Managing the IBM zERT NMI

BMC AMI Ops Monitor for IP uses the SYSTCPER and SYSTCPES NMI to gather the following data:

• zERT detailed encryption data for every connection (SYSTCPER)
• zERT Audit by Policy Agent data (SYSTCPER)
• zERT summary encryption data (SYSTCPES)

You can manage the zERT NMI by enabling the zERT data collection parameter DETAIL, SUMMARY or ALL, or by disabling the zERT NMI through the OFF parameter.

Enabling data collection from the zERT NMI interface

Use the following procedure to edit the NETMONITOR statement in the TCP/IP profile data set to enable data collection from the zERT NMI interface:

To collect detailed encryption data from the SYSTCPER NMI interface

1. In the TCP/IP profile data set, specify the ZERTSERVICE parameter on the NETMONITOR statement.
2. In the zERT Data Collection field in the MVIPNMID view, type DETAIL.
3. In the GLOBALCONFIG statement in the TCP/IP profile data set, type zERT.

If you do not specify ZERTSERVICE on the NETMONITOR statement, the connection from the BMC AMI Ops Monitor for IP PAS to the SYSTCPER NMI interface fails, and zERT data (detailed encryption data) is not collected.

To collect summary encryption data from the SYSTCPES NMI interface

1. In the TCP/IP profile data set, specify the ZERTSUMMARY parameter on the NETMONITOR statement.
2. In the zERT Data Collection field in the MVIPNMID view, type SUMMARