated.

Default label-1: RESOURCEDefault label-2: LISTField type: 04010000 - Secured resource authorization listsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

AUTHALTR List of ALERT transactions updated.

Default label-1: ALRTDefault label-2: TRANDefault label-3: LISTField type: 04010000 - Secured resource authorization listsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

AUTHFLAC Updated file access level (inquiry or update).

Default label-1: FILEDefault label-2: ACCESSDefault label-3: LEVELField type: 04010000 - Secured resource authorization listsInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'I'............T'INQUIRY'C'U'............T'UPDATE '

AUTHMPRF Map reference number of affected maps.

Default label-1: MAPDefault label-2: REFRDefault label-3: NMBRField type: 04010000 - Secured resource authorization listsInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

Page 368: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Activation and Deactivation Fields Fieldname List

7-68 Auditing and Report Writing Guide

Activation and Deactivation Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile activation and deactivation records (segment X'05000000'). These fields will be printedonly on report detail lines with other activation or deactivation record and common segmentfieldnames.

Field Description

ACTVSTAT Status of resource after update.

Default label-1: NEWDefault label-1: STATUSField type: 05000000 - Activate or deactivate informationInput data length: 1Input data format: Character (C)Default output length: 12Default output format: Transformed (T)

C'A'............T'ACTIVATED 'C'D'............T'DE-ACTIVATED'

The 05010000 segment information can be used to produce reports about specific resources orresource types that have been activated or deactivated.

Field Description

ACTVTYPE Type of resource activated or deactivated.

Default label-1: RESOURCEDefault label-2: TYPEField type: 05010000 - Activate or deactivate informationInput data length: 1Input data format: Character (C)Default output length: 11Default output format: Transformed (T)

C'R'............T'FIELD RSRC 'C'T'............T'TRANSACTION'C'P'............T'PROGRAM 'C'F'............T'FILE 'C'M'............T'MAP 'C'R'............T'FIELD 'C'D'............T'TERMINAL 'C'O'............T'OPERATOR '

(continued)

Activation andDeactivation DataFields

Page 369: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Activation and Deactivation Fields

Chapter 7. ALRTVCAU Audit File Report 7-69

Field Description

ACTVTRAN Transaction ID activated or deactivated.

Default label-1: TRANField type: 05010000 - Activate or deactivate informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

ACTVPROG Program activated or deactivated.

Default label-1: PROGRAMField type: 05010000 - Activate or deactivate informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

ACTVFILE File activated or deactivated.

Default label-1: FILENAMEField type: 05010000 - Activate or deactivate informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

ACTVMAP Map name activated or deactivated.

Default label-1: MAPNAMEField type: 05010000 - Activate or deactivate informationInput data length: 7Input data format: Character (C)Default output length: 7Default output format: Character (C)

ACTVMAP# Map reference number activated or deactivated.

Default label-1: MAPDefault label-2: REFField type: 05010000 - Activate or deactivate informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

(continued)

Page 370: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Activation and Deactivation Fields Fieldname List

7-70 Auditing and Report Writing Guide

Field Description

ACTVNAME Terminal or operator ID activated or deactivated.

Default label-1: AFFECTEDDefault label-2: IDField type: 05010000 - Activate or deactivate informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

ACTVTERM Terminal activated or deactivated.

Default label-1: TERMField type: 05010000 - Activate or deactivate informationInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

ACTVOPER Operator activated or deactivated.

Default label-1: OPERATORField type: 05010000 - Activate or deactivate informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

ACTVFLDN Field resource activated or deactivated.

Default label-1: FIELDDefault label-2: RESOURCEField type: 05010000 - Activate or deactivate informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

ACTVFLDR Field real resource activated or deactivated.

Default label-1: REALDefault label-2: RESOURCEField type: 05010000 - Activate or deactivate informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 371: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Administrator Maintenance Fields

Chapter 7. ALRTVCAU Audit File Report 7-71

Administrator Maintenance Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile administrator maintenance records (segment X'06000000'). These fields will be printedonly on report detail lines with other administrator maintenance and common segmentfieldnames.

Field Description

ADMCTYPE Administrator change type (terminal or operator).

Default label-1: TERMINALDefault label-2: ORDefault label-3: OPERATORField type: 06000000 - Administrator maintenance informationInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'D'............T'TERMINAL'C'O'............T'OPERATOR'

ADMCACT Administrator change action (change or reclaim).

Default label-1: CHANGEDefault label-2: ORDefault label-3: RECLAIMField type: 06000000 - Administrator maintenance informationInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'C'............T'CHANGE 'C'R'............T'RECLAIM'

Page 372: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Administrator Maintenance Fields Fieldname List

7-72 Auditing and Report Writing Guide

The 06010000 segment records can be used to produce reports on specific administratormaintenance activity logged as a result of using the administrator change and reclaimfunctions ADCT, ADRT, ADCO, and ADRO.

Field Description

ADMCNAME Administrator change: affected terminal or operator.

Default label-1: AFFECTEDDefault label-2: IDField type: 06010000 - Administrator maintenance data valuesInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

ADMCTERM Administrator change: terminal ID.

Default label-1: ADMNDefault label-2: CHNGDefault label-3: TERMField type: 06010000 - Administrator maintenance data valuesInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

ADMCOPER Administrator change: operator ID.

Default label-1: ADMINSTRDefault label-2: CHANGEDefault label-3: OPERATORField type: 06010000 - Administrator maintenance data valuesInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

ADMCFROM Administrator change: original administrator.

Default label-1: ADMINSTRDefault label-2: CHANGEDDefault label-3: FROMField type: 06010000 - Administrator maintenance data valuesInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

(continued)

AdministratorMaintenance FieldsData Values

Page 373: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Administrator Maintenance Fields

Chapter 7. ALRTVCAU Audit File Report 7-73

Field Description

ADMCINTO Administrator change: new administrator.

Default label-1: ADMINSTRDefault label-2: CHANGEDDefault label-3: TOField type: 06010000 - Administrator maintenance data valuesInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

ADMCSTAT Administrator change status: temporary or permanent.

Default label-1: TEMPORARYDefault label-2: ORDefault label-3: PERMANENTField type: 06010000 - Administrator maintenance data valuesInput data length: 1Input data format: Character (C)Default output length: 9Default output format: Transformed (T)

C'T'............T'TEMPORARY'C'P'............T'PERMANENT'

Page 374: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Location Information Fields Fieldname List

7-74 Auditing and Report Writing Guide

Location Information Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile location records segment (X'070x0000'). These fields will be printed only on report detaillines with other location record and common segment fieldnames.

Field Description

LOCTYPE Location type (company, division, department, or section).

Default label-1: LOCATIONDefault label-2: TYPEField type: 07000000 - Location ID maintenanceInput data length: 2Input data format: Character (C)Default output length: 10Default output format: Transformed (T)

C'CO'...........T'COMPANY 'C'DI'...........T'DIVISION 'C'DP'...........T'DEPARTMENT'C'SC'...........T'SECTION '

LOCACT Location activity (add or update).

Default label-1: ADDDefault label-2: ORDefault label-3: UPDATEField type: 07000000 - Location ID maintenanceInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C'A'............T'ADD 'C'U'............T'UPDATE'

Page 375: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Location Information Fields

Chapter 7. ALRTVCAU Audit File Report 7-75

The 07010000 segment information can be used to produce very specific reports of changes tolocation information.

Field Description

LOCPARMD Location parameter description.

Default label-1: LOCATIONDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 07010000 - Location ID information listInput data length: 1Input data format: Hexadecimal (X)Default output length: 15Default output format: Transformed (T)

X'01'......'LOCATION TYPE 'X'02'......'LOCATION ID 'X'03'......'LOCATION STATUS'X'03'......'LOCATION NAME '

LOCPARMB Location parameter value before update.

Default label-1: BEFOREField type: 07010000 - Location ID information listInput data length: 35Input data format: Character (C)Default output length: 35Default output format: Character (C)

LOCPARMA Location parameter value after update.

Default label-1: AFTERField type: 07010000 - Location ID information listInput data length: 35Input data format: Character (C)Default output length: 35Default output format: Character (C)

LOCFLAG Indicates before or after data.

Default label-1: BEFOREDefault label-2: /AFTERField type: 07010000 - Location ID information listInput data length: 1Input data format: Character (C)Default output length: 6Default output format: Transformed (T)

C' '............T'N/A 'C'B'............T'BEFORE'C'A'............T'AFTER '

(continued)

Location IDInformation List

Page 376: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Location Information Fields Fieldname List

7-76 Auditing and Report Writing Guide

Field Description

LOCID ID of location being changed.

Default label-1: LOCATIONDefault label-2: IDField type: 07020000 - Location ID field valuesInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

LOCSTAT Location status.

Default label-1: LOCATIONDefault label-2: STATUSField type: 07010000 - Location ID information listInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'............T'ACTIVE 'C'D'............T'DISABLED'

LOCNAME Location name.

Default label-1: LOCATIONDefault label-2: NAMEField type: 07010000 - Location ID information listInput data length: 35Input data format: Character (C)Default output length: 35Default output format: Character (C)

Page 377: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Password Change Field

Chapter 7. ALRTVCAU Audit File Report 7-77

Password Change Field

The following fieldname can be included in any ALRTVCAU report SUBTITLE, FIELD, orFIELDS command statements. This fieldname is contained in the ALRTVCAU input fileoperator password change records (OPWD) (segment X'08000000'). This field will be printedonly on report detail lines with other operator password change record and common segmentfieldnames.

Field Description

OPWDOPER Operator whose password was changed. (This field was formerlyOPWDCHBY.)

Default label-1: OPERATORDefault label-2: PASSWORDDefault label-3: CHANGEDField type: 08000000 - Security code change informationInput data length: 9Input data format: Character (C)Default output length: 9Default output format: Character (C)

Page 378: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Program Refresh Fields Fieldname List

7-78 Auditing and Report Writing Guide

Program Refresh Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile program refresh records (REFR) (segment X'09000000'). These fields will be printed onlyon report detail lines with other program refresh records and common segment fieldnames.

Field Description

REFRPROG Refreshed program name.

Default label-1: REFRESHDDefault label-2: PROGRAMDefault label-3: NAMEField type: 09000000 - Program refresh informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

REFPRTYP Refreshed program type.

Default label-1: REFRESHDDefault label-2: PROGRAMDefault label-3: TYPEField type: 09000000 - Program refresh informationInput data length: 1Input data format: Character (C)Default output length: 12Default output format: Transformed (T)

C'M'............T'MONITOR PROG'C'E'............T'EXIT PROGRAM'C'L'............T'LOGO PROGRAM'

Page 379: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Optional Zap Fields

Chapter 7. ALRTVCAU Audit File Report 7-79

Optional Zap Fields

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVCAU inputfile optional zap records (VERS) (segment X'09000000'). These fields will be printed only onreport detail lines with other optional zap records and common segment fieldnames.

Field Description

OPTZAPB Optional zap information before change.

Default label-1: OPTIONALDefault label-2: ZAP INFODefault label-3: (BEFORE)Field type: 0A000000 - Optional zap informationInput data length: 15Input data format: Hexadecimal (X)Default output length: 30Default output format: Hexadecimal (X)

OPTZAPA Optional zap information after change.

Default label-1: OPTIONALDefault label-2: ZAP INFODefault label-3: (AFTER)Field type: 0A000000 - Optional zap informationInput data length: 15Input data format: Hexadecimal (X)Default output length: 30Default output format: Hexadecimal (X)

Page 380: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Record Dump Information Fieldname List

7-80 Auditing and Report Writing Guide

Record Dump Information

The following fieldnames can be included in any ALRTVCAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are not themselves contained in any ofthe records in the audit file, but they will be included in the report if the FILEDUMPcommand is executed to get a listing of the audit records (diagnostic information). Thesefields are assigned a special segment ID of X'FF000000'.

Field Description

OFFSET Offset into record.

Default label-1: NoneField type: FF000000 - Record dump informationInput data length: 2Input data format: Hexadecimal (X)Default output length: 4Default output format: Hexadecimal (X)

RECORD Record data in hexadecimal and character format.

Default label-1: NoneField type: FF000000 - Record dump informationInput data length: 34Input data format: Hexadecimal (X)Default output length: 72Default output format: Transformed (T)

Page 381: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Introduction

Chapter 7. ALRTVCAU Audit File Report 7-81

Sample ALRTVCAU Reports

Introduction

Many different reports can be produced from the information in the BIM-ALERT/CICS auditfile, depending on which types of changes to security you want to review. This sectionincludes sample input commands and resulting output for a number of such reports. Thesesample reports should be considered examples from which further reports can be designed;they are not intended to be an exhaustive treatment of all reports that can be produced usingthe audit data.

The input statements of the sample ALRTVCAU reports that follow can be found in the BIM-ALERT installation library in member ALRTVCAU.J.

System Options Update Report

The following sample input can be used to produce a report showing changes to the current orpermanent options, changes which affect the type of security processing BIM-ALERT/CICSperforms.

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU LINELEN(80) SUBTITLE DATE LINE(2) LABEL('DATE:') CTLBREAK(P) SUBTITLE ADMINID LINE(2) LABEL(' ADMIN ID:') JUSTIFY(C) LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') JUSTIFY(R) LENGTH(8) - FORMAT(C) SUBTITLE TIME LINE(3) LABEL('TIME:') CTLBREAK(P) SUBTITLE ADMINAME LINE(3) LABEL('ADMIN NAME:') JUSTIFY(C) LENGTH(20) SUBTITLE SYSTEMID LINE(3) LABEL(' SYSID:') JUSTIFY(R) SUBTITLE TRANDESC LINE(4) LABEL('ACTION:') SUBTITLE LITERAL('= ') LINE(5) LENGTH(30) SUBTITLE LITERAL('SECURITY OPTIONS') LINE(5) JUSTIFY(C) SUBTITLE LITERAL('= ') LINE(5) LENGTH(30) JUSTIFY(R) FIELD PARMVALD LABELS(N) JUSTIFY(L) FILLCHAR(.) LENGTH(32) FIELD PARMVALB LABEL(BEFORE) JUSTIFY(C) FIELD PARMVALA LABEL(AFTER) JUSTIFY(C) SELECT IF TRANID EQ C'UCOP' OR TRANID EQ C'UPOP' RUN/*

Input

Page 382: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Options Update Report Sample ALRTVCAU Reports

7-82 Auditing and Report Writing Guide

The preceding sample input produces the following report:

DATE: 03/23/1998 12:34:49 PAGE: 000002 ** BIM-ALERT/CICS AUDIT INFORMATION **

DATE: 02/25/1998 ADMIN ID: FLL FUNCTION: UCOPTIME: 14:40 ADMIN NAME: LINTON, FRED SYSID: VSE1CICSACTION: UPDATE CURRENT OPTIONS= = = = = = = = = = = = = = = SECURITY OPTIONS = = = = = = = = = = = = = = = BEFORE AFTER ------ ----- SYSTEM TRAN SECURITY............ ON OFF SYSTEM PROG SECURITY............ OFF OFF SYSTEM FILE SECURITY............ OFF OFF TERMINAL TRAN SECURITY.......... OFF OFF TERMINAL PROG SECURITY.......... OFF OFF TERMINAL FILE SECURITY.......... OFF OFF TERMINAL MAP SECURITY........... OFF OFF OPERATOR TRAN SECURITY.......... ON OFF OPERATOR PROG SECURITY.......... ON OFF OPERATOR FILE SECURITY.......... ON OFF OPERATOR MAP SECURITY........... OFF OFF VIOLATION AUDITING.............. OFF OFF TERMINAL SCHEDULING............. OFF OFF

DATE: 03/23/1998 12:34:49 PAGE: 000003 ** BIM-ALERT/CICS AUDIT INFORMATION **

DATE: 02/26/1998 ADMIN ID: A FUNCTION: UCOPTIME: 06:49 ADMIN NAME: N/A-ALERT NOT ACTIVE SYSID: VSE1CICSACTION: UPDATE CURRENT OPTIONS= = = = = = = = = = = = = = = SECURITY OPTIONS = = = = = = = = = = = = = = = BEFORE AFTER ------ ----- SYSTEM TRAN SECURITY............ OFF ON SYSTEM PROG SECURITY............ OFF OFF SYSTEM FILE SECURITY............ OFF OFF TERMINAL TRAN SECURITY.......... OFF OFF TERMINAL PROG SECURITY.......... OFF OFF TERMINAL FILE SECURITY.......... OFF OFF TERMINAL MAP SECURITY........... OFF OFF OPERATOR TRAN SECURITY.......... OFF ON OPERATOR PROG SECURITY.......... OFF ON OPERATOR FILE SECURITY.......... OFF ON OPERATOR MAP SECURITY........... OFF OFF VIOLATION AUDITING.............. OFF OFF TERMINAL SCHEDULING............. OFF OFF

Output

Page 383: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports System Parameter Change Report

Chapter 7. ALRTVCAU Audit File Report 7-83

System Parameter Change Report

The following sample input can be used to produce a report showing all changes made to thesystem parameters. Because of the specified SELECT IF command, only those parametersthat have been changed using the UPAR transaction will be included in the resulting report.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVCAU TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') SUBTITLE PARMTYPE LINE(2) JUSTIFY(C) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANDESC LINE(3) LABEL('ACTION :') SUBTITLE LITERAL('=') LINE(4) LENGTH(132) SUBTITLE LITERAL(' SECURITY PARAMETERS ') LINE(4) JUSTIFY(C) FIELD DATE LABEL(DATE) CTLBREAK(S) FIELD TIME LABEL(TIME) CTLBREAK(S) FIELD PARMVALD LABEL(N) JUSTIFY(L) FILLCHAR(.) LENGTH(40) FIELD PARMVALB LABEL(<BEFORE) JUSTIFY(L) FIELD PARMVALA LABEL(<AFTER) JUSTIFY(L) SELECT IF PARMVALB NE PARMVALA AND TRANID EQ C'UPAR' RUN/*

The preceding sample input produces the following report:

DATE: 03/23/1998 12:48:58 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : VSE1CICS ADMIN ID : FLLFUNCTION: UPAR SYSTEM PARAMETER ADMIN NAME: LINTON, FREDACTION : UPDATE SYSTEM PARMS======================================================= SECURITY PARAMETERS ======================================================== DATE TIME BEFORE AFTER ---- ---- ------ ----- 02/05/1998 13:58 DATE FORMAT............................. U C 02/05/1998 13:59 DATE FORMAT............................. C E 02/05/1998 14:00 DATE FORMAT............................. E U 02/06/1998 07:13 DATE FORMAT............................. U C 02/06/1998 07:13 DATE FORMAT............................. C E 02/06/1998 07:14 DATE FORMAT............................. E U 02/06/1998 15:56 DATE FORMAT............................. U C 02/11/1998 17:17 FORCE DELAY TIME........................ 0001 0000 02/12/1998 12:09 DATE FORMAT............................. U C 02/12/1998 13:28 DATE FORMAT............................. C U 02/16/1998 14:37 CONTROL SUFFIX.......................... 2 1 02/16/1998 16:31 CONTROL SUFFIX.......................... 1 2 02/20/1998 14:25 DATE FORMAT............................. U E 02/20/1998 14:51 DATE FORMAT............................. E C 02/25/1998 12:05 DYNAMIC TERMINALS....................... 00000 00020 02/25/1998 12:09 DATE FORMAT............................. C U 03/04/1998 08:43 DATE FORMAT............................. U C 03/04/1998 08:44 GROUP STAT/MAX VIOL..................... V A 03/04/1998 08:44 DATE FORMAT............................. C U 03/04/1998 08:45 USER SVC................................ 255 . 03/04/1998 12:49 CONSOLE VIOL DISPLAY.................... NO YES 03/04/1998 15:41 CONSOLE VIOL DISPLAY.................... YES NO 03/04/1998 16:18 DATE FORMAT............................. U C 03/10/1998 08:55 DATE FORMAT............................. C U

Input

Output

Page 384: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

System Parameter Update Report Sample ALRTVCAU Reports

7-84 Auditing and Report Writing Guide

System Parameter Update Report

The following sample input can be used to produce a report showing all data logged byexecuting the UPAR function to update system parameters.

Note that this report, unlike the previous report, will include all data logged, whether or not itwas changed, because no comparison of data fields is specified in the SELECT IF command.

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') SUBTITLE PARMTYPE LINE(2) JUSTIFY(C) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANDESC LINE(3) LABEL('FUNCTION:') SUBTITLE LITERAL('=') LINE(4) LENGTH(132) SUBTITLE LITERAL(' SECURITY PARAMETERS ') LINE(4) JUSTIFY(C) FIELD DATE CTLBREAK(S) FIELD TIME CTLBREAK(S) FIELD PARMFLAG LABELS(NO) LENGTH(3) FIELDS MAXVIOLA MAXCONSC CTRLSUFX EXTRAENT - USEREXIT DYNATERM DUMMYTRM USERSVC NEWCODEN AGENCODE - ALLTERMS ALLTRANS ALLPROGS ALLFILES FORCEDEL FORCEDSP - OSTATMAX GSTATMAX MSGDELAY DATEFORM CONSVIOL UNSECTRM SELECT IF TRANID EQ C'UPAR' RUN/*

The preceding sample input produces the following report:

DATE: 03/23/1998 13:08:26 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : VSE1CICS ADMIN ID : FLLFUNCTION: UPAR SYSTEM PARAMETER ADMIN NAME: LINTON, FREDFUNCTION: UPDATE SYSTEM PARMS======================================================= SECURITY PARAMETERS ======================================================== MAX S USR NEW ALT ALL ALL ALL ALL FORCE FORC OP GP SN CON UNSECURD MAX CON F EXT EXT DYNAM DUMM USR CDE GEN TRM TRN PRG FIL DELAY DISP ST ST MS DT VIO TERMINAL DATE TIME VIO ATT # ENT REQ TERMS TERM SVC NTF CDE SEC SEC SEC SEC TIME TRAN MX MX DL FM DSP PROGRAM ---- ---- --- --- - --- --- ----- ---- --- --- --- --- --- --- --- ----- ---- -- -- -- -- --- -------- 02/18/1998 08:11 BEF 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 02/18/1998 08:11 AFT 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 02/20/1998 14:25 BEF 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 02/20/1998 14:25 AFT 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 E NO ________ 02/20/1998 14:51 BEF 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 E NO ________ 02/20/1998 14:51 AFT 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 02/25/1998 12:05 BEF 010 003 0 010 NO 00000 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 02/25/1998 12:05 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 02/25/1998 12:09 BEF 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 02/25/1998 12:09 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 08:43 BEF 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 08:43 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 03/04/1998 08:44 BEF 010 003 0 010 NO 00020 DUMY 255 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 03/04/1998 08:44 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 08:45 BEF 010 003 0 010 NO 00020 DUMY 255 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 08:45 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 12:49 BEF 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 12:49 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 03/04/1998 15:41 BEF 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________ 03/04/1998 15:41 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 16:18 BEF 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 U NO ________ 03/04/1998 16:18 AFT 010 003 0 010 NO 00020 DUMY . 005 NO NO NO NO NO 00:01 CSSN V V 3 C NO ________

Input

Output

Page 385: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Global Terminal/Operator Parameter Change Report

Chapter 7. ALRTVCAU Audit File Report 7-85

Global Terminal/Operator Parameter Change Report

The following sample input can be used to produce a report showing all changes made to theglobal terminal and operator parameters using the UTOP function.

Note that all fields are to be displayed in a vertical format and all logged data is to bedisplayed whether or not it was changed. A report showing the same data in a horizontalformat can be produced by selecting each field.

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID: ') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') SUBTITLE PARMTYPE LINE(2) JUSTIFY(C) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANDESC LINE(3) LABEL('ACTION :') SUBTITLE LITERAL('=') LINE(4) LENGTH(132) SUBTITLE LITERAL(' SECURITY PARAMETERS ') LINE(4) JUSTIFY(C) FIELD DATE CTLBREAK(P) REPCHAR(' ') FIELD TIME CTLBREAK(P) REPCHAR(' ') FIELD PARMCHGI REPCHAR(' ') FIELD PARMVALD LENGTH(40) FILLCHAR(.) JUSTIFY(L) FIELDS PARMVALB PARMVALA SELECT IF TRANID EQ C'UTOP' RUN/*

Input

Page 386: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Global Terminal/Operator Parameter Change Report Sample ALRTVCAU Reports

7-86 Auditing and Report Writing Guide

The preceding sample input produces the following report:

DATE: 03/23/1998 13:18:38 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : VSE1CICS ADMIN ID: FLLFUNCTION: UTOP TERM/OPER SYSTEM PARM ADMIN NAME: LINTON, FREDACTION : UPDATE TERM/OPER PARMS======================================================= SECURITY PARAMETERS ======================================================== SECURITY CHG PARAMETER DATE TIME IMM DESCRIPTION BEFORE AFTER ---- ---- --- ----------- ------ ----- 02/27/1998 09:20 NO TERM LOGO NAME.......................... BIMLOGO BIMLOGO TERM LOG OPTION......................... YES YES TERM SIGNON PROGRAM..................... ________ ________ TERM SIGNOFF PROGRAM.................... ________ ________ TERM SCTY CODE PERIOD................... 090 090 TERM SCTY CODE MASK..................... NNNNNNNN NNNNNNNN TERM PRINT PROFILE...................... NO NO TERM DEFAULT AUTH....................... ALL ALL TERM SCTY CODE HIST..................... 05 05 TERM MESSAGE FILE....................... S1SMS## S1SMS## OPER LOG OPTION......................... YES YES OPER SIGNON PROGRAM..................... ________ U1S610 OPER SIGNOFF PROGRAM.................... ________ ________ OPER SECURITY CODE PERIOD............... 100 100 OPER SECURITY CODE MASK................. NNNNNNNN NNNNNNNN OPER PRINT PROFILE...................... NO NO OPER DEFAULT AUTH....................... ALL ALL OPER SECURITY CODE HISTORY.............. 05 05 OPER EXTERNAL SECURITY.................. NO NO

DATE: 03/23/1998 13:18:38 PAGE: 000002 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : VSE1CICS ADMIN ID: FLLFUNCTION: UTOP TERM/OPER SYSTEM PARM ADMIN NAME: LINTON, FREDACTION : UPDATE TERM/OPER PARMS======================================================= SECURITY PARAMETERS ======================================================== SECURITY CHG PARAMETER DATE TIME IMM DESCRIPTION BEFORE AFTER ---- ---- --- ----------- ------ ----- 03/04/1998 07:26 NO TERM LOGO NAME.......................... BIMLOGO BIMLOGO TERM LOG OPTION......................... YES YES TERM SIGNON PROGRAM..................... ________ ________ TERM SIGNOFF PROGRAM.................... ________ ________ TERM SCTY CODE PERIOD................... 090 090 TERM SCTY CODE MASK..................... NNNNNNNN NNNNNNNN TERM PRINT PROFILE...................... NO ONE TERM DEFAULT AUTH....................... ALL ALL TERM SCTY CODE HIST..................... 05 05 TERM MESSAGE FILE....................... S1SMS## S1SMS## OPER LOG OPTION......................... YES YES OPER SIGNON PROGRAM..................... U1S610 ________ OPER SIGNOFF PROGRAM.................... ________ ________ OPER SECURITY CODE PERIOD............... 100 100 OPER SECURITY CODE MASK................. NNNNNNNN NNNNNNNN OPER PRINT PROFILE...................... NO NO OPER DEFAULT AUTH....................... ALL ALL OPER SECURITY CODE HISTORY.............. 05 05 OPER EXTERNAL SECURITY.................. NO NO

Output

Page 387: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Resource Name Update Report

Chapter 7. ALRTVCAU Audit File Report 7-87

Resource Name Update Report

The following sample input can be used to produce a report showing the names of all securedresources that have been updated.

Note that the resulting report will not specify exactly what changes were made to securedresources. Instead, this report format provides a global method of determining whichresources have been changed in some way or other.

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') SORTPRTY(1) - CTLBREAK(P) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANDESC LINE(3) LABEL('ACTION :') SUBTITLE LITERAL('=') LINE(4) LENGTH(132) SUBTITLE LITERAL(' SECURED RESOURCES ') LINE(4) JUSTIFY(C) FIELD INFOTYPE REPCHAR(' ') FIELD DATE LENGTH(15) FIELDS TIME FIELDS RESCTRAN RESCPROG RESCFILE RESCMAP RESMPSET RESMPREF SELECT IF TRANTYPE(8) EQ T'RESOURCE' RUN/*

Input

Page 388: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Name Update Report Sample ALRTVCAU Reports

7-88 Auditing and Report Writing Guide

The preceding sample input produces the following report:

DATE: 05/13/1998 12:40 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : ERICFUNCTION: ASMP ADMIN NAME: KEHLER, ERICACTION : ADD RESTRICTED MAP======================================================== SECURED RESOURCES ========================================================= MAP INFO TRAN PROGRAM FILE MAP MAPSET REF TYPE DATE TIME ID NAME NAME NAME NAME NBR ---- ---- ---- ---- ------- ---- ---- ------ --- SEC'D RESRC FIELD VALUES 05/12/1998 13:42 . . . S#M500 S1M500 0001 05/12/1998 13:47 . . . S#M510 S1M510 0005 05/12/1998 13:44 . . . S#M510 S1M510 0003 05/12/1998 13:45 . . . S#M510 S1M510 0004 05/12/1998 13:47 . . . S#M510 S1M510 0005 05/12/1998 13:45 . . . S#M510 S1M510 0004 05/12/1998 13:42 . . . S#M500 S1M500 0001 05/12/1998 13:43 . . . S#M500 S1M500 0002 05/12/1998 13:44 . . . S#M510 S1M510 0003 05/12/1998 13:43 . . . S#M500 S1M500 0002

DATE: 05/13/1998 12:40 PAGE: 000002 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : FLLFUNCTION: ASTR ADMIN NAME: LINTON, FREDACTION : ADD SECURED TRANID======================================================== SECURED RESOURCES ========================================================= MAP INFO TRAN PROGRAM FILE MAP MAPSET REF TYPE DATE TIME ID NAME NAME NAME NAME NBR ---- ---- ---- ---- ------- ---- ---- ------ --- SEC'D RESRC FIELD VALUES 06/30/1997 11:43 BMGM . . . . . 09/04/1997 12:33 BIMO . . . . . 09/04/1997 12:33 BIMO . . . . . 09/04/1997 12:33 BIMV . . . . . 09/04/1997 12:33 BIMC . . . . . 09/02/1997 10:00 OPWD . . . . . 09/02/1997 10:00 OPWD . . . . . 09/04/1997 12:33 BIMV . . . . . 09/04/1997 12:33 BIMC . . . . . 06/30/1997 11:43 BMGM . . . . .

Output

Page 389: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Resource Update Report

Chapter 7. ALRTVCAU Audit File Report 7-89

Resource Update Report

The following sample input can be used to produce a report showing all changes made tosecured resources.

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU DATEFORM(DD,' ',MMM,' ',YYYY) SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANID LINE(2) LABEL('FUNCTION:') SORTPRTY(1) - CTLBREAK(P) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANDESC LINE(3) LABEL('ACTION :') SUBTITLE LITERAL('=') LINE(4) LENGTH(132) SUBTITLE LITERAL(' RESOURCE UPDATES ') LINE(4) JUSTIFY(C) FIELD DATE LENGTH(11) SORTPRTY(2) CTLBREAK(S) REPCHAR(' ') FIELD TIME SORTPRTY(3) CTLBREAK(S) REPCHAR(' ') FIELDS RESPARMD RESPARMB RESPARMA SELECT IF DATE GE D'01 JAN 1998' AND - TRANTYPE(8) EQ T'RESOURCE' RUN/*

Input

Page 390: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Update Report Sample ALRTVCAU Reports

7-90 Auditing and Report Writing Guide

The preceding sample input produces the following report:

DATE: 13 MAY 1998 12:43 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : ERICFUNCTION: ASMP ADMIN NAME: KEHLER, ERICACTION : ADD RESTRICTED MAP======================================================== RESOURCE UPDATES ========================================================== RESOURCE PARAMETER DATE TIME DESCRIPTION BEFORE AFTER ---- ---- ----------- ------ ----- 12 MAY 1998 13:43 MAP FIELD DISPLAY . Y 13:45 MAP FIELD NUMBER . 001 13:47 MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 103 MAP FIELD TITLE . TEST FIELD 102 XXXX MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 102 MAP FIELD TITLE . TEST FIELD 101 XXXX MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 101 MAP FIELD TITLE . TEST FIELD 13 XXXXX MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 013 DESCRIPTION . TEST MAP S#M510 STATUS . ACTIVE NAME S#M510 S#M510 13:45 MAP FIELD TITLE . TEST FIELD 5 MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 005 MAP FIELD TITLE . TEST FIELD 4 MAP FIELD DISPLAY . Y MAP FIELD NUMBER . 004 MAP FIELD TITLE . TEST FIELD 3

DATE: 13 MAY 1998 12:43 PAGE: 000002 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : ERICFUNCTION: ASMP ADMIN NAME: KEHLER, ERICACTION : ADD RESTRICTED MAP======================================================== RESOURCE UPDATES ========================================================== RESOURCE PARAMETER DATE TIME DESCRIPTION BEFORE AFTER ---- ---- ----------- ------ ----- 12 MAY 1998 13:45 MAP FIELD TITLE . TEST FIELD 1 MAP FIELD DISPLAY . Y STATUS . ACTIVE 13:47 MAP FIELD TITLE . TEST FIELD 103 XXXX 13:45 DESCRIPTION . TEST MAP S#M510 13:44 MAP FIELD NUMBER . 005 MAP FIELD TITLE . TEST FIELD 5 13:45 NAME S#M510 S#M510 13:44 MAP FIELD DISPLAY . Y STATUS . ACTIVE MAP FIELD TITLE . TEST FIELD 1 MAP FIELD DISPLAY . Y MAP FIELD TITLE . TEST FIELD 3 MAP FIELD NUMBER . 003 MAP FIELD NUMBER . 001 MAP FIELD DISPLAY . Y DESCRIPTION . TEST MAP S#M510

DATE: 13 MAY 1998 12:43 PAGE: 000003 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : ERICFUNCTION: ASMP ADMIN NAME: KEHLER, ERICACTION : ADD RESTRICTED MAP======================================================== RESOURCE UPDATES ========================================================== RESOURCE PARAMETER DATE TIME DESCRIPTION BEFORE AFTER ---- ---- ----------- ------ ----- 12 MAY 1998 13:42 MAP FIELD NUMBER . 002 DESCRIPTION . TEST MAP S#M550 STATUS . ACTIVE NAME S#M500 S#M500

Output

Page 391: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Resource Activation and Deactivation Report

Chapter 7. ALRTVCAU Audit File Report 7-91

Resource Activation and Deactivation Report

The following sample input can be used to produce a report showing all activation anddeactivation activity against all secured resources:

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE TRANTYPE LINE(2) LABEL('FUNCTION:') SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE LITERAL('=') LINE(3) LENGTH(132) SUBTITLE LITERAL(' ACTIVATE/DEACTIVATE RESOURCES ') LINE(3) - JUSTIFY(C) FIELD DATE SORTPRTY(1) REPCHAR(' ') CTLBREAK(S) FIELD TIME SORTPRTY(2) FIELDS ACTVTYPE ACTVSTAT ACTVTRAN ACTVPROG ACTVFILE ACTVMAP FIELDS ACTVMAP# ACTVOPER ACTVTERM SELECT IF TRANTYPE(8) EQ T'ACTIVATE' RUN/*

The preceding sample input produces the following report:

DATE: 05/12/1998 14:46 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : FLLFUNCTION: ACTIVATE ADMIN NAME: LINTON, FRED================================================== ACTIVATE/DEACTIVATE RESOURCES =================================================== RESOURCE NEW MAP DATE TIME TYPE STATUS TRAN PROGRAM FILENAME MAPNAME REF OPERATOR TERM ---- ---- -------- ------ ---- ------- -------- ------- --- -------- ---- 02/27/1998 12:19 TERMINAL ACTIVATED . . . . . . BC34 12:19 TERMINAL ACTIVATED . . . . . . BC32 02/28/1998 07:55 TERMINAL ACTIVATED . . . . . . BC32 11:49 TERMINAL ACTIVATED . . . . . . BC22 11:44 TRANSACTION ACTIVATED BMGM . . . . . . 07:54 TERMINAL ACTIVATED . . . . . . BC34 07:34 TERMINAL DE-ACTIVATED . . . . . . BC34 07:34 TERMINAL DE-ACTIVATED . . . . . . BC32 03/01/1998 13:57 TERMINAL ACTIVATED . . . . . . BC13 09:06 TERMINAL ACTIVATED . . . . . . BC14 03/01/1998 17:35 OPERATOR ACTIVATED . . . . . GSWJBG . 17:35 TERMINAL ACTIVATED . . . . . . BC31 03/02/1998 14:21 OPERATOR ACTIVATED . . . . . JMM . 14:22 OPERATOR ACTIVATED . . . . . JMM . 03/28/1998 16:16 TERMINAL ACTIVATED . . . . . . BC12 06/08/1998 10:56 FILE DE-ACTIVATED . . S1SAUDT . . . . 13:16 FILE DE-ACTIVATED . . S1SECLG . . . .

Input

Output

Page 392: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Administrator Change Activity Report Sample ALRTVCAU Reports

7-92 Auditing and Report Writing Guide

Administrator Change Activity Report

The following sample input can be used to produce a report showing all changes made tooperator and terminal administrative ownership privileges using the ADCT, ACRT, ADCO, orADRO functions:

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU TIMEFORM(HH : MM : SS) SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE TRANDESC LINE(2) LABEL('ACTION :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE LITERAL('=') LINE(3) LENGTH(132) SUBTITLE LITERAL(' ADMINISTRATOR CHANGE ACTIVITY ') LINE(3) - JUSTIFY(C) FIELD DATE REPCHAR(' ') CTLBREAK(P) FIELD TIME REPCHAR(") CTLBREAK(S) LENGTH(8) FIELD TRANID REPCHAR(") LABEL(TRAN) LENGTH(4) FIELD LITERAL(' ') FIELD ADMCSTAT LABEL(N) REPCHAR(' ') MISSCHAR(' ') FIELD LITERAL(ADMINISTRATOR) REPCHAR(") FIELD ADMCACT LABEL(N) REPCHAR(") FIELD LITERAL(FOR) REPCHAR(' ') FIELD ADMCTYPE LABEL(N) REPCHAR(") FIELD ADMCNAME LABEL(N) JUSTIFY(L) FIELD LITERAL('FROM ADMIN:') REPCHAR(' ') FIELD ADMCFROM JUSTIFY(L) LABEL(N) REPCHAR(") FIELD LITERAL('TO ADMIN:') REPCHAR(' ') FIELD ADMCINTO JUSTIFY(L) LABEL(N) REPCHAR(") SELECT IF TRANTYPE(5) EQ T'ADMIN' RUN/*

Input

Page 393: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Administrator Change Activity Report

Chapter 7. ALRTVCAU Audit File Report 7-93

The preceding sample input produces the following report:

DATE: 05/13/1998 12:51:23 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : ERICACTION : CHANGE OPERATOR ADMIN ADMIN NAME: KEHLER, ERIC================================================== ADMINISTRATOR CHANGE ACTIVITY =================================================== DATE TIME TRAN ---- ---- ----05/13/1998 06:06:09 ADCO PERMANENT ADMINISTRATOR CHANGE FOR OPERATOR DICKM2 FROM ADMIN: ERIC TO ADMIN: FLL " " " " " JSTECHER " " " " " " Y2TEST " "

05/13/1998 06:08:51 ADCT TEMPORARY ADMINISTRATOR CHANGE FOR TERMINAL BC12 FROM ADMIN: FLL TO ADMIN: ERIC " " " " " BC13 " " " " " " " BC22 " " " " " " " BC32 " " " " " " " BC33 " " " " " " " DUMY " " " " " " " Q008 " " " " " " " YR2K " "

05/13/1998 06:09:22 ADRT ADMINISTRATOR RECLAIM FOR TERMINAL BC12 FROM ADMIN: ERIC TO ADMIN: FLL " " " " " BC13 " " " " " " " BC22 " " " " " " " BC32 " " " " " " " BC33 " " " " " " " DUMY " " " " " " " Q008 " " " " " " " YR2K " "

Output

Page 394: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Location Change Report Sample ALRTVCAU Reports

7-94 Auditing and Report Writing Guide

Location Change Report

The following sample input can be used to produce a report showing all changes made to thelocation information:

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU TIMEFORM(HH : MM : SS) SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE TRANTYPE LINE(2) LABEL('TYPE :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE LITERAL('=') LINE(3) LENGTH(132) SUBTITLE LITERAL(' LOCATION CHANGE ACTIVITY ') LINE(3) - JUSTIFY(C) FIELD DATE REPCHAR(' ') CTLBREAK(S) FIELD TIME REPCHAR(") CTLBREAK(S) LENGTH(8) FIELD TRANID REPCHAR(") LABEL(TRAN) LENGTH(4) FIELDS LOCFLAG LOCID LOCSTAT LOCNAME SELECT IF TRANTYPE(8) EQ T'LOCATION' RUN/*

The preceding sample input produces the following report:

DATE: 03/26/1998 06:29:00 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : VSE1CICS ADMIN ID : ERICTYPE : LOCATION ADMIN NAME: KEHLER, ERIC==================================================== LOCATION CHANGE ACTIVITY ====================================================== BEFORE LOCATION LOCATION LOCATION DATE TIME TRAN /AFTER ID STATUS NAME ---- ---- ---- ------ -------- -------- -------- 03/25/1998 12:12:31 ADPT BEFORE BIMCLBSSUPP . . " " AFTER BIMCLBSSUPP ACTIVE COLUMBUS DEVELOPMENT_____________ 03/25/1998 12:14:51 UCOM BEFORE BIM ACTIVE B I MOYLE ASSOCIATES, INC.________ " " AFTER BIM ACTIVE B I MOYLE ASSOCIATES, INC. 03/25/1998 12:15:26 UDPT BEFORE BIMCLBSDEVL ACTIVE COLUMBUS DEVELOPMENT " " AFTER BIMCLBSDEVL ACTIVE COLUMBUS DEVELOPMENT 03/25/1998 12:15:36 UDPT BEFORE BIMCLBSSUPP ACTIVE COLUMBUS DEVELOPMENT_____________ " " AFTER BIMCLBSSUPP ACTIVE COLUMBUS SUPPORT 03/25/1998 12:18:32 UDPT BEFORE BIMSNTASUPP ACTIVE SANTA ANA SUPPORT__________ " " AFTER BIMSNTASUPP ACTIVE SANTA ANA SUPPORT 03/25/1998 12:18:43 UDPT BEFORE BIMSNTADEVL ACTIVE SANTA ANA DEVELOPMENT____________ " " AFTER BIMSNTADEVL ACTIVE SANTA ANA DEVELOPMENT 03/25/1998 12:45:29 UDIV BEFORE BIMCLBS ACTIVE BIM OHIO OFFICE_________________ " " AFTER BIMCLBS ACTIVE BIM OHIO OFFICE 03/25/1998 12:45:46 UDIV BEFORE BIM0000 ACTIVE ( N/A ) " " AFTER BIM0000 DISABLED ( N/A ) 03/25/1998 12:46:55 ASCT BEFORE BIMSNTADEVLEPIC . . " " AFTER BIMSNTADEVLEPIC ACTIVE BIM-EPIC/VSE 03/25/1998 12:47:59 ASCT BEFORE BIMCLBSDEVLALRT . . " " AFTER BIMCLBSDEVLALRT ACTIVE BIM-ALERT 03/25/1998 12:47:59 ASCT BEFORE BIMCLBSDEVLFAQS . . " " AFTER BIMCLBSDEVLFAQS ACTIVE BIM-FAQS 03/25/1998 12:52:32 UDIV BEFORE BIM0000 DISABLED ( N/A ) " " AFTER BIM0000 DISABLED ( N/A ) 03/25/1998 12:53:10 UDPT BEFORE BIMCLBS0000 ACTIVE ( N/A ) " " AFTER BIMCLBS0000 DISABLED ( N/A ) 03/25/1998 12:53:26 UDPT BEFORE BIMSNTA0000 ACTIVE ( N/A ) " " AFTER BIMSNTA0000 DISABLED ( N/A ) 03/25/1998 12:53:38 UDPT BEFORE BIMMPLS0000 ACTIVE ( N/A )

Input

Output

Page 395: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVCAU Reports Operator Profile Change Report

Chapter 7. ALRTVCAU Audit File Report 7-95

Operator Profile Change Report

The following sample input can be used to produce a report showing all changes made toselected fields in the operator profile records:

// EXEC ALRTVREP,SIZE=256K TITLES '** BIM-ALERT/CICS AUDIT INFORMATION **' REPORT ALRTVCAU SUBTITLE SYSTEMID LINE(1) LABEL('SYSID :') SUBTITLE TRANTYPE LINE(2) LABEL('TYPE :') SUBTITLE ADMINID LINE(1) LABEL('ADMIN ID :') JUSTIFY(R) - LENGTH(20) - SORTPRTY(1) CTLBREAK(P) SUBTITLE ADMINAME LINE(2) LABEL('ADMIN NAME:') JUSTIFY(R) - LENGTH(20) SUBTITLE LITERAL('=') LINE(3) LENGTH(132) SUBTITLE LITERAL(' OPERATOR CHANGE ACTIVITY ') LINE(3) - JUSTIFY(C) FIELD DATE REPCHAR(' ') CTLBREAK(S) SORTPRTY(2) FIELD TIME REPCHAR(' ') CTLBREAK(S) SORTPRTY(3) FIELD TRANID REPCHAR(") LABEL(TRAN) LENGTH(4) FIELDS TMOPFLAG TMOPERID TMOPERNM TMOPITLM TMOPDEVC TMOPALT1 FIELDS TMOPALT2 TMOPGRP SELECT IF TRANID EQ C'UAUP' RUN/*

The preceding sample input produces the following report:

DATE: 01/29/1998 14:12 PAGE: 000001 ** BIM-ALERT/CICS AUDIT INFORMATION **SYSID : TEST ADMIN ID : LFLTYPE : TERMOPER ADMIN NAME: LINTON, FRED==================================================== OPERATOR CHANGE ACTIVITY ======================================================

INACT OPER OPER OPER BEFORE OPERATOR TIME PRIM ALRT ALRT TERM DATE TIME TRAN /AFTER ID USER NAME LIMT DEVC TRM1 TRM2 GRP ---- ---- ---- ------ -------- --------- ----- ---- ---- ---- ----

01/29/98 11:35 UAUP BEFORE EDP EDP 00:01 . . . ALL " AFTER EDP EDP 01:01 N480 N481 . ALL 01/29/98 12:53 UAUP BEFORE EDP EDP 01:01 N480 N481 . ALL " AFTER EDP EDP 01:01 N480 N481 N482 ALL 01/29/98 13:16 UAUP BEFORE EDP EDP 01:01 N480 N481 N482 ALL " AFTER EDP EDP 01:01 N480 N481 N482 ALL

Input

Output

Page 396: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Operator Profile Change Report Sample ALRTVCAU Reports

7-96 Auditing and Report Writing Guide

Page 397: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

8-1

8

ALRTVVAU Audit File Report

This chapter describes the ALRTVVAU audit file report, which you can use to select anddisplay information from the BIM-ALERT/VSE audit file.

Introduction....................................................................................................................8-2General Information...................................................................................................8-2Sample JCL................................................................................................................8-2Input Record Description...........................................................................................8-3Field Information .......................................................................................................8-7

Fieldname List................................................................................................................8-9Common Segment Fields ...........................................................................................8-9Extended User Fields...............................................................................................8-15Jobmask Fields.........................................................................................................8-20SECID Maintenance Fields......................................................................................8-24DASD Dataset Maintenance Fields .........................................................................8-28Tape Dataset Maintenance Fields ............................................................................8-32Resource Maintenance Fields ..................................................................................8-36Library Maintenance Fields .....................................................................................8-40Rules Table Maintenance Fields..............................................................................8-44Control File Maintenance Fields..............................................................................8-47Node Information Fields..........................................................................................8-53Remote Submittal Information Fields ......................................................................8-55

Sample ALRTVVAU Reports......................................................................................8-57Introduction .............................................................................................................8-57DASD Dataset Change Report.................................................................................8-58Resource Change Report .........................................................................................8-59Control File Maintenance Report.............................................................................8-60

Page 398: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

General Information Introduction

8-2 Auditing and Report Writing Guide

Introduction

General Information

Information contained in the BIM-ALERT/VSE audit file is available for selection and displayin the ALRTVVAU report type. This information includes changes made to the following:

• Extended user information• JOBMASK records• SECID records• DASD, tape, library, and other resource datasets• The rules table• The control file

To report on changes to batch user profiles, use the ALRTVCAU report type, as described inChapter 7.

This report type requires the BIM-ALERT/VSE audit file, or a VSAM copy of the file, asinput. It will also accept a sequential tape or disk file of variable-length records as input.

The phase ALRTVVAU is loaded by ALRTVREP when this report type is specified on aREPORT command statement. ALRTVVAU reads the input file and formats the data for thereport.

Sample JCL

The following sample JCL can be used to execute any ALRTVVAU report:

// JOB ALRTVVAU BIM-ALERT/VSE audit file report// LIBDEF PHASE,SEARCH=.... <== optional// DLBL IJSYSUC,'user.catalog.name',,VSAM <== optional// DLBL SORTWK1,'SORTWK1.SYS001.WORKFILE',0000,VSAM, <== optional DISP=(,DELETE),RECORDS=2000,RECSIZE=4096 <== optional// DLBL S1SAUDT,'ALERT.S1SAUDT.V50',,VSAM// EXEC ALRTVREP,SIZE=256K . ./*/&

Input Dataset

I/O Module Name

Page 399: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 8. ALRTVVAU Audit File Report 8-3

Input Record Description

Each BIM-ALERT/VSE audit file record contains an 18-byte record key and one of severalsubordinate information field types (segments).

The common segment contains control information about the record. It is contained in everyrecord type.

The 01000000 segment contains the global information regarding changes to the extendeduser information. (Such changes are made with transactions AUSR and UUSR.) This is theinformation necessary to identify a USER record.

User Information Data List (Type 01010000)The 01010000 segment fields can be used to produce a report of all before and after dataconcerning changes to the extended user records. This report will be produced in a verticalformat, with multiple output lines per record (one line per field).

User Information Data Values (Type 01020000)The type 01020000 fields allow you to select and report on specific extended user recordfields to limit the report to very specific information.

User Information Task ID Build Parameters (Type 01030000)The type 01030000 fields allow you to select and report on specific extended user recordTASKID build parameters.

The type 03000000 fields can be used to produce a listing of all the jobmask records that havebeen added or updated. The report does not show the changes that were made; rather, it showswhich jobmask records were changed.

Jobmask Data List (Type 03010000)The type 03010000 fields produce a complete listing of all before and after data for each fieldin the jobmask records. This report will be produced in a vertical format, with multiple outputlines per record (one line per field).

Jobmask Data Values (Type 03020000)The type 03020000 fields allow you to select and report on specific data fields (for example,Mask) in a jobmask record.

The type 05000000 fields show a global list of all SECID records that have been changed.This list does not show the changes that were made; rather, it shows which SECID recordswere changed.

SECID Data List (Type 05010000)

Introduction

CommonInformation (Type00000000)

Extended UserMaintenance (Type01000000)

JobmaskMaintenance (Type03000000)

SECID Information(Type 05000000)

Page 400: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

8-4 Auditing and Report Writing Guide

The type 05010000 fields can be used to produce reports of all before and after SECID datalogged as a result of any SECID change. The report will be produced in a vertical format,with multiple lines of output per record (one line per field).

SECID Data Values (Type 05020000)The type 05020000 fields can be used to produce reports of before and after data for specificSECID record fields.

The type 06000000 fields can be used to produce a global report of all DASD dataset recordsthat have been changed. This report does not show the changes that were made; rather, itshows which DASD dataset records were changed.

DASD Dataset Data List (Type 06010000)The type 06010000 fields can be used to produce reports showing all before and after DASDdataset information logged as a result of any DASD dataset update. The report is produced ina vertical format, with multiple lines of output per record (one line per field).

DASD Dataset Data Values (Type 06020000)The type 06020000 fields can be used to produce reports of before and after DASD datasetdata for specific fields.

The type 07000000 fields can be used to produce a global report of all tape dataset recordsthat have been changed. This report does not show the changes that were made; rather, itshows which tape dataset records were changed.

Tape Dataset Data List (Type 07010000)The type 07010000 fields can be used to produce reports showing all before and after tapedataset information logged as a result of any tape dataset update. The report is produced in avertical format, with multiple lines of output per record (one line per field).

Tape Dataset Data Values (Type 07020000)The type 07020000 fields can be used to produce reports of before and after tape dataset datafor specific fields.

The type 08000000 fields can be used to produce a global report of all resource records thathave been changed. This report does not show the changes that were made; rather, it showswhich resource records were changed.

Resource Data List (Type 08010000)The type 08010000 fields can be used to produce reports showing all before and after resourceinformation logged as a result of any resource update. The report is produced in a verticalformat, with multiple lines of output per record (one line per field).

Resource Data Values (Type 08020000)The type 08020000 fields can be used to produce reports of before and after resource data forspecific fields.

DASD DatasetMaintenanceInformation (Type06000000)

Tape DatasetMaintenanceInformation (Type07000000)

ResourceMaintenanceInformation (Type08000000)

Page 401: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Input Record Description

Chapter 8. ALRTVVAU Audit File Report 8-5

The type 09000000 fields can be used to produce a global report of all library records thathave been changed. This report does not show the changes that were made; rather, it showswhich library records were changed.

Library Data List (Type 09010000)The type 09010000 fields can be used to produce reports showing all before and after libraryinformation logged as a result of any resource update. The report is produced in a verticalformat, with multiple lines of output per record (one line per field).

Library Data Values (Type 09020000)The type 09020000 fields can be used to produce reports of before and after library data forspecific fields.

The type 0A0x0000 fields can be used to produce a report of all before and after data loggedas a result of executing CALR to perform rules table maintenance. The report will beproduced in a vertical format, with multiple lines per audit record (one line per field).

Rules Table Maintenance Values (Type 0A010000)The type 0A010000 fields can be used to produce reports of before and after rules tablemaintenance data.

Rules Table Before/After Values (Type 0A020000)The type 0A020000 fields can be used to produce reports of before and after rules tablemaintenance data for specific fields.

The type 0B0x0000 fields can be used to produce a report of all before and after data loggedas a result of executing SCFL to perform control file maintenance. The report will beproduced in a vertical format, with multiple lines per audit record (one line per field).

Control File Maintenance Values (Type 0B010000)The type 0B010000 fields can be used to produce reports of before and after control filemaintenance data.

Control File Before/After Values (Type 0B020000)The type 0B020000 fields can be used to produce reports of before and after control filemaintenance data for specific fields.

Control File Monitor Parameters (Type 0B030000)The type 0B030000 fields can be used to produce reports of monitor parameters and monitorsuspend parameters changed in the control file record.

The type C00x0000 fields can be selected to produce a report of node name data changed inthe system control file record.

Node Name Before/After Values (Type C0010000)The type C0010000 fields can be used to produce reports of all before and after node nameparameters changed in the system control file record.

LibraryMaintenanceInformation (Type09000000)

Rules TableMaintenance DataList (Type0A0x0000)

Control FileMaintenance DataList (Type0B0x0000)

Node Information(Type C00x0000)

Page 402: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Input Record Description Introduction

8-6 Auditing and Report Writing Guide

Node Name Parameters (Type C0020000)The type C0020000 fields can be used to produce a report of before and after node nameparameter changes for specific fields.

The type C10x0000 fields can be selected to produce a report of remote submittal datachanged in the system control file record.

Remote Submittal Parameter Descriptions (Type C1010000)The type C1010000 fields can be used to produce a report of all before and after remotesubmittal parameters changed in the system control file record.

Remote Submittal Parameters (Type C1020000)The type C1020000 fields can be used to produce a report of before and after data for specificfields, such as target classes.

Remote Submittal Parameters (Type C1030000)The type C1030000 fields can be used to produce a report of before and after data for specificfields, such as target SYSIDs.

Remote SubmittalInformation (TypeC10x0000)

Page 403: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction Field Information

Chapter 8. ALRTVVAU Audit File Report 8-7

Field Information

Report output is comprised of one or more data fields extracted from an input dataset andformatted according to default or user specifications. Each data field is selected from a pre-defined list of ALRTVVAU fieldnames.

At report generation time, each fieldname selected is assigned a report column, positionedfrom left to right across the report page in the order in which the fieldnames were specified.

Data corresponding to the selected fieldname is located, extracted from the physical inputrecord by the ALRTVVAU I/O module, and moved to, or transformed into, the output reportcolumn, using either the default values described in the fieldname entries below, or asspecified by the user in a FIELD command statement.

The following information is provided for each ALRTVVAU fieldname:

Heading Description

Group Field: YES Indicates that the fieldname being defined is a group fieldname containing several individualfieldnames within the group. The individual fieldnames are listed.• If the group fieldname is specified in the SUBTITLE, FIELD, or FIELDS command

statement, input data represented by all individual fieldnames within the group will be printedas a single field.

• If the individual fieldnames are specified in a command statement, each fieldname is assignedits own column in the report output detail line.

Field type Each fieldname is defined as a particular field type. By definition, type 00000000 information ispresent in every input record. Following the type 00000000 common segment information,ALRTVVAU records will contain one subordinate type of field information.

Default label-n Default label information is positioned in the output report, if requested, at the top of each page ofoutput. Up to three labels can be specified for each field; they will be placed above the reportcolumn reserved for the fieldname.

Occurrences: variable Indicates that the field is defined within a variable-occurrence segment. This fieldname, ifincluded on any FIELD or FIELDS command statement, will generate a report detail line for everyoccurrence of the information in the record.

Belongs to group Indicates a higher level group fieldname which can be included on any SUBTITLE, FIELD, orFIELDS command statement to display the data represented by this fieldname.

Input data length Represents the defined length of the data in the input record corresponding to the fieldname. If thelength is indicated as variable, then the length of the data field has no pre-defined length, and theamount of data present is defined in each individual input record.

(continued)

Page 404: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Field Information Introduction

8-8 Auditing and Report Writing Guide

Heading Description

Input data format Indicates that the data in the input record is in one of the following formats:

X Hexadecimal or binaryC Printable charactersP Packed-decimal

Default output length This numeric value is the default value used to determine the number of character positions to bereserved in the output report detail line for the column in which the data will be positioned. Thisvalue can be increased or decreased by the use of the LENGTH keyword on a FIELD commandstatement.

Default output format One of the following output formats is assigned by default for each fieldname; it determines howthe data will appear in the output report:

C Character. The input data is simply moved from the input record to the report detailline. Each non-printable characters is translated to a period (.).

X Hexadecimal. Each byte or character in the input field is translated to its two-characterhexadecimal equivalent.

Z Zoned-decimal. The input data field, up to a length of four, is treated as a binarynumber and converted to its decimal equivalent. By default, zoned-decimal formattedoutput fields are zero-suppressed and right-justified in the report column. Users canoverride the field justification value by using the JUSTIFY keyword on the FIELDcommand statement. Zero-suppression can be overridden by specifying NOTRUNC onthe FIELD or SUBTITLE command statement.

T Transformed. The input data field is replaced by an alternate value, either as set forth inthe transformation table shown or as determined by some other programmedtransformation algorithm, such as is performed on BIM-ALERT/VSE TERMPHONfield.

Users can override the field output format value by using the FORMAT keyword on the FIELDcommand statement.

Page 405: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 8. ALRTVVAU Audit File Report 8-9

Fieldname List

Common Segment Fields

The following field names can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the common segment ofall input records and, if specified, will be printed on all detail lines of the report.

Field Description

KEY Input record key.

Field type: 00000000 - Common segment informationDefault label-1: RECORD KEYInput data length: 18Input data format: Hexadecimal (X)Default output data length: 36Default output data format: Hexadecimal (X)

RECLEN Input record length.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: RECORDDefault label-3: LENGTHInput data length: 2Input data format: Hexadecimal (X)Default output data length: 4Default output data format: Zoned-decimal (Z)

DSNAME Input file dataset name.

Field type: 00000000 - Common segment informationDefault label-1: INPUTDefault label-2: DATASETDefault label-3: NAMEInput data length: 44Input data format: Character (C)Default output data length: 44Default output data format: Character (C)

(continued)

Page 406: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

8-10 Auditing and Report Writing Guide

Field Description

TRANID CICS transaction ID creating the audit record.

Field type: 00000000 - Common segment informationDefault label-1: TRANDefault label-2: IDInput data length: 4Input data format: Character (C)Default output data length: 4Default output data format: Character (C)

DATE Date change was made.

Field type: 00000000 - Common segment informationDefault label-1: CHANGEDefault label-2: DATEInput data length: 4Input data format: Hexidecimal (X)Default output data length: 10Default output data format: Transformed (T)X'AFCBB7AD'.....T'01/01/1998' (or user-defined DATEFORM)

TIME Time change was made.

Field type: 00000000 - Common segment informationDefault label-1: CHANGEDefault label-2: TIMEInput data length: 4Input data format: Hexidecimal (X)Default output data length: 5Default output data format: Transformed (T)X'AFCBB7AD'.....T' 08:25 ' (or user-defined TIMEFORM)

SYSTEMID CICS SYSID where change was made.

Field type: 00000000 - Common segment informationDefault label-1: SYSIDInput data length: 8Input data format: Character (C)Default output data length: 8Default output data format: Character (C)

ADMINAME Name of administrator or subadministrator who made the change.

Field type: 00000000 - Common segment informationDefault label-1: ADMINDefault label-1: NAMEInput data length: 20Input data format: Character (C)Default output data length: 20Default output data format: Character (C)

(continued)

Page 407: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 8. ALRTVVAU Audit File Report 8-11

Field Description

AUDACT Action processed (addition, deletion, update).

Field type: 00000000 - Common segment informationDefault label-1: ACTIONDefault label-2: TAKENInput data length: 1Input data format: Character (C)Default output data length: 8Default output data format: Character (C)

C'A'............T'ADDITION'C'D'............T'DELETE 'C'C'............T'UPDATE 'C'S'............T'UPDATE 'C'U'............T'UPDATE '

ADMINID Operator number of administrator or subadministrator who made the change.

Field type: 00000000 - Common segment informationDefault label-1: ADMINDefault label-2: NUMBERInput data length: 9Input data format: Character (C)Default output data length: 9Default output data format: Character (C)

DATEFMT Date format.

Field type: 00000000 - Common segment informationDefault label-1: DATEDefault label-2: FORMATInput data length: 1Input data format: Character (C)Default output data length: 8Default output data format: Transformed (T)

C'C'............T'CANADIAN'C'E'............T'EUROPEAN'C'U'............T'USA '

(continued)

Page 408: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

8-12 Auditing and Report Writing Guide

Field Description

RECCODE Record code.

Field type: 00000000 - Common segment informationDefault label-1: RECORDDefault label-2: CODEInput data length: 2Input data format: Character (C)Default output data length: 2Default output data format: Character (C)

INFOTYPE Information type. Describes the type of information contained in the field or record.

Field type: 00000000 - Common segment informationDefault label-1: INFODefault label-2: TYPEInput data length: 4Input data format: Hexadecimal (X)Default output length: 26Default output format: Transformed (T)X'00000000'..T'COMMON SEGMENT INFO 'X'01000000'..T'EXTENDED USER INFO 'X'01010000'..T'EXTENDED USER DATA LIST 'X'01020000'..T'EXTENDED USER DATA VALUES'X'01030000'..T'USER TASK ID BUILD 'X'01040000'..T'USER SEQUENCE INFORMATION'X'01050000'..T'USER SEQUENCE BEFORE/AFTER'X'02000000'..T'USER PROFILE INFO 'X'02010000'..T'USER PROFILE DATA LIST 'X'02020000'..T'USER PROFILE DATA VALUES 'X'03000000'..T'JOBMASK INFORMATION 'X'03010000'..T'JOBMASK DATA LIST 'X'03020000'..T'JOBMASK DATA VALUES 'X'03030000'..T'JOBMASK SEQUENCE INFO 'X'03040000'..T'JOBMASK SEQ BEFORE/AFTER 'X'05000000'..T'SECID INFORMATION 'X'05010000'..T'SECID DATA LIST 'X'05020000'..T'SECID DATA VALUES 'X'06000000'..T'DASD DATASET INFO 'X'06010000'..T'DASD DATASET DATA LIST 'X'06020000'..T'DASD DATASET DATA VALUES 'X'07000000'..T'TAPE DATASET INFO '

X'07010000'..T'TAPE DATASET DATA LIST 'X'07020000'..T'TAPE DATASET DATA VALUES 'X'08000000'..T'RESOURCE INFORMATION 'X'08010000'..T'RESOURCE DATA LIST 'X'08020000'..T'RESOURCE DATA 'X'08020000'..T'RESOURCE BEFORE/AFTER 'X'09000000'..T'LIBRARY INFO 'X'09010000'..T'LIBRARY PARM VALUES 'X'09020000'..T'LIBRARY BEFORE/AFTER 'X'0A010000'..T'CONVERT RULES PARM VALUES'X'0A020000'..T'CONVERT RULES BEF/AFT 'X'0B010000'..T'SYSTEM CNTL FILE PARMS 'X'0B020000'..T'SYSTEM CNTL FILE BEF/AFT 'X'0B030000'..T'SYSTEM CNTL MONITOR PARMS'X'C0010000'..T'NODE NAME BEFORE/AFTER 'X'C0020000'..T'NODE NAME PARAMETERS 'X'C1010000'..T'REMOTE SUBMIT BEF/AFTER 'X'C1020000'..T'REMOTE SUBMIT PARAMETERS 'X'C1030000'..T'REMOTE SUBMIT PARAMETERS 'X'E0010000'..T'XPCC SUBMIT BEFORE/AFTER 'X'E0020000'..T'XPCC SUBMIT PARAMETERS '

SEQNUM Output detail line sequence number.

Field type: 00000000 - Common segment informationDefault label-1: REPORTDefault label-2: LINEDefault label-3: NUMBERInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

(continued)

Page 409: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Common Segment Fields

Chapter 8. ALRTVVAU Audit File Report 8-13

Field Description

INRECNUM Physical input record sequence number, assigned by the ALRTVVAU I/O module when the inputrecord is read.

Field type: 00000000 - Common segment informationDefault label-1: INPTDefault label-2: RECDDefault label-3: NMBRInput data length: 4Input data format: Hexadecimal (X) - Binary fullwordDefault output length: 6Default output format: Zoned-decimal (Z)

TABLEID Table number contained in record.

Field type: 00000000 - Common segment informationDefault label-1: TABLEDefault label-1: IDInput data length: 2Input data format: Character (C)Default output data length: 2Default output data format: Character (C)

SERNUM Record serial number.

Field type: 00000000 - Common segment informationDefault label-1: SERIALDefault label-2: NUMBERInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

CTLNUM Record control number.

Field type: 00000000 - Common segment informationDefault label-1: CONTROLDefault label-2: NUMBERInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 410: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Common Segment Fields Fieldname List

8-14 Auditing and Report Writing Guide

Field Description

BEFAFT Before or after indicator.

Field type: 00000000 - Common segment informationDefault label-1: BEFOREDefault label-2: /AFTERInput data length: 1Input data format: Hexadecimal (X)Default output length: 6Default output format: Transformed (T)

X'00'.....T'BEFORE'X'FF'.....T'AFTER '

Page 411: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Extended User Fields

Chapter 8. ALRTVVAU Audit File Report 8-15

Extended User Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile extended user records (segment X'010x0000'). These fields will be printed only on reportdetail lines with other segment 01xxxxxx record and common segment fieldnames.

Field Description

UJFLDNM Job entry field name.

Field type: 01000000 - Extended user informationDefault label-1: J-EDefault label-2: FIELDDefault label-3: NAMEInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

UJFLDPO Job entry field position.

Field type: 01000000 - Extended user informationDefault label-1: J-EDefault label-2: FIELDDefault label-3: POSInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

UJFLDLIT Job entry field literal.

Field type: 01000000 - Extended user informationDefault label-1: J-EDefault label-2: FIELDDefault label-3: LITInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 412: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Extended User Fields Fieldname List

8-16 Auditing and Report Writing Guide

The 01010000 segment fields will produce a report containing all the before and after valueslogged as a result of updating the extended user data. (This is done with transactions AUSRand UUSR). This report will be displayed in a vertical format, with multiple output lines perrecord (one line per field).

Field Description

USRVALD Extended user field description.

Default label-1: EXTENDED USERDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 01010000 - Extended user data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 25Default output format: Transformed (T)

X'01'....T'EXTENDED USER DESCRIPTION'X'02'....T'EXTENDED USER SEQ FOR ASM'X'03'....T'EXTENDED USER STATUS 'X'04'....T'EXTENDED USER ACTION 'X'05'....T'EXT-USER JOB-ENT FLD NAME'X'06'....T'EXT-USER JOB-ENT FLD POS 'X'07'....T'EXT-USER JOB-ENT LITERAL 'X'08'....T'EXT-USER TASKID FLD NAME 'X'09'....T'EXT-USER TASKID FLD LEN 'X'0A'....T'EXT-USER TASKID FLD POS '

USRVALB Extended user value before update.

Default label-1: BEFOREField type: 01010000 - Extended user data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

USRVALA Extended user value after update.

Default label-1: AFTERField type: 01010000 - Extended user data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Extended UserData List

Page 413: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Extended User Fields

Chapter 8. ALRTVVAU Audit File Report 8-17

The 01020000 segment fields allow you to produce a report by selecting specific extendeduser fields.

Field Description

UCOMMENT Extended user comment.

Default label-1: EXTENDEDDefault label-1: USERDefault label-1: DESCRIPTIONField type: 01020000 - Extended user valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

UASMSEQ Extended user comment.

Default label-1: EXTDefault label-1: USERDefault label-1: SEQUENCEField type: 01020000 - Extended user valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

USTATUS Extended user status.

Default label-1: EXTDefault label-1: USERDefault label-1: STATUSField type: 01020000 - Extended user valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

(continued)

Extended UserValues

Page 414: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Extended User Fields Fieldname List

8-18 Auditing and Report Writing Guide

Field Description

UACTION Extended user action.

Default label-1: EXTDefault label-1: USERDefault label-1: ACTIONField type: 01020000 - Extended user valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'...........T'NONE 'C'C'...........T'CANCEL 'C'W'...........T'WTO/LOG'C'L'...........T'LOG '

UJEFLNM Extended user job entry field name.

Default label-1: EXTUSRDefault label-1: JOB-ENTDefault label-1: FLDNAMEField type: 01020000 - Extended user valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

UJEFLPO Extended user job entry field position.

Default label-1: EXTUSRDefault label-1: JOB-ENTDefault label-1: FLDPOSField type: 01020000 - Extended user valuesInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

UJEFLLI Extended user job entry literal.

Default label-1: EXTUSRDefault label-1: JOB-ENTDefault label-1: LITERALField type: 01020000 - Extended user valuesInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 415: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Extended User Fields

Chapter 8. ALRTVVAU Audit File Report 8-19

The 01030000 segment fields allow you to select and report on specific extended-user recordtask ID build parameters.

Field Description

UTSKFLN Extended user TASKID field name.

Default label-1: EXTUSRDefault label-2: TASKIDDefault label-3: FLDNAMEField type: 01030000 - User task ID buildInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

UTSKFLL Extended user TASKID field length.

Default label-1: EXTUSRDefault label-2: TASKIDDefault label-3: FLDLENField type: 01030000 - User task ID buildInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

UTSKFLP Extended user TASKID field position.

Default label-1: EXTUSRDefault label-2: TASKIDDefault label-3: FLDPOSField type: 01030000 - User task ID buildInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

User Task ID BuildValues

Page 416: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Jobmask Fields Fieldname List

8-20 Auditing and Report Writing Guide

Jobmask Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile jobmask records (segment X'030x0000'). These fields will be printed only on report detaillines with other jobmask update record and common segment fieldnames.

Field Description

JMSKTASK Jobmask TASKID this rule applies to.

Default label-1: JOBMASKDefault label-2: TASKIDField type: 03000000 - Jobmask fieldsInput data length: 16Input data format: Character (C)Default output length: 8Default output format: Character (C)

The 03010000 segment records can be used to produce a report showing all before and afterinformation logged as a result of adding or updating jobmask data. (This is done withtransactions AJOB and UJOB). The report produced is in vertical format with multiple outputlines per audit record (one line per field).

Field Description

JOBVALD Jobmask parameter description.

Default label-1: JOBMASKDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 03010000 - Jobmask fields data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 26Default output format: Transformed (T)

X'01'....T'JOBMASK DESCRIPTION 'X'02'....T'JOBMASK ASSEMBLER SEQUENCE'X'03'....T'JOBMASK STATUS 'X'04'....T'JOBMASK ACTION 'X'05'....T'JOBMASK TASKID 'X'06'....T'JOBMASK BUILD OPERATORS '

(continued)

Jobmask FieldsData List

Page 417: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Jobmask Fields

Chapter 8. ALRTVVAU Audit File Report 8-21

Field Description

JOBVALB Jobmask parameter value before update.

Default label-1: BEFOREField type: 03010000 - Jobmask field data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

JOBVALA Jobmask parameter value before update.

Default label-1: AFTERField type: 03010000 - Jobmask field data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

The 03020000 segment information can be used to produce reports to report on specific fieldsthat can be updated in the jobmask records.

Field Description

JMSKDESC Jobmask description.

Default label-1: JOBMASKDefault label-2: DESCRIPTIONField type: 03020000 - Jobmask field data valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

JMSKSEQ Jobmask sequence to read into assembler.

Default label-1: JOBMASKDefault label-2: SEQUENCEField type: 03020000 - Jobmask field data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Jobmask Field DataValues

Page 418: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Jobmask Fields Fieldname List

8-22 Auditing and Report Writing Guide

Field Description

JMSKSTAT Jobmask status.

Default label-1: JOBMASKDefault label-2: STATUSField type: 03020000 - Jobmask field data valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

JMSKACT Jobmask action.

Default label-1: JOBMASKDefault label-2: ACTIONField type: 03020000 - Jobmask field data valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

JMSKSECL Jobmask sequence to read into assembler.

Default label-1: JOBMASKDefault label-2: SECIDDefault label-3: LENGTHField type: 03020000 - Jobmask field data valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 1Default output format: Zoned-decimal (Z)

JMSKTSID Jobmask TASKID this rule applies to.

Default label-1: JOBMASKDefault label-2: SECIDDefault label-3: TASKIDField type: 03020000 - Jobmask field data valuesInput data length: 16Input data format: CHaracter (C)Default output length: 8Default output format: Character (C)

(continued)

Page 419: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Jobmask Fields

Chapter 8. ALRTVVAU Audit File Report 8-23

Field Description

JMSKBLD Jobmask build operators.

Default label-1: JOBMASKDefault label-2: BUILDDefault label-3: OPERATORSField type: 03020000 - Jobmask field data valuesInput data length: 16Input data format: CHaracter (C)Default output length: 8Default output format: Character (C)

Page 420: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Maintenance Fields Fieldname List

8-24 Auditing and Report Writing Guide

SECID Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile SECID maintenance records (segment X'050x0000'). These fields will be printed only onreport detail lines with other SECID maintenance record and common segment fieldnames.

Field Description

SECID Security ID.

Default label-1: SECIDField type: 05000000 - SECID maintenance fieldsInput data length: 16Input data format: Character (C)Default output length: 8Default output format: Character (C)

The 05010000 segment information can be used to produce reports showing all SECIDmaintenance activity. The report is produced in a vertical format, with multiple lines perSECID maintenance record (one line per field).

Field Description

SECVALD SECID parameter description.

Default label-1: SECIDDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 05010000 - SECID maintenance data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 24Default output format: Transformed (T)

X'01'.........T'SECID ASSEMBLER SEQUENCE'X'02'.........T'SECID LENGTH 'X'03'.........T'SECID STATUS 'X'04'.........T'SECID PASSWORD TYPE 'X'05'.........T'SECID DESCRIPTION 'X'06'.........T'SECID ACTION 'X'07'.........T'SECID SOURCE 'X'08'.........T'SECID PASSWORD 'X'09'.........T'SECID MODE 'X'0A'.........T'SECID NODE 'X'0B'.........T'SECID RJEUID '

(continued)

SECIDMaintenance DataList

Page 421: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List SECID Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-25

Field Description

SECVALB SECID parameter value before change.

Default label-1: BEFOREField type: 05010000 - SECID maintenance data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

SECVALA SECID parameter value after change.

Default label-1: AFTERField type: 05010000 - SECID maintenance data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

The 05020000 segment information can be used to produce reports showing before and afterdata for individual fields contained in the SECID maintenance records.

Field Description

SECSEQ SECID sequence.

Default label-1: SECIDDefault label-2: RECORDDefault label-3: SEQUENCEField type: 05020000 - SECID maintenance fieldsInput data length: 8Input data format: Hexadecimal (X)Default output length: 8Default output format: Character (C)

SECSTAT SECID status.

Default label-1: SECIDDefault label-2: STATUSField type: 05020000 - SECID maintenance fieldsInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

(continued)

SECIDMaintenance Fields

Page 422: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Maintenance Fields Fieldname List

8-26 Auditing and Report Writing Guide

Field Description

SECPWTYP SECID password type.

Default label-1: SECIDDefault label-2: PSWDDefault label-3: TYPEField type: 05020000 - SECID maintenance fieldsInput data length: 1Input data format: Character (C)Default output length: 5Default output format: Transformed (T)

C'I'............T'// ID'C'P'............T'POWER'

SECDESC SECID description.

Default label-1: SECIDDefault label-2: DESCRIPTIONField type: 05020000 - SECID maintenance fieldsInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

SECIACT SECID action.

Default label-1: SECIDDefault label-3: ACTIONField type: 05020000 - SECID maintenance fieldsInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

SECSOURC SECID source.

Default label-1: SECIDDefault label-3: SOURCEField type: 05020000 - SECID maintenance fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 423: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List SECID Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-27

Field Description

SECMODE SECID mode.

Default label-1: SECIDDefault label-3: MODEField type: 05020000 - SECID maintenance fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SECNODE SECID RJE node.

Default label-1: SECIDDefault label-3: RJENODEField type: 05020000 - SECID maintenance fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SECRUID SECID RJE user ID.

Default label-1: SECIDDefault label-3: RJEUIDField type: 05020000 - SECID maintenance fieldsInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

Page 424: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD Dataset Maintenance Fields Fieldname List

8-28 Auditing and Report Writing Guide

DASD Dataset Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile DASD dataset maintenance records (segment X'06000000'). These fields will be printedonly on report detail lines with other DASD dataset maintenance and common segmentfieldnames.

Field Description

DASDDSNM DASD dataset name.

Default label-1: DASDDefault label-2: DATASETDefault label-3: NAMEField type: 06000000 - DASD dataset maintenance informationInput data length: 44Input data format: Character (C)Default output length: 44Default output format: Character (C)

DASDVOL DASD dataset volume serial number.

Default label-1: DASDDefault label-2: VOLSERDefault label-3: NUMBERField type: 06000000 - DASD dataset maintenance informationInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

Page 425: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List DASD Dataset Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-29

The 06010000 segment records can be used to produce reports which show all before andafter data logged as a result of any DASD dataset maintenance activity. The report isproduced in a vertical format, with multiple output lines per record (one line per field).

Field Description

DASDVALD DASD dataset parameter description.

Default label-1: DASD DATASETDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 06010000 - DASD dataset data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 17Default output format: Transformed (T)

X'01'...........T'DASD SECID 'X'02'...........T'DASD ACTION 'X'03'...........T'DASD ACCESS LEVEL'X'04'...........T'DASD DESCRIPTION 'X'05'...........T'DASD STATUS '

DASDVALB DASD dataset value before change.

Default label-1: BEFOREField type: 06010000 - DASD dataset data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

DASDVALA DASD dataset value after change.

Default label-1: AFTERField type: 06010000 - DASD dataset data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

DASD Dataset DataList

Page 426: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD Dataset Maintenance Fields Fieldname List

8-30 Auditing and Report Writing Guide

The 06020000 segment records can be used to report on before and after data for individualDASD dataset fields.

Field Description

DASDSEC DASD dataset SECID/program.

Default label-1: DASDDefault label-2: SECID/Default label-3: PROGRAMField type: 06020000 - DASD dataset data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

DASDIACT DASD action.

Default label-1: DASDDefault label-2: ACTIONField type: 06020000 - DASD dataset data valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

DASDACCS DASD access level.

Default label-1: DASDDefault label-2: ACCESSDefault label-3: LEVELField type: 06020000 - DASD dataset data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

DASDDESC DASD description.

Default label-1: DASDDefault label-2: DESCRIPTIONField type: 06020000 - DASD dataset data valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

(continued)

DASD Dataset DataValues

Page 427: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List DASD Dataset Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-31

Field Description

DASDSTAT DASD status.

Default label-1: DASDDefault label-2: STATUSField type: 06020000 - DASD dataset data valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

Page 428: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Tape Dataset Maintenance Fields Fieldname List

8-32 Auditing and Report Writing Guide

Tape Dataset Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile tape dataset maintenance records segment (X'07000000'). These fields will be printedonly on report detail lines with other tape dataset maintenance and common segmentfieldnames.

Field Description

TAPEDSNM Tape dataset name.

Default label-1: TAPEDefault label-2: DATASETDefault label-3: NAMEField type: 07000000 - TAPE dataset maintenance informationInput data length: 44Input data format: Character (C)Default output length: 44Default output format: Character (C)

Page 429: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Tape Dataset Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-33

The 07010000 segment records can be used to produce reports which show all before andafter data logged as a result of any tape dataset maintenance activity. The report is producedin a vertical format, with multiple output lines per record (one line per field).

Field Description

TAPEVALD Tape dataset parameter description.

Default label-1: TAPE DATASETDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 07010000 - Tape dataset data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 17Default output format: Transformed (T)

X'01'...........T'TAPE SECID 'X'02'...........T'TAPE ACTION 'X'03'...........T'TAPE ACCESS LEVEL'X'04'...........T'TAPE DESCRIPTION 'X'05'...........T'TAPE STATUS '

TAPEVALB Tape dataset value before change.

Default label-1: BEFOREField type: 07010000 - Tape dataset data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

TAPEVALA Tape dataset value after change.

Default label-1: AFTERField type: 07010000 - Tape dataset data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Tape Dataset DataList

Page 430: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Tape Dataset Maintenance Fields Fieldname List

8-34 Auditing and Report Writing Guide

The 07020000 segment records can be used to report on before and after data for individualtape dataset fields.

Field Description

TAPESEC Tape dataset SECID/program.

Default label-1: TAPEDefault label-2: SECID/Default label-3: PROGRAMField type: 07020000 - Tape dataset data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TAPEIACT Tape action.

Default label-1: TAPEDefault label-2: ACTIONField type: 07020000 - Tape dataset data valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

TAPEACCS Tape access level.

Default label-1: TAPEDefault label-2: ACCESSDefault label-3: LEVELField type: 07020000 - Tape dataset data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

TAPEDESC Tape description.

Default label-1: TAPEDefault label-2: DESCRIPTIONField type: 07020000 - Tape dataset data valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

(continued)

Tape Dataset DataValues

Page 431: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Tape Dataset Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-35

Field Description

TAPESTAT Tape status.

Default label-1: TAPEDefault label-2: STATUSField type: 07020000 - Tape dataset data valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

Page 432: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Maintenance Fields Fieldname List

8-36 Auditing and Report Writing Guide

Resource Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile resource maintenance records (segment X'08000000'). These fields will be printed onlyon report detail lines with other resource maintenance and common segment fieldnames.

Field Description

RESCLASS Resource class.

Default label-1: RESOURCEDefault label-2: CLASSField type: 08000000 - Resource maintenance informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESNAME Resource name.

Default label-1: RESOURCEDefault label-2: NAMEField type: 08000000 - Resource maintenance informationInput data length: 52Input data format: Character (C)Default output length: 52Default output format: Character (C)

Page 433: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Resource Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-37

The 08010000 segment records can be used to produce reports which show all before andafter data logged as a result of any resource maintenance activity. The report is produced in avertical format, with multiple output lines per record (one line per field).

Field Description

RESVALD Resource parameter description.

Default label-1: RESOURCEDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 08010000 - Resource data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 21Default output format: Transformed (T)

X'01'...........T'RESOURCE SECID 'X'02'...........T'RESOURCE ACTION 'X'03'...........T'RESOURCE ACCESS LEVEL'X'04'...........T'RESOURCE DESCRIPTION 'X'05'...........T'RESOURCE STATUS '

RESVALB Resource value before change.

Default label-1: BEFOREField type: 08010000 - Resource data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

RESVALA Resource value after change.

Default label-1: AFTERField type: 08010000 - Resource data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Resource Data List

Page 434: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Maintenance Fields Fieldname List

8-38 Auditing and Report Writing Guide

The 08020000 segment records can be used to report on before and after data for individualresource fields.

Field Description

RESSECID Resource SECID/program.

Default label-1: RESOURCEDefault label-2: SECID/Default label-3: PROGRAMField type: 08020000 - Tape dataset data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESIACT Resource action.

Default label-1: RESOURCEDefault label-2: ACTIONField type: 08020000 - Resource data valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

RESACCS Resource access level.

Default label-1: RESOURCEDefault label-2: ACCESSDefault label-3: LEVELField type: 08020000 - Resource data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

RESDESC Resource description.

Default label-1: RESOURCEDefault label-2: DESCRIPTIONField type: 08020000 - Resource data valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

(continued)

Resource DataValues

Page 435: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Resource Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-39

Field Description

RESSTAT Resource status.

Default label-1: RESOURCEDefault label-2: STATUSField type: 08020000 - Resource data valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

Page 436: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Library Maintenance Fields Fieldname List

8-40 Auditing and Report Writing Guide

Library Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile library maintenance records (segment X'09000000'). These fields will be printed only onreport detail lines with other library maintenance and common segment fieldnames.

Field Description

LIBCLASS Library class.

Default label-1: LIBRARYDefault label-2: CLASSField type: 09000000 - Library maintenance informationInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

LIBNAME Library name.

Default label-1: LIBRARYDefault label-2: NAMEField type: 09000000 - Resource maintenance informationInput data length: 52Input data format: Character (C)Default output length: 52Default output format: Character (C)

Page 437: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Library Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-41

The 09010000 segment records can be used to produce reports which show all before andafter data logged as a result of any library maintenance activity. The report is produced in avertical format, with multiple output lines per record (one line per field).

Field Description

LIBVALD Library parameter description.

Default label-1: LIBRARYDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 09010000 - Library data listInput data length: 1Input data format: Hexadecimal (X)Default output length: 20Default output format: Transformed (T)

X'01'...........T'LIBRARY SECID 'X'02'...........T'LIBRARY ACTION 'X'03'...........T'LIBRARY ACCESS LEVEL'X'04'...........T'LIBRARY DESCRIPTION 'X'05'...........T'LIBRARY STATUS '

LIBVALB Library value before change.

Default label-1: BEFOREField type: 09010000 - Library data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

LIBVALA Library value after change.

Default label-1: AFTERField type: 09010000 - Library data listInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

Library Data List

Page 438: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Library Maintenance Fields Fieldname List

8-42 Auditing and Report Writing Guide

The 09020000 segment records can be used to report on before and after data for individuallibrary fields.

Field Description

LIBSECID Library SECID/program.

Default label-1: LIBRARYDefault label-2: SECID/Default label-3: PROGRAMField type: 09020000 - Library data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

LIBIACT Library action.

Default label-1: LIBRARYDefault label-2: ACTIONField type: 09020000 - Library data valuesInput data length: 1Input data format: Character (C)Default output length: 7Default output format: Transformed (T)

C'*'............T'NONE 'C'C'............T'CANCEL 'C'W'............T'WTO/LOG'C'L'............T'LOG '

LIBACCS Library access level.

Default label-1: LIBRARYDefault label-2: ACCESSDefault label-3: LEVELField type: 09020000 - Library data valuesInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

LIBDESC Library description.

Default label-1: LIBRARYDefault label-2: DESCRIPTIONField type: 09020000 - Library data valuesInput data length: 30Input data format: Character (C)Default output length: 30Default output format: Character (C)

(continued)

Library Data Values

Page 439: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Library Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-43

Field Description

LIBSTAT Library status.

Default label-1: LIBRARYDefault label-2: STATUSField type: 09020000 - Library data valuesInput data length: 1Input data format: Character (C)Default output length: 8Default output format: Transformed (T)

C'A'...........T'ACTIVE 'C'D'...........T'DISABLED'C'L'...........T'LOG 'C'M'...........T'MONITOR 'C'T'...........T'AUDIT 'C'W'...........T'WTO/LOG '

LIBCLB Controlled library (YES or NO).

Default label-1: LIBDefault label-2: CLBField type: 09020000 - Resource data valuesInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'...........T'YES'C'N'...........T'NO '

Page 440: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Rules Table Maintenance Fields Fieldname List

8-44 Auditing and Report Writing Guide

Rules Table Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile rules table maintenance records (segment X'0A0x0000'). These fields will be printed onlyon report detail lines with other rules table maintenance and common segment fieldnames.

Field Description

CALRVALD Rules table maintenance parameter description.

Default label-1: CALRDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 0A010000 - Convert rules parameter valuesInput data length: 1Input data format: Hexadecimal (X)Default output length: 24Default output format: Transformed (T)

X'01'...........T'CALR RUN TYPE 'X'02'...........T'CALR TABLE NUMBER 'X'03'...........T'CALR TABLE NAME 'X'04'...........T'CALR SID PARAMETER 'X'05'...........T'CALR EXEC PARAMETER 'X'06'...........T'CALR TABLE DISPOSITION 'X'07'...........T'CALR TABLE LIBRARY NAME'

CALRVALB Rules table maintenance value before change.

Default label-1: BEFOREField type: 0A010000 - Convert rules parameter valuesInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

CALRVALA Rules table maintenance value after change.

Default label-1: AFTERField type: 0A010000 - Convert rules parameter valuesInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 441: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Rules Table Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-45

The 0A020000 segment records can be used to report on before and after data for individualrules table maintenance fields.

Field Description

CALRRTYP CALR run type.

Default label-1: CALRDefault label-2: RUNDefault label-3: TYPEField type: 0A020000 - Convert rules before/afterInput data length: 3Input data format: Character (C)Default output length: 21Default output format: Transformed (T)

C'X '.....T'CONVERT 'C'XX '.....T'CONVERT/ASSEMBLE 'C'XXX'.....T'CONVERT/ASSEMBLE/LOAD'

CALRTNUM CALR table number.

Default label-1: CALRDefault label-2: TABLEDefault label-3: NUMBERField type: 0A020000 - Convert rules before/afterInput data length: 2Input data format: Character (C)Default output length: 2Default output format: Character (C)

CALRTNAM CALR table name.

Default label-1: CALRDefault label-2: TABLEDefault label-3: NAMEField type: 0A020000 - Convert rules before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

CALRSID CALR SID parameter.

Default label-1: CALRDefault label-2: SIDDefault label-3: PARAMETERField type: 0A020000 - Convert rules before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Rules TableMaintenance DataValues

Page 442: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Rules Table Maintenance Fields Fieldname List

8-46 Auditing and Report Writing Guide

Field Description

CALREXEC CALR EXEC parameter.

Default label-1: CALRDefault label-2: EXECDefault label-3: PARAMETERField type: 0A020000 - Convert rules before/afterInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

CALRTDSP CALR table disposition.

Default label-1: CALRDefault label-2: TABLEDefault label-3: DISPField type: 0A020000 - Convert rules before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

CALRLIBR CALR library name.

Default label-1: CALRDefault label-2: TABLEDefault label-3: LIBRARYField type: 0A020000 - Convert rules before/afterInput data length: 16Input data format: Character (C)Default output length: 16Default output format: Character (C)

Page 443: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Control File Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-47

Control File Maintenance Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU inputfile control file maintenance records (segment X'0B0x0000'). These fields will be printedonly on report detail lines with other control file maintenance and common segmentfieldnames.

Field Description

SCFLVALD Control file maintenance parameter description.

Default label-1: SCFLDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: 0B010000 - System control file parametersInput data length: 1Input data format: Hexadecimal (X)Default output length: 26Default output format: Transformed (T)

X'01'........T'SCFL RUN TYPE 'X'02'........T'SCFL PRODUCT CODE 'X'03'........T'SCFL TABLE NAME 'X'04'........T'SCFL SID PARM 'X'05'........T'SCFL CHECK $$B PARM 'X'06'........T'SCFL LOG FULL PARM 'X'07'........T'SCFL TEST PARM 'X'08'........T'SCFL WTO PARM 'X'09'........T'SCFL PROTECT PARM 'X'0A'........T'SCFL LOG PARM 'X'0B'........T'SCFL LOG EXEC PARM 'X'0C'........T'SCFL IDENCR PARM 'X'0D'........T'SCFL LOGSER PARM 'X'0E'........T'SCFL CARDIN PARM 'X'0F'........T'SCFL CANCEL PARM 'X'10'........T'SCFL EMERGENCY JOBNAME 'X'11'........T'SCFL EMERGENCY PASSWORD 'X'12'........T'SCFL MONITOR PARMS 'X'13'........T'SCFL MONITOR SUSPEND PARMS'

SCFLVALB Control file maintenance value before change.

Default label-1: BEFOREField type: 0B010000 - System control file parametersInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

(continued)

Page 444: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Control File Maintenance Fields Fieldname List

8-48 Auditing and Report Writing Guide

Field Description

SCFLVALA Control file maintenance value after change.

Default label-1: AFTERField type: 0B010000 - System control file parametersInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

The 0B020000 segment records can be used to report on before and after data for individualrules table maintenance fields.

Field Description

SCFLRTYP SCFL run type.

Default label-1: SCFLDefault label-2: RUNDefault label-3: TYPEField type: 0B020000 - System control file before/afterInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

SCFLTNAM SCFL table name.

Default label-1: SCFLDefault label-2: TABLEDefault label-3: NAMEField type: 0B020000 - System control file before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Control FileMaintenance DataValues

Page 445: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Control File Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-49

Field Description

SCFLSID SCFL SID parameter.

Default label-1: SCFLDefault label-2: SIDDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SCFLCK$B SCFL check $$B parameter.

Default label-1: SCFLDefault label-2: CHKDefault label-3: $$BField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SCFLFULL SCFL LOGFULL parameter.

Default label-1: SCFLDefault label-2: LOGFULLDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 6Input data format: Character (C)Default output length: 6Default output format: Character (C)

SCFLTEST SCFL TEST parameter.

Default label-1: SCFLDefault label-2: TESTDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 446: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Control File Maintenance Fields Fieldname List

8-50 Auditing and Report Writing Guide

Field Description

SCFLWTO SCFL WTO parameter.

Default label-1: SCFLDefault label-2: WTODefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SCFLPRO SCFL PROTECT parameter.

Default label-1: SCFLDefault label-2: PROTDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SCFLLOG SCFL LOG parameter.

Default label-1: SCFLDefault label-2: LOGDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 4Input data format: Character (C)Default output length: 4Default output format: Character (C)

SCFLLEXC SCFL LOGEXEC parameter.

Default label-1: SCFLDefault label-2: LOGDefault label-3: EXECField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 447: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Control File Maintenance Fields

Chapter 8. ALRTVVAU Audit File Report 8-51

Field Description

SCFLIDEN SCFL IDENCR parameter.

Default label-1: SCFLDefault label-2: IDENCRDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SCFLLSER SCFL LOGSER parameter.

Default label-1: SCFLDefault label-2: LOGSERDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SCFLCARD SCFL CARDIN parameter.

Default label-1: SCFLDefault label-2: CARDINDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

SCFLCNCL SCFL CANCEL parameter.

Default label-1: SCFLDefault label-2: CANCELDefault label-3: PARMField type: 0B020000 - System control file before/afterInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

(continued)

Page 448: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Control File Maintenance Fields Fieldname List

8-52 Auditing and Report Writing Guide

Field Description

SCFLEJOB SCFL emergency override jobname.

Default label-1: SCFLDefault label-2: EMERGENCYDefault label-3: JOBNAMEField type: 0B020000 - System control file before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

SCFLMON SCFL monitor parameters.

Default label-1: SCFLDefault label-2: MONITORDefault label-3: PARMSField type: 0B030000 - System control monitor parametersInput data length: 20Input data format: Character (C)Default output length: 20Default output format: Character (C)

SCFLMONS SCFL monitor suspend parameters.

Default label-1: SCFLDefault label-2: MONITORDefault label-3: SUSPENDField type: 0B030000 - System control monitor parametersInput data length: 3Input data format: Character (C)Default output length: 3Default output format: Character (C)

Page 449: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Node Information Fields

Chapter 8. ALRTVVAU Audit File Report 8-53

Node Information Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAU nodeinformation records (segment X'C00x0000').

Field Description

NODEVALD Node name parameter description.

Default label-1: NODENAMEDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: C0010000 - Node name before/afterInput data length: 1Input data format: Hexadecimal (X)Default output length: 26Default output format: Transformed (T)

X'01'......'NODE NAME 'X'02'......'NODE OPERATING SYSTEM CODE'X'03'......'NODE ORIGIN/TARGET 'X'04'......'NODE SECURED SYSTEM '

NODEVALB Node name parameter value before update.

Default label-1: BEFOREField type: C0010000 - Node name before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

NODEVALA Node name parameter value after update.

Default label-1: AFTERField type: C0010000 - Node name before/afterInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

NODENAME Node name.

Default label-1: NODEDefault label-2: NAMEField type: C0020000 - Node name parametersInput data length: 8Input data format: Character (C)Default output length: 8Default output format: Character (C)

(continued)

Page 450: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Node Information Fields Fieldname List

8-54 Auditing and Report Writing Guide

Field Description

OPSYSCOD Operating system code.

Default label-1: OPDefault label-2: SYSDefault label-3: CODEField type: C0020000 - Node name parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

ORGTARGT Origin/Target/Both.

Default label-1: ORIGINDefault label-2: ORDefault label-3: TARGETField type: C0020000 - Node name parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

SECDSYS Secured system (Y or N).

Default label-1: SECDefault label-2: SYSField type: C0020000 - Node name parametersInput data length: 1Input data format: Character (C)Default output length: 3Default output format: Transformed (T)

C'Y'.....'YES'C'N'.....'NO '

Page 451: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Fieldname List Remote Submittal Information Fields

Chapter 8. ALRTVVAU Audit File Report 8-55

Remote Submittal Information Fields

The following fieldnames can be included in any ALRTVVAU report SUBTITLE, FIELD,or FIELDS command statements. These fieldnames are contained in the ALRTVVAUremote submittal records (segment X'C10x0000').

Field Description

REMVALD Remote submittal parameter description.

Default label-1: REMOTEDefault label-2: PARAMETERDefault label-3: DESCRIPTIONField type: C1010000 - Remote submit before/afterInput data length: 1Input data format: Hexadecimal (X)Default output length: 30Default output format: Transformed (T)

X'01'......'REMOTE SUBMITTAL TARGET CLASS 'X'02'......'REMOTE SUBMITTAL CLASS ID 'X'03'......'REMOTE SUBMITTAL TARGET SYSID 'X'04'......'REMOTE SUBMITTAL SYSID ID INFO'

REMVALB Remote submittal parameter value before update.

Default label-1: BEFOREField type: C1010000 - Remote submit before/afterInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

REMVALA Remote submittal parameter value after update.

Default label-1: AFTERField type: C1010000 - Remote submit before/afterInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

REMCLASS Target class.

Default label-1: TARGETDefault label-2: CLASSField type: C1020000 - Remote submit parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

(continued)

Page 452: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Remote Submittal Information Fields Fieldname List

8-56 Auditing and Report Writing Guide

Field Description

REMCLSID Type of ID information.

Default label-1: TYPEDefault label-2: OFDefault label-3: IDField type: C1020000 - Remote submit parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Transformed (T)

C'$'......'$$ JOB'C'/'......'// ID 'C'N'......'NONE '

REMSYSID Target SYSID.

Default label-1: TARGETDefault label-2: SYSIDField type: C1030000 - Remote submit parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Character (C)

REMSIDID Type of ID information.

Default label-1: TYPEDefault label-2: OFDefault label-3: IDField type: C1030000 - Remote submit parametersInput data length: 1Input data format: Character (C)Default output length: 1Default output format: Transformed (T)

C'$'......'$$ JOB'C'/'......'// ID 'C'N'......'NONE '

Page 453: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVAU Reports Introduction

Chapter 8. ALRTVVAU Audit File Report 8-57

Sample ALRTVVAU Reports

Introduction

Many different reports can be produced from the information in the BIM-ALERT/VSE auditfile, depending on which types of changes you want to review. This section includes sampleinput commands and resulting output for several such reports. These sample reports areexamples from which further reports can be designed; they are not intended to show all thereports that can be produced using the audit data.

The input statements of the sample ALRTVVAU reports that follow can be found in the BIM-ALERT installation library in member ALRTVVAU.J.

Page 454: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

DASD Dataset Change Report Sample ALRTVVAU Reports

8-58 Auditing and Report Writing Guide

DASD Dataset Change Report

The following sample input can be used to produce a report showing changes made DASDdataset records. Note the use of the SELECT IF command to limit the report to only thosefields that changed.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVAU TITLES 'B I M - A L E R T / V S E' - '* * AUDIT FILE REPORT * *' SUBTITLE DASDDSNM LABEL('DATASET NAME:') LINE(2) JUSTIFY(L) - SORTPRTY(1) SUBTITLE DASDVOL LABEL(' VOLSER:') LINE(3) JUSTIFY(L) - SORTPRTY(2) FIELD DATE SORTPRTY(3) CTLBREAK(S) REPCHAR(' ') FIELD TIME SORTPRTY(4) CTLBREAK(Y) REPCHAR(' ') FIELDS DASDVALD DASDVALB DASDVALA SELECT IF TRANID EQ C'UDDS' AND DASDVALB NE DASDVALA RUN/*

The preceding sample input produces the following report:

DATE: 03/25/1998 09:15:13 PAGE: 000002 B I M - A L E R T / V S E * * AUDIT FILE REPORT * *

DATASET NAME: =.=.=.=.=.=.=.= VOLSER: . DASD CHANGE CHANGE PARAMETER DATE TIME DESCRIPTION BEFORE AFTER ------ ------ ----------- ------ ----- 08/22/1997 06:47:29 DASD STATUS A D DASD STATUS A D 11/05/1997 10:32:14 DASD SECID SEC= = 13:51:11 DASD SECID SYSADMIN SYSA= 10:32:14 DASD STATUS D A 13:18:59 DASD STATUS A M 10:32:14 DASD DESCRIPTION ALLOW READ/UPDATE ALLOW READ ONLY ACCESS 10:32:13 DASD STATUS D A 10:42:02 DASD SECID SECADMIN SYSADMIN 10:32:14 DASD ACCESS LEVEL ALTER READ 10:32:13 DASD DESCRIPTION ALLOW ONLY READ ALLOW FULL ACCESS DASD ACCESS LEVEL READ ALTER 11/12/1997 16:39:29 DASD STATUS M A 08/01/1997 11:05:35 DASD STATUS A D 08/22/1997 06:46:12 DASD STATUS D A

Input

Output

Page 455: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Sample ALRTVVAU Reports Resource Change Report

Chapter 8. ALRTVVAU Audit File Report 8-59

Resource Change Report

The following sample input can be used to produce a report showing all updates to resourcerecords in a horizontal format.

A report showing the same information in a vertical format could be produced by specifyingthe fields RESVALB and RESVALA. The format shown here allows you to specify theindividual fields to be included in the report.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVAU TITLES 'B I M - A L E R T / V S E' - '* * AUDIT FILE REPORT * *' FIELD DATE CTLBREAK(S) FIELD TIME CTLBREAK(S) FIELDS ADMINID RESCLASS RESNAME RESSECID RESIACT RESACCS RESSTAT SELECT IF TRANID EQ C'UDIT' OR - /* UPDATES TO DITTO RULES */ TRANID EQ C'USUB' OR - /* UPDATES TO SUBLIB RULES */ TRANID EQ C'ULMB' /* UPDATES TO LIBMEM RULES */ RUN/*

The preceding sample input produces the following report:

DATE: 03/25/1998 10:37:52 PAGE: 000001 B I M - A L E R T / V S E * * AUDIT FILE REPORT * * RESOURCE RESOURCE CHANGE CHANGE ADMIN RESOURCE MEMBER RESOURCE RESOURCE ACCESS RESOURCE DATE TIME NUMBER CLASS NAME SECID ACTION LEVEL STATUS ------ ------ ------ -------- -------- -------- -------- -------- --------08/01/1997 11:37:19 A LIBMEM COLSYS6.ALT493.AXPI1.PHASE SECADMIN NONE EXEC ACTIVE08/01/1997 11:37:19 A LIBMEM COLSYS6.ALT493.AXPI1.PHASE SECADMIN WTO/LOG EXEC ACTIVE08/01/1997 15:11:17 A LIBMEM COLSYS6.ALT493.=.= SECADMIN WTO/LOG EXEC ACTIVE08/01/1997 15:11:17 A LIBMEM COLSYS6.ALT493.=.= SECADMIN NONE ALTER ACTIVE08/26/1997 08:44:13 A LIBMEM COLSYS6.ALT493.=.= SECADMIN NONE ALTER ACTIVE08/26/1997 08:44:13 A LIBMEM COLSYS6.ALT493.=.= SECADMIN NONE ALTER ACTIVE03/25/1998 10:08:07 A SUBLIB BIMCOL.ALT50A = LOG ALTER ACTIVE03/25/1998 10:08:07 A SUBLIB BIMCOL.ALT50A = WTO/LOG ALTER ACTIVE03/25/1998 10:36:33 A DITTO COMMAND:NOPEN.DVT = WTO/LOG EXEC ACTIVE03/25/1998 10:36:33 A DITTO COMMAND:NOPEN.DVT = NONE EXEC ACTIVE

Input

Output

Page 456: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Control File Maintenance Report Sample ALRTVVAU Reports

8-60 Auditing and Report Writing Guide

Control File Maintenance Report

The following sample input can be used to produce a control file maintenance change report.Specifying the SCFLVALx fields causes the report to be produced in vertical format. Becauseno selection criteria are specified, all fields will be printed, whether or not they were changed.

// EXEC ALRTVREP,SIZE=256K REPORT ALRTVVAU TITLES 'B I M - A L E R T / V S E' - '* * AUDIT FILE REPORT * *' FIELD DATE SORTPRTY(1) CTLBREAK(S) REPCHAR(' ') FIELD TIME SORTPRTY(2) CTLBREAK(Y) REPCHAR(' ') FIELDS SCFLVALD SCFLVALB SCFLVALA SELECT IF TRANID EQ C'SCFL' RUN/*

The preceding sample input produces the following report:

DATE: 03/25/1998 10:49:01 PAGE: 000025 B I M - A L E R T / V S E * * AUDIT FILE REPORT * * SCFL CHANGE CHANGE PARAMETER DATE TIME DESCRIPTION BEFORE AFTER ------ ------ ----------- ------ ----- 03/13/1998 05:59:47 SCFL EMERGENCY JOBNAME . . SCFL LOGSER PARM . . SCFL MONITOR PARMS ALL,LOGREQ,WTOREQ ALL,LOGREQ,WTOREQ SCFL LOG EXEC PARM NO NO SCFL MONITOR SUSPEND PARMS FA FA SCFL EMERGENCY PASSWORD . . SCFL CANCEL PARM NO NO SCFL CARDIN PARM YES YES SCFL IDENCR PARM YES YES SCFL PROTECT PARM NO NO SCFL WTO PARM REQ REQ SCFL TEST PARM NO NO SCFL LOG FULL PARM IGNORE IGNORE SCFL CHECK $$B PARM NO NO SCFL LOG PARM NO NO SCFL SID PARM . . SCFL TABLE NAME . . SCFL RUN TYPE MODIFY MODIFY

Input

Output

Page 457: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

A-1

A

Additional BIM-ALERT/VSE Reports

This appendix describes BIM-ALERT/VSE batch reports produced by auditing and batchreport writing programs other than the BIM-ALERT batch report writer.

About This Appendix................................................................................................A-2Log File Integrity Report ..........................................................................................A-3Status Change Report................................................................................................A-4Dataset Name Report ................................................................................................A-7User Entry Report .....................................................................................................A-9Resource Class Report ............................................................................................A-11Program Execution Report......................................................................................A-13SECID/USER Job Summary Report.......................................................................A-14Control Totals Reports............................................................................................A-15SECID Authorized Resource Report ......................................................................A-16

Page 458: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

About This Appendix

A-2 Auditing and Report Writing Guide

About This Appendix

The reports described in this appendix are batch reports produced by auditing and batch reportwriting programs other than the BIM-ALERT batch report writer. The reports produced bysome of these programs can be duplicated or nearly duplicated by the BIM-ALERT batchreport writer. In those cases, the description of the program includes a reference to the BIM-ALERT batch report writer report most similar to the program's output.

The following reports are provided in the current release of BIM-ALERT/VSE:

• Log File Integrity• Status Change• Dataset Name• Use Entry• Resource Class• Program Execution• SECID/USER Job Summary• Control Totals• SECID Authorized Resource

Page 459: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Log File Integrity Report

Appendix A. Additional BIM-ALERT/VSE Reports A-3

Log File Integrity Report

The Log File Integrity Report summarizes all the log records read, on the basis of log eventdate. It shows the starting and ending log serial number for each date and notes any serialnumber exceptions. A serial number exception is recognized whenever serial numbers are notconsecutive. Non-consecutive serial numbers can result from any of the following conditions:

• A log file tape was omitted from the run.

• A system crash occurred, or the CPU was shut down without shutting down the logger.This can cause overlapping or duplicate serial numbers, because the control file may notcontain the correct starting serial number when the logger is started up again.

• The log file data has been deliberately altered, possibly to cover up unauthorized accessto a dataset or other resource.

(1) CPUID=FF039001 (2) (3) (4) (5) 03/17/1998 START SERIAL NUMBER 019807 TIME 05:23:06 JOBNAME AXPL1 03/17/1998 END SERIAL NUMBER 019885 TIME 19:59:13 JOBNAME EPICPTFB

03/19/1998 START SERIAL NUMBER 019994 TIME 06:16:15 JOBNAME AXPL1 *EXC* SERIAL NUMBER 019994 TIME 06:16:15 JOBNAME AXPL1 * MISSING 019886-019993 (6) 03/19/1998 END SERIAL NUMBER 020166 TIME 21:18:55 JOBNAME VSE1CICS

The following list explains the numbered items in the preceding sample report:

1. The CPUID of the machine where the log event occurred.

2. The date of the log event.

3. The serial number of the log event.

4. The time of day of the log event.

5. The // JOB name of the job that produced the log event.

6. Serial numbers 19886-19993 were not found in any of the data read, but numbers beforeand after that range were present. Apparently the data from 3/18/1998 was omittedfrom the reports.

Description

Sample Report

Explanation ofReport

Page 460: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Status Change Report

A-4 Auditing and Report Writing Guide

Status Change Report

The Status Change Report tracks change activity affecting the overall operation of the BIM-ALERT/VSE system. The events shown in this report are as follows:

Event Description

BIM-ALERT/VSEsystem startup

Normally this occurs at IPL.

Logger start-up Normally this occurs at IPL, shortly after system start-up.

Rules table update The rules table is loaded at system start-up. The identity of thetable loaded at that time is logged as part of the system start-updata. When a new rules table is loaded any other time, this islogged as a rules table update.

Rules table catalog A rules table can be cataloged into the library at any time. Thisevent is logged as a rules table catalog.

BIM-ALERT/VSEsystem modification

Some of the BIM-ALERT/VSE options, normally specified atstart-up time, can be modified later.

Inquiry The AXPL1 utility program accepts a MODE=INQUIREparameter. This causes the current status of the BIM-ALERT/VSE options to be logged.

BIM-ALERT/VSEsystem shutdown

Normally this occurs as part of the operating system shutdownprocedure, but it can occur at any time.

Logger shutdown BIM-ALERT/VSE system shutdown automatically shuts downthe logger. However, the logger can also be shut down at othertimes by using the AXPL3 utility program.

Description

Page 461: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Status Change Report

Appendix A. Additional BIM-ALERT/VSE Reports A-5

(1) (2) (3) (4)TYPE OF ACTION DATE TIME SERIAL OPTIONS IN FORCEAXP.STARTUP 03/17/1998 05:18:17 019816 (5) VER=5.0A CHK$$B=NO (6) EPW=XXXXXXXX | IPLPWD=XXXXXXXX | IPLNOSEC=XXXXXXXX | IDENCR=YES | DITTO=NO | LOGFULL=IGNORE | OBJ=ALERTB1,TABLE ID=B1 | ASSEMBLED=01/22/1998--06:01:42 | UPDATED=01/22/1998--06:01:24 | SID=ALERTB1 | PASS=6937 | LOG=REQ | WTO=REQ | PROTECT=NO | LOGEXEC=NO | MONITOR=(JOB=XXXXXXXX,PWD=XXXXXXXX) V MONITOR=(ALL,ALL,LOGREQ,WTOREQ) (6)

LOG.START 03/17/1998 05:23:06 019807 (7)

RULES.CATALG 03/18/1998 17:31:01 019962 (8) OBJ=ALERTB1 TABLE ID=B1 (9) ASSEMBLED 03/18/1998 17:31:00 | UPDATED 03/18/1998 17:29:15 | SID=AXPRULE V PASS=1493 (9)

AXP.MODIFY 03/18/1998 18:05:16 019981 (10)

AXP.SHUTDOWN 03/18/1998 18:30:29 019986 (11)

LOG.STOP 03/18/1998 18:30:41 019989 (12)

The following list explains the numbered items in the preceding sample Status Change Report:

1. TYPE OF ACTION describes the event being reported, such as start-up or shutdown.

2. DATE is the date of the event, in the format mm/dd/yyyy.

OPTIONS IN FORCE lists the BIM-ALERT/VSE system options that apply to theevent. These are not shown for events that change only the status of the logger.

3. TIME is the time of day the event occurred, in the format hh:mm:ss.

4. SERIAL is the serial number of the log record that was written to record the event.

5. This detail line shows the data for a start-up of the BIM-ALERT/VSE system.

(continued)

Sample Report

Explanation ofReport

Page 462: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Status Change Report

A-6 Auditing and Report Writing Guide

6. These are the options selected for the start-up. They are shown in the keyword formatin which they were read by the start-up utility AXPI1.

7. This detail line shows the time the logger was started.

8. This detail line shows the data for the catalog of a rules table.

9. These options describe the rules table that was cataloged. Other system options are notshown. The report data shown for a rules table update is similar to that shown for rulestable catalog. The TYPE OF ACTION for a rules table update is RULES.UPDATE.

10. This detail line shows the data for a system modification run using utility programAXPI1. All the system options that are in effect after the modify run is complete areshown in the report. (These are not shown in the sample report.)

11. This detail line shows the data for a system shutdown. All the system options that are ineffect at the time the system is shut down are shown in the report. (These are not shownin the sample report.)

12. This detail line shows the time the logger was shut down.

Page 463: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Dataset Name Report

Appendix A. Additional BIM-ALERT/VSE Reports A-7

Dataset Name Report

The Dataset Name Report shows log records generated as a result of access authorizationchecks for datasets. The report is sequenced on dataset name, and then by security ID withineach unique dataset name.

The BIM-ALERT batch report writer can produce a report similar to this report. Sample inputfor producing that report is given on page 6-31.

(1) (3) (4) (5) (6) DATASET NAME (7)VOLSER(8) (9) (10) (11) (12) (13) (14)(15) (16)(2)SECID USER LS JOB NAME REQ/ALLOW SRCE MODE DATE TIME --TABLE--IDENTITY-- PTN PHASE REA EXC SERIAL CICS.RSD SYSWK1 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/20/1998 19:29:29 B1 01/22/1998 06:01 F2 DFHSIP 17 M 68 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/20/1998 20:10:11 B1 01/22/1998 06:01 F2 DFHSIP 17 M 68 CICS.TD.INTRA SYSWK1 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/17/1998 05:19:48 B1 01/22/1998 06:01 F2 DFHSIP 17 M 68 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/17/1998 14:52:17 B1 01/22/1998 06:01 F2 DFHSIP 17 M 68 ICCF.LIBRARY SYSWK1 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/17/1998 05:19:28 B1 01/22/1998 06:01 F2 DTSANALS 17 M 68 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/17/1998 05:21:20 B1 01/22/1998 06:01 F2 DFHSIP 17 M 68 DEVELOP PCSMAINT C CICSICCF UPD/RD 0999 SPL 03/17/1998 14:51:45 B1 01/22/1998 06:01 F2 DTSANALS 17 M 68 P390CICS.DFHDMPA FBA001 UNKNOWN PG L VSE1CICS ALT/RD 0000 PNT 03/18/1998 06:00:45 B1 01/22/1998 06:01 F4 DFHSIP 17 M 68

The following explanation refers to the numbered notes in the preceding sample Dataset NameReport:

1. DATASET NAME shows the name of the dataset that was accessed.

2. SECID is the security ID of the job that requested access to the dataset.

3. USER LS is the user ID and the logon source code of the user submitting the job.

4. JOB NAME is the name from the // JOB statement.

5. REQ/ALLOW shows the level of access requested (REQ) and the highest level ofaccess allowed (ALLOW). For example, RD/EX indicates read access was requestedand execute access is the highest level allowed. Abbreviations of the levels of accessare as follows:

− EX Execute− RD Read− UPD Update− ALT Alter

6. VOLSER shows the volume serial number of the dataset. For VSAM datasets, this isthe VOLSER of the catalog in which the dataset is defined.

(continued)

Description

Similar BIM-ALERTBatch ReportWriter Report

Sample Report

Explanation ofReport

Page 464: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Dataset Name Report

A-8 Auditing and Report Writing Guide

7. SRCE shows the device address (source) by which the job entered the system.

8. MODE describes how the job entered the system. Possible values are as follows:

This Value Indicates the job entered

POW Via a POWER-controlled reader

SPL Via PUTSPOOL or XPCC

RJE Via a network facility defined with the PRMT and PLINE macros

PNT Via a network facility defined with the PNODE macro

EXT Outside the control of POWER

9. DATE is the date the log record was written, in the format mm/dd/yyyy.

10. TIME is the time of day the log record was written, in the format hhmmss.

11. TABLE IDENTITY shows the table ID and assembly date and time of the rules tablethat was in effect at the time the dataset was accessed.

12. PTN identifies the partition where the job was run.

13. PHASE is the name of the phase that was being executed when the dataset was opened.

14. REA shows a two-character reason code describing the type of action that initiated thelog record. The meaning of each of these codes is detailed in the BIM-ALERT/VSESecurity Administrator's Guide.

15. EXC is an exception flag that highlights unusual or unexpected conditions. Values forthis field are as follows:

Code Meaning

V A violation occurred. Access was denied.

M Access would have been denied, but was allowed because monitor modewas active.

O Access was allowed. Emergency override was in effect.

The EXC column is blank if a log record was written for a reason other than one of theexception conditions listed in the preceding table.

16. SERIAL shows the rules table serial number of the rule that caused the log record to bewritten. This corresponds to SEQUENCE NUMBER in the Rules Conversion Reportfrom program AXPU002.

Page 465: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Entry Report

Appendix A. Additional BIM-ALERT/VSE Reports A-9

User Entry Report

The User Entry Report shows data from log events that occurred during the job entryverification process. The report is sequenced on security ID, // ID USER, date, and time.

The BIM-ALERT batch report writer can produce a report similar to this report. Sample inputfor producing that report is given on page 6-33.

< - - - - - - - (1) - - - - - - > (3) (4) (5) (6) (7) (8) (9) (10) (11)SECID USER LOGON SUBMIT RJEUSER RJENODE POW NAME JOB# JOB NAME DATE TIME --TABLE--IDENTITY-- MODE SRCE PTN REA EXC SERIAL< - - - - - - (2) - - - - - - >DEVELOP FRED CMS CMS P390VSE ALRTVVSC 31748 ALRTVVSC 03/20/1998 09:08:14 B1 01/22/1998 06:01 POW 000C BG 20 ALRTRPT 31780 ALRTRPT 03/20/1998 12:45:34 B1 01/22/1998 06:01 POW 0000 F5 20UNKNOWN PG NOTVAL UNKNWN PG BIM SRVTRACE 30849 SRVTRACE 03/17/1998 18:09:49 B1 01/22/1998 06:01 PNT 0000 BG 0D M SRVTRACE 30851 SRVTRACE 03/17/1998 18:17:56 B1 01/22/1998 06:01 PNT 0000 BG 0D MNO-USER NO-USER UNKNWN UNKNWN P390VSE VSE1EDIT 31717 VSE1EDIT 03/19/1998 19:15:07 B1 01/22/1998 06:01 POW 000C Y1 07 M VTAMSTRT 31712 VTAMSTRT 03/20/1998 05:43:00 B1 01/22/1998 06:01 POW 000C F3 07 M

The following explanation refers to the numbered notes in the preceding sample User EntryReport:

1. SECID is the security ID developed by the job entry verification process.USER is the // ID USER parameter. If no // ID statement is present, then NOUSER isshown here.

LOGON is the location from which the user submitted the job. For example, if a usersubmitted the job from a CMS machine, LOGON would show CMS.

SUBMIT is the facility used to perform the job submission. For example, if the jobwere submitted through JCLMAN, SUBMIT would show JCLMAN.

2. POW NAME is the POWER job name. Valid values are as follows:

JOB# The POWER queue entry number

JOBNAME The name from the // JOB statement

3. RJEUSER is the RJE User ID field from the POWER job header record.

(continued)

Description

Similar BIM-ALERTBatch ReportWriter Report

Sample Report

Explanation ofReport

Page 466: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

User Entry Report

A-10 Auditing and Report Writing Guide

4. RJENODE is the RJE node field from the POWER job header record.

5. TABLE IDENTITY shows the table ID and assembly date and time of the rules tablethat was in effect at the time the job entry verification was performed.

6. MODE describes how the job entered the system. Possible values are as follows:

This Value Indicates the job entered

POW Via a POWER-controlled reader

SPL Via PUTSPOOL or XPCC

RJEs Via a network facility defined with the PRMT and PLINE macros

PNT Via a network facility defined with the PNODE macro

EXT Outside the control of POWER

7. SRCE describes the device address by which the job entered the system.

8. PTN identifies the partition where the job was run.

9. REA shows a two-character code describing why the event was logged. The meaning ofeach of these codes is detailed in the BIM-ALERT/VSE Security Administrator's Guide.

10. EXC is an exception flag that highlights unusual or unexpected conditions. Values forthis field are as follows:

Code Meaning

V A violation occurred. Access was denied.

M Access would have been denied, but was allowed because monitor modewas active.

O Access was allowed. Emergency override was in effect.

The EXC column is blank if a log record was written for a reason other than one of theexception conditions in preceding table.

11. SERIAL shows the rules table serial number of the rule that caused the log record to bewritten. This corresponds to the SEQUENCE NUMBER on the Rules ConversionReport produced by program AXPU002 when the rules table was assembled.

Page 467: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Class Report

Appendix A. Additional BIM-ALERT/VSE Reports A-11

Resource Class Report

The Resource Class Report shows log records generated as a result of access checks forresources. Resources as used in this context refers to access checks controlled by BIM-ALERT/VSE RESOURCE rules. The Resource Class Report groups together all data byresource class, and then groups resource names within each class.

The BIM-ALERT batch report writer can produce a report similar to this report. Sample inputfor producing that report is given on page 6-34.

Description

Similar BIM-ALERTBatch ReportWriter Report

Page 468: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Resource Class Report

A-12 Auditing and Report Writing Guide

(1) (2)RESCLASS RESNAME SECID USER LS JOB NAME REQ/ALLOW SRCE MODE DATE TIME --TABLE--IDENTITY-- PTN PHASE REA EXC SERIALLIBMEM BIMCOL.ALT50A.AXPHJ19.OBJ SECADMIN KEN P AXPHJ19 UPD/UPD 0000 PNT 03/26/1998 05:35:47 B1 03/26/1998 05:17 FB LIBR 18 L 84LIBMEM BIMCOL.ALT50A.AXPHJ19D.PHASE SECADMIN KEN L AXPHJ19D UPD/UPD 0000 PNT 03/26/1998 05:37:23 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84 SECADMIN KEN L AXPHJ19D UPD/UPD 0000 PNT 03/26/1998 05:37:25 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84LIBMEM BIMCOL.ALT50A.AXPHJ19E.PHASE SECADMIN KEN L AXPHJ19D UPD/UPD 0000 PNT 03/26/1998 05:37:24 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84 SECADMIN KEN L AXPHJ19D UPD/UPD 0000 PNT 03/26/1998 05:37:25 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84LIBMEM BIMCOL.ALT50A.AXPI22F.PHASE SECADMIN KEN P AXPI22F UPD/UPD 0000 PNT 03/26/1998 05:34:51 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84 SECADMIN KEN P AXPI22F UPD/UPD 0000 PNT 03/26/1998 05:34:52 B1 03/26/1998 05:17 FB $LNKEDT 18 L 84LIBMEM BIMCOL.ALT50A.AXPI24.PHASE UNKNOWN UNK-USER Y CALR50A EX/NONE 0999 SPL 03/26/1998 05:17:31 B1 03/26/1998 05:17 BG AXPI1 1F M 84LIBMEM BIMCOL.ALT50A.AXPRULE.PHASE SECADMIN KEN L AXPRULE UPD/UPD 0000 PNT 03/26/1998 05:37:32 B1 03/26/1998 05:17 FB AXPR1 18 L 84 SECADMIN KEN L AXPRULE UPD/UPD 0000 PNT 03/26/1998 05:37:33 B1 03/26/1998 05:17 FB AXPR1 18 L 84

The following explanation refers to the numbered notes in the preceding sample ResourceClass Report:

1. RESCLASS shows the resource class. Currently supported pre-defined resource classesare as follows:

− LIBMEM− LIBRARY− SUBLIB− CATALOG− TAPELBL− ULTAPE− DITTO− ENVRES− JCxxxxxx− XCOMSEND− XCOMRECV

2. RESNAME shows the name of the resource. In the case of LIBRARY resource class,this item shows the library dataset name and file name.

The rest of the items in the Resource Class Report are the same as those in the Dataset NameReport; they are described beginning on page A-7.

Sample Report

Explanation ofReport

Page 469: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Program Execution Report

Appendix A. Additional BIM-ALERT/VSE Reports A-13

Program Execution Report

When the LOGEXEC=YES option is in force, BIM-ALERT/VSE writes a log record for eachprogram execution (EXEC statement). These log records can be printed in a separate reportusing the report program SELECT REASON parameter. JCL to produce this type of report isincluded in the sample JCL (member AXPJCL50.J) cataloged into the BIM-ALERT residencesublibrary.

B I MOYLE ASSOCIATES, INC. BIM-ALERT/VSE 5.0A ** PROGRAM EXECUTION REPORT ** AXPL7 CPUID=FF039001 03/26/1998 PAGE 001

RESCLASS RESNAME SECID USER LS JOB NAME REQ/ALLOW SRCE MODE DATE TIME --TABLE--IDENTITY-- PTN PHASE REA EXC SERIAL

EXECUTE AXPB001 SECADMIN EKEHLER C AXPB001 EX/EX 000C POW 03/26/1998 07:19:35 B1 03/26/1998 05:17 BG NO NAME 22 L

EXECUTE AXPL7 SECADMIN EKEHLER C ALERT50A EX/EX 000C POW 03/26/1998 07:29:30 B1 03/26/1998 05:17 FB NO NAME 22 L

EXECUTE BIMPUNCH SECADMIN KEN L AXPSERV EX/EX 0000 PNT 03/26/1998 07:18:47 B1 03/26/1998 05:17 FB NO NAME 22 L SECADMIN KEN L AXPSERV EX/EX 0000 PNT 03/26/1998 07:19:39 B1 03/26/1998 05:17 FB NO NAME 22 L

EXECUTE LIBR OPERATNS ADMN C MULTSTEP EX/EX 0999 SPL 03/26/1998 07:24:53 B1 03/26/1998 05:17 BG NO NAME 22 L OPERATNS ADMN C MULTSTEP EX/EX 0999 SPL 03/26/1998 07:28:48 B1 03/26/1998 05:17 BG NO NAME 22 L SECADMIN KEN L AXPSERV EX/EX 0000 PNT 03/26/1998 07:19:43 B1 03/26/1998 05:17 FB NO NAME 22 L

EXECUTE PCSERPT OPERATNS ADMN C MULTSTEP EX/EX 0999 SPL 03/26/1998 07:27:42 B1 03/26/1998 05:17 BG NO NAME 22 L

EXECUTE PCSEVRP OPERATNS ADMN C MULTSTEP EX/EX 0999 SPL 03/26/1998 07:24:55 B1 03/26/1998 05:17 BG NO NAME 22 L

Description

Sample Report

Page 470: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID/USER Job Summary Report

A-14 Auditing and Report Writing Guide

SECID/USER Job Summary Report

The SECID/USER Job Summary Report summarizes the resources accessed by each job.Accessed resources are displayed in chronological sequence within each job. The report issequenced primarily on security ID and User ID (USER field of // ID statement). This reportis most useful when BIM-ALERT/VSE is performing full logging (or nearly full logging) ofresources accessed, such as during monitor mode.

The BIM-ALERT batch report writer can produce a report similar to this report. Sample inputfor producing that report is given on page 6-36.

B I MOYLE ASSOCIATES, INC. BIM-ALERT/VSE 5.0A ** SECID/USER JOB SUMMARY ** AXPL11 CPUID=FF039001 03/26/1998 PAGE 001

SECID ASIBG USER FORSEC

POWER JOB JOB# DOS JOB DATE TIME MODE SRCE PTN LOGON RESCLASS RESNAME VOLSER REQSTED ALLOWED PHASEBGASI 00000 BGASI 03/11/1998 05:06:55 ASI BG ASI DASDDS ALERT.S1SCTY.V50 CKD001 READ ALTER AXPWAIT DASDDS BIM.EPIC.VSE.RECORDER UPDATE READ TSIDRFS

SECID DEVELOP USER DRJ

POWER JOB JOB# DOS JOB DATE TIME MODE SRCE PTN LOGON RESCLASS RESNAME VOLSER REQSTED ALLOWED PHASEMSHP50A 31374 MSHP50A 03/19/1998 07:49:55 PNT BG NOTVAL DASDDS VSE.SYSTEM.HISTORY.FILE DOSRES ALTER READ MSHPFAQSMAIN 00568 FAQSMAIN 03/25/1998 09:08:28 SPL 0999 Z1 CMS LIBMEM COLSYS6.ALT493.AXPHJ4.PHASE EXEC ALTER FAQSVMXCICSICCF 30372 CICSICCF 03/11/1998 05:08:02 SPL 0999 F2 CMS DASDDS ICCF.LIBRARY SYSWK1 UPDATE READ DTSANALS DASDDS CICS.DUMPA SYSWK1 UPDATE READ DFHSIP DASDDS CICS.RSD SYSWK1 UPDATE READ DFHSIP

SECID OPERATNS USER ADMN

POWER JOB JOB# DOS JOB DATE TIME MODE SRCE PTN LOGON RESCLASS RESNAME VOLSER REQSTED ALLOWED PHASEGSPDSU 00657 GSPDSU 03/25/1998 02:30:07 SPL 0999 F6 CMS DASDDS VSE.BIM.COLUMBUS.MON.BACKUP FBA001 ALTER READ GSPDSUGSPDSU 00658 GSPDSU 03/25/1998 02:32:04 SPL 0999 F5 CMS DASDDS VSE.BIM.COLUMBUS.VIO.BACKUP FBA001 ALTER READ GSPDSUGSPDSU 00659 GSPDSU 03/25/1998 02:33:43 SPL 0999 F5 CMS DASDDS VSE.BIM.COLUMBUS.EVT.BACKUP FBA001 ALTER READ GSPDSUPCSEVBR 00660 PCSEVBR 03/25/1998 02:34:09 SPL 0999 F5 CMS DASDDS VSE.BIM.COLUMBUS.EVT.EVENTS.BACKUP FBA001 ALTER READ PCSEVBR

Description

Similar BIM-ALERTBatch ReportWriter Report

Sample Report

Page 471: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Control Totals Reports

Appendix A. Additional BIM-ALERT/VSE Reports A-15

Control Totals Reports

The log file archive/print job stream produces two Control Totals reports. The first, producedby program AXPL10, shows the number of records read from the log file and merged into thecombined log file. The second, produced by program AXPL7, shows the number of recordsread from tape and from the combined log file, as well as the number of records written totape.

Three sample Control Totals Reports follow. The first two were produced by runningAXPL10 twice; the third was produced by running AXPL7.

** CONTROL TOTALS CPUID=FF400689 **RECORDS COPIED FROM AXPLOG1 3370RECORDS WRITTEN TO AXPLOG3 3370 (1)AXPLOG3 RESET=YES (2)AXPLOG1 COPY=YES

** CONTROL TOTALS CPUID=FF400689 **RECORDS COPIED FROM AXPLOG1 27RECORDS WRITTEN TO AXPLOG3 27 (1)AXPLOG3 RESET=NO (2)AXPLOG1 COPY=YES

NUMBER OF INPUT TAPE FILES 0RECORDS READ FROM TAPES 0RECORDS READ FROM VSAM 3,397 (3)RECORDS WRITTEN TO TAPE 0

The following explanation refers to the numbered notes in the preceding sample ControlTotals Reports:

1. This shows the number of log records written to the cumulative log file (AXPLOG3)from the current log file (AXPLOG1).

2. RESET=YES means that the cumulative file was emptied (reset) before records werecopied from the current log file. RESET=NO means that the records from the currentlog file were added to those already in the cumulative file.

3. The total number of records read from the VSAM file by the report program matchesthe combined totals from the AXPL10 copy and reset jobs.

Description

Sample Report

Explanation ofReports

Page 472: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Authorized Resource Report

A-16 Auditing and Report Writing Guide

SECID Authorized Resource Report

All of the screens of the online rules definition facility are designed to show all the securityIDs that can access a specific resource. In some cases, you may want to know all theresources a specific security ID may reference. A batch program, AXPB001, provides thisreporting capability. This report takes the security IDs in the specified table (or a specificsecurity ID if desired), actually goes through the authorization process, and produces a reportof all the resources defined in that table that can be accessed by the security IDs. The JCLnecessary to run this report is cataloged during the installation as member AXPAUTH.J.

The input to AXPB001 consists of a single input record (card image) that includes thefollowing keyword parameters:

Parameter Description

TABLENUM=xx The table number from which you want the security IDs extracted.This parameter is required.

OBJ= The name by which the rules table was cataloged after assembly.This parameter is required.

SECID= A particular security ID you want run through the authorizationprocess and reported on. This parameter is optional. If it is notincluded, all the security IDs in the specified table will be reportedon.

All parameters must be included on the same record. They can be in any order, but they mustbe between columns 1-71, and they must be separated by at least one blank or comma.

Description

Input to AXPB001

Page 473: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Authorized Resource Report

Appendix A. Additional BIM-ALERT/VSE Reports A-17

B I MOYLE ASSOCIATES, INC. BIM-ALERT/VSE 5.0A *** SECID AUTHORIZED RESOURCES ***AXPB001 TABLE=B1 03/26/1998 PAGE 1

TABLENUM=B1 OBJ=ALERTB1 SID=ALERTB1 SVC=NO SECID=SECADMINAXPB001 SVC=NO OBJ=ALERTB1 ID=B1 ASSEMBLED 03/26/1998 05:17:26 UPDATED 03/26/1998 05:17:07

----------------------------------------------------- SECID: SECADMIN ----------------------------------------------------

AUTHORIZED DATASETS - DASD<- - - - - - - DATASET NAME - - - - - - - -> VOLSER RD UPD ALT <- - - - - - - DATASET NAME - - - - - - - -> VOLSER RD UPD ALT+USERID.= * C C ALERT.AXPCTL.50A W * *ALERT=.= * * * *BG.IJSYS=.= * * **F*.IJSYSLN * * * *F*.IJSYSPH W W W*F*.IJSYS0* * * * =.=.=.=.=.=.=.= * C C=.=.=.=.=.=.=.= CKD001 * * *

AUTHORIZED DATASETS - TAPE<- - - - - - - DATASET NAME - - - - - - - -> VOLSER RD UPD ALT <- - - - - - - DATASET NAME - - - - - - - -> VOLSER RD UPD ALT>>>>> NO AUTHORIZED TAPE DATASETS FOR THIS SECID <<<<<

AUTHORIZED RESOURCE - DITTO<- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP AL <- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP ALCOMMAND:NOPEN.DVT *

AUTHORIZED RESOURCE - LIBMEM<- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP AL <- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP ALBIMCOL.ALT50A.AXPBR14.PHASE L * * * BIMCOL.ALT50A.=.= * * W CBIMCOL.AXPOBJ.=.= * * W C BIMCOL.RULES50A.ALERTB1.PHASE W W W WCOLSYS6.ALT493.AXPI1.PHASE W * * * COLSYS6.ALT493.=.= * * * *IJSYSRS.SYSLIB.ASMA90.PHASE W * * *

AUTHORIZED RESOURCE - LIBRARY<- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP AL <- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP ALVSE.BIM.COLUMBUS.LIBRARY:BIMCOL * * L L VSE.BIM.COLUMBUS.LIB6:COLSYS6 * * * *VSE.PRD1.LIBRARY:PRD1 * * * * VSE.PRD2.LIBRARY:PRD2 * * * *VSE.SYSRES.LIBRARY:IJSYSRS * * * *

AUTHORIZED RESOURCE - SUBLIB<- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP AL <- - - - - - - - - MEMBERNAME - - - - - - - - -> EX RD UP ALBIMCOL.ALT50A * * * W COLSYS6.ALT493 * * * *

Sample Report

Page 474: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

SECID Authorized Resource Report

A-18 Auditing and Report Writing Guide

Page 475: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

B-1

B Additional BIM-ALERT/CICS Reports

This appendix describes BIM-ALERT/CICS batch reports produced by auditing and batchreport writing programs other than the BIM-ALERT batch report writer.

Introduction ..............................................................................................................B-2S1B100: Audit Trail Batch Report ..........................................................................B-4S1B190: Violation, Sign-On, and Specification Reports .........................................B-7S1B192: Security Violation Query Report ............................................................B-15S1B500: System Transaction Security Report .......................................................B-16S1B510: System Program Security Report ............................................................B-17S1B520: System File Security Report....................................................................B-18S1B530: System Map Security Report ..................................................................B-19S1B540: Organizational Information Report .........................................................B-20S1B550: Operator Security Information Report ....................................................B-21S1B560: Terminal Security Information Report....................................................B-23S1B570/S1B571: Operator/Terminal Authorized Resources ................................B-25

Page 476: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction

B-2 Auditing and Report Writing Guide

Introduction

The reports described in this appendix are batch reports produced by auditing and batch reportwriting programs other than the BIM-ALERT batch report writer. The reports produced bysome of these programs can be duplicated or nearly duplicated by the BIM-ALERT batchreport writer. In those cases, the description of the program includes a reference to the BIM-ALERT batch report writer report most similar to the program's output.

A number of batch reports can be produced with the self-documented job control contained inthe BIM-ALERT source library supplied with the installation tape. The following table showsthe programs provided and the reports each can produce:

Program Reports Produced

S1B100 Audit Trail Batch Report

S1B190 Violation, Sign-On, and Specification Reports

S1B192 Display/Print Attempted Violations (Query)

S1B500 System Transaction Security Report

S1B510 System Program Security Report

S1B520 System File Security Report

S1B530 System Map Security Report

S1B540 Organizational Information Report

S1B550 Operator Security Information Report

S1B560 Terminal Security Information Report

S1B570/S1B571 Operator/Terminal Authorized Resources Report

About ThisAppendix

Programs Provided

Page 477: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Introduction

Appendix B . Additional BIM-ALERT/CICS Reports B-3

After you have processed all desired reports, you must reset the security log file using ajobstream similar to that found in the following supplied job control:

S1SECLOG Reset security log file

* CONTENTS *

IDCAMS LISTCAT entries (SECLOG)

Delete Log fileDefine Log fileListcat Entries (SECLOG)

S1U003 Initialize file

IDCAMS LISTCAT entries (SECLOG)

The following sections show sample JCL that can be used to produce the batch reportsavailable in BIM-ALERT. This JCL is also provided in source member ALRTRPTS of thedistribution tape. You must modify the JCL to suit your particular installation. For example,you must modify it if you use VSAM user catalogs.

Resetting the LogFile

About the JCLProvided

Page 478: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B100: Audit Trail Batch Report

B-4 Auditing and Report Writing Guide

S1B100: Audit Trail Batch Report

BIM-ALERT maintains an audit trail of security system changes. The audit trail includesrecords of changes made from BIM-ALERT file maintenance screens, real-time changes (suchas deactivation of resources), and changes when levels of security are turned on or off. Theaudit trail contains the date and time of each change, the ID of the administrator who made thechange, the name of the function used to make the change, and before- and after-images of thedata.

S1B100 is the batch reporting program provided to generate reports of the audit data. Thereports are generated using as input either the current audit file or the backup/archive file.

A number of keywords with associated data are provided in order to allow you to tailor thereport to your needs. The keywords and input parameters are read by the program fromSYSIPT. The S1B100 keywords and parameters are as follows:

Keyword Description Default

ADMIN=A1/(A1,A2,...A10) Use to select records from the file for specifiedadministrators. Up to ten administrator numbers canbe specified. If multiple administrators arespecified, they must be enclosed in parentheses andseparated by commas.

All administrators

FUNCTION=fn1/(fn1,fn2,...fn10) Use to select records from the file based upon theBIM-ALERT function that caused them to becreated (ASTR, UCOP, UPAR, and so on). Up toten functions can be specified per report. If multiplefunctions are selected, they must be enclosed inparentheses and separated by commas.

All functions

START-DATE=mm/dd/yyyy Use to specify the beginning date for the records tobe selected. The date specified is included in thereport.

01/01/0000

END-DATE=mm/dd/yyyy Use to specify the end date for the records to beincluded in the report. Audit records for the END-DATE specified are included.

12/31/9999

START-TIME=hh:mm:ss Use to specify the beginning time for records to beselected.

00:00:00

(continued)

Overview

S1B100 InputKeywords

Page 479: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B100: Audit Trail Batch Report

Appendix B . Additional BIM-ALERT/CICS Reports B-5

Keyword Description Default

END-TIME=hh:mm:ss Use to specify the ending time for the records to beselected

Assume that the user codes the following:

START-DATE=03/01/1998,END-DATE=03/31/1998START-TIME=14:00:00,END-TIME=16:00:00

The only records selected are those that were loggedbetween the hours of 2:00 p.m. and 4:00 p.m. eachday from March 1, 1998 through March 31, 1998,inclusive.

24:00:00

START-DATE-TIME=mm/dd/yyyy.hh:mm:ss Use to specify the beginning date and time for therecords to be selected.

01/01/0000.00:00:00

END-DATE-TIME=mm/dd/yyyy.hh:mm:ss Use to specify the ending date and time for therecords to be selected.

Suppose that the user codes the following:

START-DATE-TIME=03/01/1998.14:00:00END-DATE-TIME=03/31/1998.16:00:00

This report will consist of all records logged from2:00 p.m. on March 1, 1998 through 4:00 p.m. onMarch 31, 1998, inclusive.

12/31/9999.24:00:00

LINECOUNT=nn Use to specify the number of lines to print per page. 60

UPPER-CASE=YES/NO Use to direct the report writer to display all data inuppercase.

NO

INPUT-FILE=TAPE/DISK Use to specify the input device. If DISK isspecified, the input will come from a backup diskfile created by the backup/archive utility S1U100. IfTAPE is specified, the input will come from abackup tape created by S1U100.

The current auditfile, S1SAUDT

INPUT-DEVICE=SYSnnn Use to specify the logical unit assigned to the inputfile in the JCL.

SYS010

INPUT-BLOCKSIZE=nnnnn Use to specify the blocksize of the input tape or diskfile.

8000

Page 480: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B100: Audit Trail Batch Report

B-6 Auditing and Report Writing Guide

The following jobstream prints all audit records from the current audit file S1SAUDT:

// JOB S1B100 PRINT BIM-ALERT AUDIT REPORT// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// DLBL S1SAUDT,'ALERT.S1SAUDT.V50',,VSAM// LIBDEF PHASE,SEARCH=???????.?????// EXEC S1B100,SIZE=64K/*/&

The following jobstream uses a backup tape created by S1U100 as input. The only recordsselected are those logged by administrators A and B between 03/01/1998 and 03/07/1998inclusive. Note that the input file name must be B100INP.

// JOB S1B100 PRODUCE BIM-ALERT AUDIT REPORT// ASSGN SYS010,280// TLBL B100INP,'AUDIT.BACKUP'// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// LIBDEF PHASE,SEARCH=PRODLIB.ALERT// EXEC S1B100,SIZE=64K INPUT-FILE=TAPE,ADMIN=(A,B),START-DATE=03/01/1998,END-DATE=03/07/1998/*/&

S1B100 Examples

Page 481: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

Appendix B . Additional BIM-ALERT/CICS Reports B-7

S1B190: Violation, Sign-On, and Specification Reports

This section shows the JCL necessary to produce reports using the security log file. Changethe JCL to conform to your particular installation requirements.

You must run a sort on the file before producing each of these reports.

Similar reports can be produced using the BIM-ALERT batch report writer. Sample input isgiven on page 5-20.

Description

Prerequisite

Similar BIM-ALERTBatch ReportWriter Reports

Page 482: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

B-8 Auditing and Report Writing Guide

// JOB S1B190A* ******************************************************************** ***** THIS IS THE RECORD LAYOUT OF THE SECURITY LOG FILE FIELDS* ***** THAT WILL APPLY TO ALL -S1B190?- SORTS AND REPORT JOBS* ******************************************************************** ***** * POSITION * LENGTH * DESCRIPTION* ***** * 1 * 1 * RECORD TYPE (1, 2 OR 3)* ***** * 2 * 4 * DATE FIELD (PACKED)* ***** * 10 * 4 * TIME FIELD (PACKED)* ***** * 14 * 4 * TERMINAL FIELD* ***** * 18 * 9 * ADMINISTRATOR NUMBER* ***** * 37 * 16 * LOCATION CODE (CO,DIV,DEPT,SECT)* ***** * 53 * 9 * OPERATOR FIELD* ***** * 83 * 50 * VIOLATION DESCRIPTION FIELD* ******************************************************************** ******************************************************************** ***** S1B190A PRODUCES A REPORT IN TIME SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-4 = 'TIME'* JOB SEQUENCE : 1 S1B190A SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,37,16,A,2,4,A,10,4,A),FORMAT=BI,WORK=1,FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END/*

* JOB SEQUENCE : 2 S1B190A REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KTIME/*/&

(continued)

Sample JCL

Page 483: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

Appendix B . Additional BIM-ALERT/CICS Reports B-9

// JOB S1B190B* ***** S1B190B PRODUCES A REPORT IN OPERATOR SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-4 = 'OPER'* JOB SEQUENCE : 1 S1B190B SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,37,16,A,53,9,A,2,4,A,10,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END/** JOB SEQUENCE : 2 S1B190B REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KOPER/*/&

// JOB S1B190C* ***** S1B190C PRODUCES A REPORT IN TERMINAL SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-4 = 'TERM'* JOB SEQUENCE : 1 S1B109C SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,37,16,A,14,4,A,2,4,A,10,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END

(continued)

Page 484: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

B-10 Auditing and Report Writing Guide

/** JOB SEQUENCE : 2 S1B109C REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KTERM/*/&// JOB S1B190D* ***** S1B190D PRODUCES A REPORT IN ADMINISTRATOR / TIME SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-9 = 'ADMN TIME'* JOB SEQUENCE : 1 S1B190D SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,18,9,A,37,16,A,2,4,A,10,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END/*

* JOB SEQUENCE : 2 S1B190D REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KADMN TIME/*/&

(continued)

Page 485: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

Appendix B . Additional BIM-ALERT/CICS Reports B-11

// JOB S1B190E* ***** S1B190E PRODUCES A REPORT IN ADMINISTRATOR / OPERATOR SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-9 = 'ADMN OPER'* JOB SEQUENCE : 1 S1B190E SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,18,9,A,37,16,A,53,9,A,2,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END/** JOB SEQUENCE : 2 S1B190E REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KADMN OPER/*/&

// JOB S1B190F* ***** S1B190F PRODUCES A REPORT IN ADMINISTRATOR / TERMINAL SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-9 = 'ADMN TERM'* JOB SEQUENCE : 1 S1B190F SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,18,9,A,37,16,A,14,4,A,2,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150 INPFIL VSAM OUTFIL BLKSIZE=150 END

(continued)

Page 486: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

B-12 Auditing and Report Writing Guide

/** JOB SEQUENCE : 2 S1B190F REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KADMN TERM/*/&// JOB S1B190G* ***** S1B190G PRODUCES A REPORT IN SIGNON-SIGNOFF / TIME SEQUENCE* ***** NOTE CONTROL CARD - POSITIONS 1-4 = 'SIGN'* JOB SEQUENCE : 1 S1B190G SORT PHASE// DLBL SORTOUT,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS002,DISK,VOL=$$$$$$,SHR// DLBL SORTIN1,'ALERT.S1SECLG.V50',,VSAM// EXTENT SYS002,$$$$$$// DLBL SORTWK1,'SORTWK1.LABEL',0// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// EXEC SORT,SIZE=128K SORT FIELDS=(1,1,A,18,9,A,37,16,A,2,4,A,10,4,A),FORMAT=BI,WORK=1, X FILES=1 RECORD TYPE=F,LENGTH=150INPFIL VSAM OUTFIL BLKSIZE=150 END/** JOB SEQUENCE : 2 S1B190G REPORT PHASE// DLBL S1SEQLG,'SORTOUT.LABEL'// EXTENT SYS###,$$$$$$,1,0// ASSGN SYS###,DISK,VOL=$$$$$$,SHR// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KSIGN/*/&

(continued)

Page 487: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

Appendix B . Additional BIM-ALERT/CICS Reports B-13

// JOB S1B190H* ***** S1B190H PRODUCES A SPECIFICATION REPORT (NO SORT)* ***** NOTE CONTROL CARD - POSITIONS 1-4 = 'SPEC'// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B190,SIZE=200KSPEC/*/&

Page 488: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B190: Violation, Sign-On, and Specification Reports

B-14 Auditing and Report Writing Guide

The following is a sample S1B190 report. Each jobstream sorts this information in a differentorder. Consult the record layout at the front of the JCL stream to find the field positionsavailable for sorting.

DATE: 03/26/1998 S1B190 5.0A BIM-ALERT/CICS COPYRIGHT 1997, PAGETIME: 12:20 B I MOYLE ASSOCIATES, INC. 1

* * SECURITY VIOLATION REPORT - REPORT SEQ: DATE/TIME * *COMPANY: BIM B I MOYLEASSOCIATES, INC. DEPARTMENT: 0000 (N/A)DIVISION: 0000 (N/A) SECTION: 0000 (N/A) DATE TIME TERMINAL TELEPHONE SYSID OPERATOR OPERATOR NAME VIOLATION DESCRIPTION---------- -------- -------- --------- ----- -------- ------------- ---------------------01/20/1998 09:02:03 BC43 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 09:02:17 BC43 (000)000-0000 TEST ROBERT ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED01/20/1998 09:02:25 BC43 (000)000-0000 TEST **** INCORRECT OPERATOR NUMBER ENTERED01/20/1998 09:02:39 BC43 (000)000-0000 TEST ROBERT ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED01/20/1998 09:03:32 BC43 (000)000-0000 TEST **** - MAXIMUM CONSECUTIVE VIOLATIONS DETECTED -01/20/1998 09:06:51 BC43 (000)000-0000 TEST ROBERT ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS -01/20/1998 09:07:12 BC43 (000)000-0000 TEST ROBERT ROBERT - OPERATOR DISABLED DUE TO MAXIMUM VIOLATIONS -01/20/1998 09:42:54 BC32 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 10:34:26 BC23 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 10:43:37 TR93 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 10:43:54 TR93 (000)000-0000 TEST JSTECHER STECHER, JIM INCORRECT OPERATOR SECURITY CODE ENTERED01/20/1998 11:19:01 TR93 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 11:19:04 TR93 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 12:41:27 BC13 (000)000-0000 TEST ASOMAINT ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 12:48:27 TR93 (000)000-0000 TEST JSTECHER STECHER, JIM - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 12:53:15 BC42 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 12:58:43 BC43 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 13:07:39 BC43 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/20/1998 14:17:34 BC13 (000)000-0000 TEST ASOMAINT ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 14:23:32 BC42 (000)000-0000 TEST ROBERT ROBERT - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/20/1998 15:54:33 BC32 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/21/1998 15:57:27 BC32 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/21/1998 16:27:40 BC13 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/21/1998 16:28:03 BC12 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/21/1998 16:55:08 BC42 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/22/1998 05:58:33 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/22/1998 05:59:29 BC13 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/22/1998 07:20:14 BC13 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/22/1998 07:25:27 BC42 (000)000-0000 TEST ROBERT ROBERT INCORRECT OPERATOR SECURITY CODE ENTERED01/22/1998 07:54:08 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/22/1998 10:16:40 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/22/1998 13:46:15 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/22/1998 14:00:13 BC13 (000)000-0000 TEST ASOMAINT ASOMAINT - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/22/1998 14:55:15 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/23/1998 06:03:49 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/23/1998 06:47:04 BC13 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/23/1998 07:03:19 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/23/1998 08:19:19 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/23/1998 12:18:58 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/23/1998 13:10:59 BC22 (000)000-0000 TEST ERIC KEHLER, ERIC - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 07:53:32 BC32 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/26/1998 08:26:53 BC32 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 09:33:47 BC33 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/26/1998 10:10:27 BC33 (000)000-0000 TEST OPER1 OPER1 - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 10:15:27 BC32 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 10:45:28 BC33 (000)000-0000 TEST OPER1 OPER1 - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 12:55:04 BC32 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 12:56:03 BC33 (000)000-0000 TEST OPER1 OPER1 - OPERATOR INACTIVE TIME LIMIT EXCEEDED -01/26/1998 16:03:53 BC34 (000)000-0000 TEST **** - OPERATOR NOT SIGNED ON -01/26/1998 16:49:12 BC33 (000)000-0000 TEST FLL LINTON, FRED - OPERATOR INACTIVE TIME LIMIT EXCEEDED -

Sample Report

Page 489: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B192: Security Violation Query Report

Appendix B . Additional BIM-ALERT/CICS Reports B-15

S1B192: Security Violation Query Report

This section shows the JCL necessary to process the violations in a query fashion. You canspecify multiple parameter cards in a single execution of the program.

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 5-22.

* ******************************************************************** ***** SECURITY VIOLATION QUERY REPORT* ******************************************************************** ***** THIS IS THE RECORD LAYOUT OF THE PARAMETER CARDS* ***** THAT WILL APPLY TO - S1B192* ******************************************************************** ***** * POSITION * LENGTH * DESCRIPTION* ***** A-* 1 * 2 * ADMINISTRATOR # (LEFT JUSTIFIED)* ***** B-* 4 * 8 * FROM DATE (EDITED WITH /)* ***** C-* 13 * 8 * TO DATE (EDITED WITH /)* ***** D-* 22 * 5 * FROM TIME (EDITED WITH :)* ***** E-* 28 * 5 * TO TIME (EDITED WITH :)* ***** F-* 34 * 4 * TERMINAL ID* ***** G-* 39 * 9 * OPERATOR ID* ********** EXAMPLES ********************************************** *****AA BBBBBBBB CCCCCCCC DDDDD EEEEE FFFF GGGGGGGGG* *****A 03/01/82 03/31/82* *****XX 03/15/82 03/15/82 14:00 15:00 AR01 SNEAKY* *****03 77444* *****ALL* ***** NOTE - 'ALL' IN POSITIONS 1- 3 WILL SHOW EVERYTHING* ****************************************************************** *****************************************************************// JOB S1B192// ASSGN SYS020,READER// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SECLG,'ALERT.S1SECLG.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B192,SIZE=200K* ********************************* * INSERT PARAMETER CARDS ** * HERE!!!!! ** ********************************/*/&

Description

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Page 490: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B500: System Transaction Security Report

B-16 Auditing and Report Writing Guide

S1B500: System Transaction Security Report

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 3-126.

// JOB S1B/RPTS PRINT SECURITY REPORTS* S1B500 - SECURED TRANSACTIONS REPORT// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B500,SIZE=200K/*/&

The preceding JCL produces a report like the following:

DATE: 03/26/1998 S1B500 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 12:36 B I MOYLE ASSOCIATES,INC. 1

* * SYSTEM TRANSACTION SECURITY INFORMATION * *

TRAN STATUS ACCESS-TIME DESCRIPTIVE TRANSACTION NAME TRAN STATUS ACCESS-TIME DESCRIPTIVE TRANSACTION NAME---- ------ ----------- --------------------------- ---- ------ ----------- ----------------------------ALXP ACTIVE 00:01 / 24:00 BIM-ALERT/VSE MAIN TRANSACTION AXPT ACTIVE 00:01 / 24:00 BIM-ALERT/VSE ONLINE TESTAX7A INACTV 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITOR AX7B INACTV 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITORAX7C INACTV 00:01 / 24:00 BIM-ALERT/VSE ICCF MONITOR BIMC ACTIVE 00:01 / 24:00 BIMC TRANSACTIONBIMO ACTIVE 00:01 / 24:00 BIMO TRANSACTION BIMV ACTIVE 00:01 / 24:00 BIMV TRANSACTIONBMGM SAFE 00:01 / 24:00 MAKE BMGM A SAFE TRANSACTION CECI ACTIVE 00:01 / 24:00 CICS COMMAND INTERPRETERCEDA ACTIVE 00:01 / 24:00 CICS ONLINE RSRCE DEFINITION CEDF ACTIVE 00:01 / 24:00 CICS ONLINE DEBUGCEMT ACTIVE 00:01 / 24:00 CICS MASTER TERMINAL CSMT ACTIVE 00:01 / 24:00 CICS MASTER TERMINALOPWD ACTIVE 00:01 / 24:00 OPWD TRANSACTION

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Report

Page 491: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B510: System Program Security Report

Appendix B . Additional BIM-ALERT/CICS Reports B-17

S1B510: System Program Security Report

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 3-128.

// JOB S1B510 - SECURED PROGRAMS REPORT// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B510,SIZE=250K/*/&

DATE: 03/26/1998 S1B510 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 12:42 B I MOYLE ASSOCIATES, INC. 1

* * SYSTEM PROGRAM SECURITY INFORMATION * *PROGRAM STATUS ACCESS-TIME DESCRIPTIVE PROGRAM NAME PROGRAM STATUS ACCESS-TIME DESCRIPTIVE PROGRAM NAME------- ------ ----------- ------------------------ ------- ------ ----------- ------------------------AXP10000 ACTIVE 00:01 / 24:00 BIM-ALERT/VSE MAIN MENU AXP720 ACTIVE 00:01 / 24:00 BIM-ALERT/VSE ONLINE TESTBXP10000 P/ACTV 00:01 / 24:00 COMMAND LEVEL TEST PROGRAM BXP720 P/ACTV 00:01 / 24:00 COMMAND LEVEL TEST PROGRAMPPY29001 P/ACTV 00:01 / 24:00 PAYROLL MASTER UPDATE PROG S10000 INACTV 00:01 / 24:00 BIM-ALERT/CICS MAIN MENUS2S500 ACTIVE 02:00 / 23:00 TEST PROGRAM S2S500 S2S510 ACTIVE 03:00 / 24:00 TEST PROGRAM S2S510S2S520 ACTIVE 04:00 / 21:00 TEST PROGRAM S2S520 S2S530 ACTIVE 05:00 / 23:00 TEST PROGRAM S2S530S2S540 ACTIVE 06:00 / 24:00 TEST PROGRAM S2S540 S2S550 ACTIVE 07:00 / 24:00 TEST PROGRAM S2S550S2S552 ACTIVE 08:00 / 21:00 TEST PROGRAM S2S552 S2S554 ACTIVE 09:00 / 22:00 TEST PROGRAM S2S554S2S556 ACTIVE 10:00 / 21:00 TEST PROGRAM S2S556 S2S558 ACTIVE 11:00 / 24:00 TEST PROGRAM S2S558S2S560 ACTIVE 12:00 / 20:00 TEST PROGRAM S2S560 S20000 ACTIVE 02:00 / 21:00 TEST PROGRAM S20000

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Report

Page 492: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B520: System File Security Report

B-18 Auditing and Report Writing Guide

S1B520: System File Security Report

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 3-129.

// JOB S1B520 - SECURED FILES REPORT// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B520,SIZE=250K/*/&

DATE: 03/26/1998 S1B520 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 12:49 B I MOYLE ASSOCIATES, INC. 1

* * SYSTEM FILE SECURITY INFORMATION * *FILENAME STATUS PROC ACCESS-TIME DESCRIPTIVE FILE NAME FILENAME STATUS PROC ACCESS-TIME DESCRIPTIVE FILE NAME-------- ------ ---- ----------- --------------------- -------- ------ ---- ----------- ---------------------ALERTXP ACTIVE UPDT 00:01/24:00 BIM-ALERT/VSE RULES FILE AXPCTL ACTIVE INQY 00:01/24:00 BIM-ALERT/VSE CONTROL FILEAXPLOG1 ACTIVE INQY 00:01/24:00 BIM-ALERT/VSE LOG FILE S1SAUDT ACTIVE UPDT 00:01/24:00 BIM-ALERT AUDIT FILES1SCTY ACTIVE UPDT 00:01/24:00 BIM-ALERT/CICS RULES FILE S1SECLG ACTIVE UPDT 00:01/24:00 BIM-ALERT/CICS LOG FILES1SMS## ACTIVE UPDT 00:01/24:00 BIM-ALERT/CICS MESSAGE FILE S2LOCS ACTIVE UPDT 00:01/24:00 SECURITY ORGANIZATIONAL FILES2MAPS ACTIVE UPDT 00:01/24:00 MAP SECURITY FILE S2OPERS ACTIVE UPDT 00:01/24:00 OPERATOR SECURITY FILES2PROGS ACTIVE UPDT 00:01/24:00 PROGRAM SECURITY FILE S2SECLOG INACTV UPDT 00:01/24:00 SECURITY VIOLATION FILES2TERMS ACTIVE UPDT 00:01/24:00 TERMINAL SECURITY FILE S2TRANS ACTIVE UPDT 00:01/24:00 TRANSACTION SECURITY FILE

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Report

Page 493: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B530: System Map Security Report

Appendix B . Additional BIM-ALERT/CICS Reports B-19

S1B530: System Map Security Report

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 3-130.

// JOB S1B530 - SECURED MAPS REPORT// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B530,SIZE=250K/*/&

DATE: 05/12/1998 S1B530 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGE

TIME: 13:51 B I MOYLE ASSOCIATES, INC. 1

* * SYSTEM MAP DISPLAY SECURITY INFORMATION * *------------------------------------------------------------------------------------------------------------------------------------

MAP NAME: S#M500 MAPSET NAME: S1M500 MAP REFERENCE NUMBER: 0001 MAP TITLE: TEST MAP S#M550 STATUS: ACTIVE

FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME--------- ------- ---------- --------- ------- ---------- --------- ------- ----------

002 YES TEST FIELD 2 005 YES TEST FIELD 5 008 YES TEST FIELD 8 009 YES TEST FIELD 9 010 YES TEST FIELD 10

MAP NAME: S#M500 MAPSET NAME: S1M500 MAP REFERENCE NUMBER: 0002 MAP TITLE: TEST MAP S#M500 STATUS: ACTIVE

FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME--------- ------- ---------- --------- ------- ---------- --------- ------- ---------- 001 YES TEST FIELD 1 002 YES TEST FIELD 2 003 YES TEST FIELD 3

MAP NAME: S#M510 MAPSET NAME: S1M510 MAP REFERENCE NUMBER: 0003 MAP TITLE: TEST MAP S#M510 STATUS: ACTIVE

FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME--------- ------- ---------- --------- ------- ---------- --------- ------- ----------

001 YES TEST FIELD 1 003 YES TEST FIELD 3 005 YES TEST FIELD 5

MAP NAME: S#M510 MAPSET NAME: S1M510 MAP REFERENCE NUMBER: 0004 MAP TITLE: TEST MAP S#M510 STATUS: ACTIVE

FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME--------- ------- ---------- --------- ------- ---------- --------- ------- ----------

001 YES TEST FIELD 1 002 YES TEST FIELD 2 003 YES TEST FIELD 3 004 YES TEST FIELD 4 005 YES TEST FIELD 5

MAP NAME: S#M510 MAPSET NAME: S1M510 MAP REFERENCE NUMBER: 0005 MAP TITLE: TEST MAP S#M510 STATUS: ACTIVE

FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME FIELD NO. DISPLAY FIELD NAME--------- ------- ---------- --------- ------- ---------- --------- ------- ----------

001 YES TEST FIELD 1 XXXXXX 002 YES TEST FIELD 2 XXXXXX 003 YES TEST FIELD 3 XXXXXX 011 YES TEST FIELD 11 XXXXX 012 YES TEST FIELD 12 XXXXX 013 YES TEST FIELD 13 XXXXX 101 YES TEST FIELD 101 XXXX 102 YES TEST FIELD 102 XXXX 103 YES TEST FIELD 103 XXXX

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Report

Page 494: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B540: Organizational Information Report

B-20 Auditing and Report Writing Guide

S1B540: Organizational Information Report

A similar report can be produced using the BIM-ALERT batch report writer. Sample inputfor producing that report is given on page 3-131.

// JOB S1B540 - LOCATION REPORT// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B540,SIZE=250K/*/&

DATE: 03/26/1998 S1B540 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 12:16 ** ORGANIZATIONAL INFORMATION ** B I MOYLE ASSOCIATES, INC. 1

COMPANY: BIM B I MOYLE ASSOCIATES, INC. DIVISION: CLBS BIM OHIO OFFICE DEPARTMENT: DEVL COLUMBUS DEVELOPMENT SECTION: ALRT BIM-ALERT SECTION: FAQS BIM-FAQS DEPARTMENT: SUPP COLUMBUS SUPPORT SECTION: ALRT BIM-ALERT SECTION: FAQS BIM-FAQS DIVISION: MPLS BIM MINNEAPOLIS OFFICE DEPARTMENT: ADMN MINNEAPOLIS ADMINISTRATION DEPARTMENT: DEVL MINNEAPOLIS DEVELOPMENT SECTION: MVS MVS SYSTEMS SECTION: VSE VSE SYSTEMS DEPARTMENT: SUPP MINNEAPOLIS SUPPORT DIVISION: SNTA BIM CALIFORNIA OFFICE DEPARTMENT: DEVL SANTA ANA DEVELOPMENT SECTION: EPIC BIM-EPIC/VSE DEPARTMENT: SUPP SANTA ANA SUPPORT SECTION: EPIC BIM-EPIC/VSE

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Report

Page 495: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B550: Operator Security Information Report

Appendix B . Additional BIM-ALERT/CICS Reports B-21

S1B550: Operator Security Information Report

A similar, though not duplicate, report can be produced using the BIM-ALERT batch reportwriter. Sample input for producing that report is given in the section beginning on page 3-132.

// JOB S1B550 - OPERATOR SECURITY PROFILES// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B550,SIZE=250K/*/&

DATE: 03/26/1998 S1B550 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 13:05 B I MOYLE ASSOCIATES, INC. 1

* * OPERATOR SECURITY INFORMATION * *------------------------------------------------------------------------------------------------------------------------------------

OPERATOR NO: JACKF OPERATOR NAME: FROST, JACK MODEL: _________ ADMINISTRATOR: A MESSAGE SUFFIX: ##COMPANY: BIM B I MOYLE ASSOCIATES, INC. DIVISION: CLBS BIM OHIO OFFICEDEPARTMENT: SUPP COLUMBUS SUPPORT SECTION: ALRT BIM-ALERTPASSWORD: NEW PASSWORD: INACTIVE TIME LIMIT: 00:30 PRIMARY TERMINAL: ____ ALTERNATE TERMINAL-1: ____

ISSUE DATE: 03/25/1998 EFFECTIVE DATE: __/__/____ PROCESSING FUNCTION: UPDATE TERMINAL GROUP-ID: ALL ALTERNATE TERMINAL-2: ____

SUBMIT USERIDS: FROSTY LOG SOURCE: EXT. USER/PWD: IUI USER/PWD:TABLES/SECIDS: B1 PROGRAMR EXPIRE DATE 08/06/0835CICS USER: Y OPID: JFR BATCH USER: Y PWS: N MONITOR: * CON: N ACTION: * CLB: N UP RECORD STATUS: A STATUS: ACICS USER DEFINED DATA: __________ BATCH USER DEFINED DATA: ________ LAST SIGNON - NEVERSCHEDULED OPERATOR TIMES ---------- TEMPORARY OPERATOR TIMES ---------------- EFFECTIVE DATE ----------------- EXPIRATION DATE

MON ...... 07:00 / 24:00 MON ...... 00:01 / 24:00 04/01/1998 04/30/1998TUE ...... 00:01 / 24:00 TUE ...... __:__ / __:__ __/__/____ __/__/____WED ...... 00:01 / 24:00 WED ...... __:__ / __:__ __/__/____ __/__/____THU ...... 00:01 / 24:00 THU ...... __:__ / __:__ __/__/____ __/__/____FRI ...... 00:01 / 15:00 FRI ...... 00:01 / 24:00 04/01/1998 04/30/1998SAT ...... 00:01 / 00:02 SAT ...... 00:01 / 24:00 04/01/1998 04/30/1998SUN ...... 00:01 / 00:02 SUN ...... 00:01 / 24:00 04/01/1998 04/30/1998

---------------------------------------------------- AUTHORIZED TRANSACTIONS -----------------------------------------------------

ALERT TRANSACTION - 1: CEDA - CICS ONLINE RSRCE DEFINITION ALERT TRANSACTION - 4: ____ - ______________________________ALERT TRANSACTION - 2: CEMT - CICS MASTER TERMINAL ALERT TRANSACTION - 5: ____ - ______________________________ALERT TRANSACTION - 3: ____ - ______________________________ ALERT TRANSACTION - 6: ____ - ______________________________

TRAN DESCRIPTIVE TRANSACTION NAME TRAN DESCRIPTIVE TRANSACTION NAME TRAN DESCRIPTIVE TRANSACTION NAME---- ---------------------------- ---- ---------------------------- ---- ----------------------------

ALXP BIM-ALERT/VSE MAIN TRANSACTION AXPT BIM-ALERT/VSE ONLINE TEST OPWD OPWD TRANSACTION

------------------------------------------------------ AUTHORIZED PROGRAM -------------------------------------------------------

PROGRAM DESCRIPTIVE PROGRAM NAME PROGRAM DESCRIPTIVE PROGRAM NAME PROGRAM DESCRIPTIVE PROGRAM NAME------- ------------------------ ------- ------------------------ ------- ------------------------

S2S500 TEST PROGRAM S2S500 S2S510 TEST PROGRAM S2S510 S2S520 TEST PROGRAM S2S520S2S530 TEST PROGRAM S2S530 S2S540 TEST PROGRAM S2S540 S2S550 TEST PROGRAM S2S550S2S552 TEST PROGRAM S2S552 S2S554 TEST PROGRAM S2S554 S2S556 TEST PROGRAM S2S556S2S558 TEST PROGRAM S2S558 S2S560 TEST PROGRAM S2S560 S20000 TEST PROGRAM S20000

(continued)

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Sample Reports

Page 496: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B550: Operator Security Information Report

B-22 Auditing and Report Writing Guide

DATE: 03/26/1998 S1B550 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 13:05 B I MOYLE ASSOCIATES, INC. 2

* * OPERATOR SECURITY INFORMATION * *-------------------------------------------------------- AUTHORIZED FILES --------------------------------------------------------

FILE NAME PROCESS DESCRIPTIVE FILE NAME FILE NAME PROCESS DESCRIPTIVE FILE NAME--------- ------- --------------------- --------- ------- ---------------------

( GK565 ALL FILES AUTHORIZED )

-------------------------------------------------------- RESTRICTED MAPS ---------------------------------------------------------

( GK566 NO MAP RESTRICTIONS ASSIGNED )------------------------------------------------------ AUTHORIZED FIELDS -------------------------------------------------------

FIELD DESCRIPTIVE FIELD NAME FIELD DESCRIPTIVE FIELD NAME FIELD DESCRIPTIVE FIELD NAME------- ------------------------ ------- ------------------------ ------- ------------------------

( GK565 ALL FIELD RSRC.S AUTHORIZED )

Page 497: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B560: Terminal Security Information Report

Appendix B . Additional BIM-ALERT/CICS Reports B-23

S1B560: Terminal Security Information Report

A similar, though not duplicate, report can be produced using the BIM-ALERT batch reportwriter. Sample input for producing that report is given in the section beginning on page 3-132.

// JOB S1B560 - TERMINAL SECURITY PROFILES// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B560,SIZE=250K/*/&

Similar BIM-ALERTBatch ReportWriter Report

Sample JCL

Page 498: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B560: Terminal Security Information Report

B-24 Auditing and Report Writing Guide

DATE: 03/26/1998 S1B560 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 13:56 B I MOYLE ASSOCIATES, INC. 1

* * TERMINAL SECURITY INFORMATION * *------------------------------------------------------------------------------------------------------------------------------------

TERM-ID: MB01 TERM-GROUP: ____ TELEPHONE: (612) 933-2885 MODEL: ____ ADMINISTRATOR: A LOGO SUFFIX: __ MSG. SUFFIX: ##

COMPANY: BIM B I MOYLE ASSOCIATES, INC. DIVISION: MPLS BIM MINNEAPOLIS OFFICEDEPARTMENT: DEVL MINNEAPOLIS DEVELOPMENT SECTION: VSE VSE SYSTEMS

PASSWORD: NEW PSWD: TIME DIFF INACTIVE TIME LIMIT: 02:00 EXEMPT TERM. SIGN-ON: Y VIOLATION TERMINAL: ____ISSUE DATE: 03/26/1998 EFF DATE: __/__/____ +0 HOURS PROCESSING FUNCTION: UPDT EXEMPT OPER. SIGN-ON: N ASSOCIATED PRINTER: ____

SCHEDULED TERMINAL TIMES ---------- TEMPORARY TERMINAL TIMES ---------------- EFFECTIVE DATE ----------------- EXPIRATION DATE

MON ...... 00:01 / 24:00 MON ...... __:__ / __:__ __/__/____ __/__/____TUE ...... 00:01 / 24:00 TUE ...... __:__ / __:__ __/__/____ __/__/____WED ...... 00:01 / 24:00 WED ...... __:__ / __:__ __/__/____ __/__/____THU ...... 00:01 / 24:00 THU ...... __:__ / __:__ __/__/____ __/__/____FRI ...... 00:01 / 24:00 FRI ...... __:__ / __:__ __/__/____ __/__/____SAT ...... 00:01 / 24:00 SAT ...... __:__ / __:__ __/__/____ __/__/____SUN ...... 00:01 / 00:02 SUN ...... 00:01 / 24:00 04/01/1998 06/30/1998USER DEFINED DATA: 12SX______ STATUS: A---------------------------------------------------- AUTHORIZED TRANSACTIONS -----------------------------------------------------

ALERT TRANSACTION - 1: CEMT - CICS MASTER TERMINAL ALERT TRANSACTION - 4: ____ - ______________________________ALERT TRANSACTION - 2: ____ - ______________________________ ALERT TRANSACTION - 5: ____ - ______________________________ALERT TRANSACTION - 3: ____ - ______________________________ ALERT TRANSACTION - 6: ____ - ______________________________

TRAN DESCRIPTIVE TRANSACTION NAME TRAN DESCRIPTIVE TRANSACTION NAME TRAN DESCRIPTIVE TRANSACTION NAME---- ---------------------------- ---- ---------------------------- ---- ----------------------------

( GK565 ALL TRANSACTIONS AUTHORIZED )

------------------------------------------------------ AUTHORIZED PROGRAM -------------------------------------------------------

PROGRAM DESCRIPTIVE PROGRAM NAME PROGRAM DESCRIPTIVE PROGRAM NAME PROGRAM DESCRIPTIVE PROGRAM NAME------- ------------------------ ------- ------------------------ ------- ------------------------

( GK565 ALL PROGRAMS AUTHORIZED )

DATE: 03/26/1998 S1B560 5.0A BIM-ALERT/CICS COPYRIGHT 1998, PAGETIME: 13:56 B I MOYLE ASSOCIATES, INC. 2

* * TERMINAL SECURITY INFORMATION * *-------------------------------------------------------- AUTHORIZED FILES --------------------------------------------------------

FILE NAME PROCESS DESCRIPTIVE FILE NAME FILE NAME PROCESS DESCRIPTIVE FILE NAME--------- ------- --------------------- --------- ------- ---------------------

( GK565 ALL FILES AUTHORIZED )-------------------------------------------------------- RESTRICTED MAPS ---------------------------------------------------------

( GK566 NO MAP RESTRICTIONS ASSIGNED )------------------------------------------------------ AUTHORIZED FIELDS -------------------------------------------------------

FIELD DESCRIPTIVE FIELD NAME FIELD DESCRIPTIVE FIELD NAME FIELD DESCRIPTIVE FIELD NAME------- ------------------------ ------- ------------------------ ------- ------------------------

( GK565 ALL FIELD RSRC.S AUTHORIZED )

Sample Report

Page 499: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B570/S1B571: Operator/Terminal Authorized Resources

Appendix B . Additional BIM-ALERT/CICS Reports B-25

S1B570/S1B571: Operator/Terminal Authorized Resources

The programs S1B570 and S1B571 are run in conjunction with an intervening SORT toprovide a report of all the terminals or operators authorized to use specified transactions,programs, files, or maps.

S1B570 reads the S1SCTY file and creates a sequential disk file which is used as input to theSORT program. The information contained in the output file depends on the parameterspassed to the program via the control card. Because the S1SCTY file is opened as input only,the BIM-ALERT/CICS system can be functioning normally while this job is being run.

The input to the program consists of parameters supplied in card format. Comments can beincluded by specifying an asterisk (*) in column one. The following rules apply to coding theinput card images:

• Only one non-comment card can be passed to the program, and it must contain thefollowing keyword parameters with the desired option:

Parameter Description

RESOURCE=option S1B570 uses this parameter to determine which record type onthe security file it is to access. Valid options are:• TRANSACTIONS• PROGRAMS• FILES• MAPS• FIELDS• GROUPS

USER=option S1B570 uses this parameter to determine whether operator orterminal records are to be accessed. Valid options are:• TERMINAL• OPERATOR

• The two parameters must be on the same card, separated by a comma, with nointervening spaces, as follows:

USER=TERMINAL,RESOURCE=PROGRAMS

• The parameters can be specified in either order and can start in any column.

Description

S1B570

Page 500: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B570/S1B571: Operator/Terminal Authorized Resources

B-26 Auditing and Report Writing Guide

S1B571 reads the sorted disk file created by S1B570 and the SORT program, and it producesa report detailing which operators or terminals are authorized to access the specifiedtransactions, programs, files, or maps. If no specific resource names are supplied, the reportdefaults to all resources of the specified type.

The input to the program consists of parameters supplied in card format. Comments can beincluded by specifying an asterisk (*) in column one. The following rules apply to coding theinput card images:

• The first non-comment card must contain the USER= and RESOURCE= keywords andmust conform to the rules for coding cards specified above, in the description ofS1B570.

• The input cards following the parameter card can contain names of those resources thatyou want reported. The names can be coded one name per card, multiple names percard, or any combination thereof. If multiple resource names are supplied on a card, thenames must be separated by blanks or commas. The data on the resource name cardsmust not extend beyond column 71.

• If no specific resource names are supplied, the report defaults to all resources of thespecified type.

• If the desired report pertains to authorized maps, then the input cards must be codedwith the mapname followed by its reference number on the same card. The referencenumber must not exceed four characters in length. The following is an example of thecontent of a map report input card:

IN085M1 27 S1M550 43 SMAPFFF 0001

• If a report pertains to maps, the SORT FIELDS card must be coded like the secondSORT FIELDS card in the sample JCL on the following page.

S1B571 can be run multiple times against the same sorted file as long as the same type ofreport is desired. (Obviously, for example, you couldn't get a report of terminal authorizedmaps if the file you had S1B570 create contained operator authorized programs). Theresource names specified will be internally sorted by the program, so the report may come outin an order different from the resource name cards. The operator and terminal names for eachresource will also be sorted in ascending alphabetical order to help you quickly find a specificentry in cases in which many users are authorized to access the same resource.

S1B571

Page 501: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B570/S1B571: Operator/Terminal Authorized Resources

Appendix B . Additional BIM-ALERT/CICS Reports B-27

The following is a sample of the JCL required to run the S1B570/S1B571 batch reports toproduce a listing of all operators authorized to run transactions DUMP and CEMT. S1B571can run stand-alone as long as the sorted sequential disk file created by S1B570 and SORT ispresent.

// JOB S1B570// DLBL S1SCTY,'ALERT.S1SCTY.V50',,VSAM,CAT=XXXXXXX// ASSGN SYS010,DISK,VOL=XXXXXX,SHR// DLBL SEQDISK,'SORTIN.TEMP.DELETE.ME',0,SD// EXTENT SYS010,XXXXXX,1,0,2990,10// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B570,SIZE=AUTORESOURCE=TRANSACTIONS,USER=OPERATOR/*// RESET ALL// ASSGN SYS001,DISK,VOL=XXXXXX,SHR// ASSGN SYS002,DISK,VOL=XXXXXX,SHR// ASSGN SYS003,DISK,VOL=XXXXXX,SHR// DLBL SORTIN1,'SORTIN.TEMP.DELETE.ME',,SD// EXTENT SYS002,XXXXXX,1,0,2990,10// DLBL SORTOUT,'SORTOUT.TEMP.DELETE.ME',0,SD// EXTENT SYS001,XXXXXX,1,0,2910,40// DLBL SORTWK1,'SORTWK.TEMP.DELETE.ME',,SD// EXTENT SYS003,XXXXXX,1,0,2950,40// EXEC SORT SORT FIELDS=(1,8,A,9,9,A),WORK=1,FILES=1,FORMAT=BISORT FIELDS=(1,10,A,11,9,A),WORK=1,FILES=1,FORMAT=BI RECORD TYPE=F,LENGTH=40 INPFIL BLKSIZE=800 OUTFIL BLKSIZE=800 OPTION PRINT=ALL/*// RESET ALL// LIBDEF CL,SEARCH=(ALT301C),TEMP// ASSGN SYS010,DISK,VOL=VSESYS,SHR// DLBL SEQDISK,'SORTOUT.TEMP.DELETE.ME',,SD// EXTENT SYS010,VSESYS,1,0,2910,40// DLBL S1SMS##,'ALERT.S1SMS##.V50',,VSAM// EXEC S1B571,SIZE=25KUSER=OPERATOR,RESOURCE=TRANSACTIONS* THIS WILL REPORT ALL OPERATORS AUTHORIZED DUMP AND CEMTDUMP CEMT/*/&

S1B570/S1B571Sample JCL

Page 502: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

S1B570/S1B571: Operator/Terminal Authorized Resources

B-28 Auditing and Report Writing Guide

Page 503: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-1

Index

**/ (end comment indicator) 2-5

//* (begin comment indicator) 2-5

<< (for left-justified label) 2-33

>> (for right-justified label) 2-33

AAccess check information fields

ALRTVVVI report 6-11Access checks for resources

Resource Class Report A-11Access level A-7Access violations

Dataset Name Report A-7User Entry Report A-9

Activation and deactivation fieldsALRTVCAU report 7-68

Administrator Change Activity Report 7-92

Administrator maintenance fieldsALRTVCAU report 7-71

ALRTVCAU reportdescription of 7-3field information 7-7fields

activation and deactivation fields 7-68

administrator maintenance fields 7-71

common segment fields 7-9

location information fields 7-74optional zap fields 7-79password change field 7-77program refresh fields 7-78record dump information fields 7-

80secured resource authorization fields

7-65secured resource fields 7-50system options and parameter fields

7-14terminal and operator profile fields

7-32I/O module 7-3input for 7-3sample JCL 7-3sample reports 7-81

ALRTVCSC reportdescription of 3-3field information 3-9fields

common segment fields 3-11field resource information fields 3-

99field resource security information

fields 3-106file record fields 3-19group security information record

fields 3-110location record fields 3-24map record fields 3-21operator record fields 3-58program record fields 3-17terminal record fields 3-27transaction record fields 3-15user group record fields 3-119user profile record fields 3-122

I/O module 3-3input for 3-3sample JCL 3-3sample reports 3-126

Page 504: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-2 Auditing and Report Writing Guide

ALRTVCVI reportdescription of 5-2field information 5-5fields

common segment fields 5-7initialization record field 5-10sign-on and sign-off record fields 5-

11violation record fields 5-15

I/O module 5-2input for 5-2sample JCL 5-3

ALRTVREPJCL 1-5list of commands 1-8processing 1-10

ALRTVVAU reportdescription of 8-2field information 8-7fields

common segment fields 8-9control file maintenance fields 8-47DASD dataset maintenance fields

8-28extended user fields 8-15jobmask fields 8-20library maintenance fields 8-40node information fields 8-53remote submittal fields 8-55resource maintenance fields 8-36rules table maintenance fields 8-44SECID maintenance fields 8-24tape dataset maintenance fields 8-

32I/O module 8-2input for 8-2sample JCL 8-2sample reports 8-57

ALRTVVSC reportdescription of 4-2field information 4-4fields

common segment fields 4-6DASD and tape dataset record fields

4-18dataset record fields 4-18jobmask record fields 4-15node information fields 4-27reference record fields 4-26remote submittal information fields

4-29resource record fields 4-23

SECID record fields 4-16tape and DASD dataset record fields

4-18user record fields 4-11XPCC submittal information fields

4-31I/O module 4-2input for 4-2sample JCL 4-2sample reports 4-32

ALRTVVVI reportdescription of 6-2field information 6-5fields

access check information fields 6-11

common segment fields 6-7I/O module 6-2input for 6-2sample JCL 6-3sample reports 6-31

Audit Trail Batch Report B-4AXPAUTH.J A-16AXPB001 A-16

BBIM-ALERT/CICS

audit file input dataset 7-3manuals xsecurity file input dataset 3-3, 5-2security log file input dataset 5-2

BIM-ALERT/VSEaudit file input dataset 8-2manuals xsecurity file input dataset 4-2, 6-2security log file input dataset 6-2

Blanks in command statements 2-4Boolean syntax rules 2-40Brackets 2-3

CChange activity - Status Change Report

A-4Characters

continuation indicator 2-5reserved 2-5special 2-4

CommandsALRTVREP commands 1-8FIELD 2-31FIELDS 2-30

Page 505: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-3

FILEDUMP 2-35HELP 2-8OPTIONS 2-10REPORT 2-17required commands 1-9RUN 2-43SELECT IF 2-37SUBTITLE 2-23TITLES 2-21XFORM 2-13

Comments in input 2-5Common segment fields

ALRTVCAU report 7-9ALRTVCSC report 3-11ALRTVCVI report 5-7ALRTVVAU report 8-9ALRTVVSC report 4-6ALRTVVVI report 6-7

Continuation indicator 2-5Control file maintenance fields

ALRTVVAU report 8-47Control File Maintenance Report 8-60Control Totals Reports A-15Conventions for command syntax 2-3CTLBREAK keyword

FIELD command 2-33SUBTITLE command 2-26

DDASD Dataset Change Report 8-58DASD dataset fields

ALRTVVAU report 8-28ALRTVVSC report 4-18

Dataset Name Report 6-31, A-7Dataset record fields

ALRTVVSC report 4-18DATEFORM keyword

OPTIONS command 2-10REPORT command 2-18

Detail pages 1-13Documentation

list of ALERT manuals x

EEllipses 2-3ELSE parameter of XFORM command

2-14Extended user fields

ALRTVVAU report 8-15

FFIELD command 2-31Field resource information fields

ALRTVCSC report 3-99Field resource security information fields

ALRTVCSC report 3-106FIELDS command 2-30File record fields

ALRTVCSC report 3-19FILEDUMP command 2-35FILETYPE keyword of REPORT

command 2-18FILLCHAR keyword

FIELD command 2-32SUBTITLE command 2-27

FORMAT keyword of FIELD command2-32

GGlobal Terminal/Operator Parameter

Change Report 7-85Group security information fields

ALRTVCSC report 3-110

HHeader page 1-12HELP command 2-8Hyphen 2-5

II/O module

ALRTVCAU report 7-3ALRTVCSC report 3-3ALRTVCVI report 5-2ALRTVVAU report 8-2ALRTVVSC report 4-2ALRTVVVI report 6-2

Initialization record fieldALRTVCVI report 5-10

Input datasetBIM-ALERT/CICS

audit file 7-3security file 3-3, 5-2security log file 5-2

BIM-ALERT/VSEaudit file 8-2security file 4-2, 6-2security log file 6-2

default input datasets 2-17

Page 506: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-4 Auditing and Report Writing Guide

JJCL, sample

ALRTVCAU report 7-3ALRTVCSC report 3-3ALRTVCVI report 5-3ALRTVVAU report 8-2ALRTVVSC report 4-2ALRTVVVI report 6-3for executing reports 1-5

Job entry verification A-9Jobmask fields

ALRTVVAU report 8-20ALRTVVSC report 4-15

JUSTIFY keywordFIELD command 2-32SUBTITLE command 2-25

Justifying labels 2-33

LLABEL keyword

FIELD command 2-33Labels, justifying 2-33LENGTH keyword

FIELD command 2-32SUBTITLE command 2-25

Library maintenance fieldsALRTVVAU report 8-40

LINE keyword of SUBTITLE command2-25

LINELEN keyword of OPTIONScommand 2-10

LINESPC keyword of REPORT command2-19

Location Change Report 7-94Location information fields

ALRTVCAU report 7-74ALRTVCSC report 3-24

Log File Integrity Report A-3Logical Table Resource Report 4-32LOGO keyword of REPORT command

2-18

MMap record fields

ALRTVCSC report 3-21MISSCHAR keyword

FIELD command 2-32SUBTITLE command 2-27

NNOCC keyword of REPORT command

2-19Node information fields

ALRTVVAU report 8-53ALRTVVSC report 4-27

NOHDRDATE keyword of REPORTcommand 2-18

NOHDRPAGE keyword of REPORTcommand 2-18

NOLABELS keyword of REPORTcommand 2-18

NOPAGENUM keyword of REPORTcommand 2-18

NOTEST keyword of OPTIONScommand 2-10

NOTRAILER keyword of REPORTcommand 2-18

NOTRUNC keywordFIELD command 2-33SUBTITLE command 2-27

NOUPPERCASE keyword of OPTIONScommand 2-10

OOperator Access Time Report 3-133Operator and Terminal Reports 3-132Operator Authorization Report 3-135Operator Authorized Resources Report

B-25Operator Parameter Change Report 7-85Operator Profile Change Report 7-95Operator record fields

ALRTVCSC report 3-58Operator Security Information Report B-

21Operator Sign-On Report 3-136Optional zap fields

ALRTVCAU report 7-79OPTIONS command 2-10Organizational Information Report 3-

131, B-20OUTFILE keyword of REPORT

command 2-19

PPAGELEN keyword

OPTIONS command 2-10REPORT command 2-18

Parentheses 2-3

Page 507: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-5

Password change fieldALRTVCAU report 7-77

Pre-defining a table 2-16Program Execution Report A-13Program record fields

ALRTVCSC report 3-17Program refresh field

ALRTVCAU report 7-78

RRecord dump information fields

ALRTVCAU report 7-80Reference record fields

ALRTVVSC report 4-26Remote submittal fields

ALRTVVAU report 8-55Remote submittal information fields

ALRTVVSC report 4-29REPCHAR keyword of FIELD command

2-33Report

components 1-11detail pages 1-13header page 1-12

REPORT command 2-17Reports

Administrator Change Activity Report7-92

Audit Trail Batch Report B-4Control File Maintenance Report 8-60Control Totals Reports A-15DASD Dataset Change Report 8-58Dataset Name Report 6-31, A-7Global Terminal/Operator Parameter

Change Report 7-85Location Change Report 7-94Log File Integrity Report A-3Logical Table Resource Report 4-32Operator Access Time Report 3-133Operator and Terminal Reports 3-132Operator Authorization Report 3-135Operator Authorized Resources Report

B-25Operator Profile Change Report 7-95Operator Security Information Report

B-21Operator Sign-On Report 3-136Organizational Information Report 3-

131, B-20Program Execution Report A-13Resource Activation and Deactivation

Report 7-91

Resource Change Report 8-59Resource Class Report 6-34, A-11Resource Name Update Report 7-87Resource Update Report 7-89SECID Authorized Resource Report

A-16SECID/User Dataset Summary Report

6-36SECID/USER Job Summary Report

A-14SECID/User Resource Summary

Report 6-37Security Violation Query Report B-15Security Violation Report 5-20, 5-22Status Change Report A-4System File Security Report 3-129, B-

18System Map Display Security Report

3-130System Map Security Report B-19System Options Update Report 7-81System Parameter Change Report 7-

83System Parameter Update Report 7-84System Program Security Report 3-

128, B-17System Transaction Security Report 3-

126Terminal Authorized Resources Report

B-25Terminal Security Information Report

B-23User Entry Report 6-33, A-9Violation, Sign-On, and Specification

Reports B-7Required commands 1-9Reserved character 2-5Resource Activation and Deactivation

Report 7-91Resource Change Report 8-59Resource Class Report 6-34, A-11Resource maintenance fields

ALRTVVAU report 8-36Resource Name Update Report 7-87Resource record fields

ALRTVVSC report 4-23Resource Update Report 7-89Rules table maintenance fields

ALRTVVAU report 8-44RUN command 2-43

Page 508: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-6 Auditing and Report Writing Guide

SS1B100 B-4S1B190

producing B-7similar ALRTVREP report 5-20

S1B192producing B-15similar ALRTVREP report 5-22

S1B500similar ALRTVREP report 3-126

S1B510producing B-17similar ALRTVREP report 3-128

S1B520producing B-18similar ALRTVREP report 3-129

S1B530producing B-19similar ALRTVREP report 3-130

S1B540producing B-20similar ALRTVREP report 3-131

S1B550producing B-21similar ALRTVREP report 3-132

S1B560 B-23S1B570 B-25S1B571 B-25SECID Authorized Resource Report A-

16SECID record fields

ALRTVVAU report (maintenancerecords) 8-24

ALRTVVSC report 4-16SECID/User Dataset Summary Report 6-

36SECID/USER Job Summary Report A-

14SECID/User Resource Summary Report

6-37Secured resource fields

ALRTVCAU report 7-50authorization fields 7-65

Security Violation Query Report B-15Security Violation Report 5-20, 5-22SELECT IF command 2-37Serial number exception A-3Sign-on and sign-off record fields

ALRTVCVI report 5-11SORTNAME keyword 2-10SORTPRTY keyword

FIELD command 2-32SUBTITLE command 2-26

SORTSEQ keyword of SUBTITLEcommand 2-26, 2-32

Special characters 2-4Square brackets 2-3Statement

comments 2-5continuation 2-5

Status Change Report A-4SUBTITLE command 2-23Syntax

blanks 2-4comments 2-5continuation indicator 2-5conventions 2-3example 2-6keywords and keyword values 2-4

System File Security Report 3-129, B-18System Map Display Security Report 3-

130System Map Security Report B-19System options and parameter fields

ALRTVCAU report 7-14System Options Update Report 7-81System Parameter Change Report 7-83System Parameter Update Report 7-84System Program Security Report 3-128,

B-17System Transaction Security Report 3-

126

TTape dataset fields

ALRTVVAU report (maintenancefields) 8-32

ALRTVVSC report 4-18Terminal Authorized Resources Report

B-25Terminal record fields

ALRTVCAU report (profile records)7-32

ALRTVCSC report 3-27Terminal Security Information Report B-

23Terminal/Operator Parameter Change

Report 7-85TEST keyword of OPTIONS command

2-10TIMEFORM keyword

OPTIONS command 2-10REPORT command 2-18

Page 509: CICS AND VSE SECURITY SYSTEM AUDITING AND ... CP DITTO IBM ICCF MSHP VM VSAM VSE/ESA VSE/SP VSE/POWER VTAM x Auditing and Report Writing Guide Related Publications

Index-7

TITLES command 2-21Transaction record fields

ALRTVCSC report 3-15Transformation table, pre-defining 2-16

UUPPERCASE keyword of OPTIONS

command 2-10User Entry Report 6-33, A-9User group record fields

ALRTVCSC report 3-119User profile record fields

ALRTVCSC report 3-122User record fields

ALRTVVSC report 4-11

VViolation record fields

ALRTVCVI report 5-15Violation, Sign-On, and Specification

Reports B-7Violations

Dataset Name Report A-7User Entry Report A-9

XXFORM command 2-13XFORM keyword

FIELD command 2-33SUBTITLE command 2-27

XPCC submittal information fieldsALRTVVSC report 4-31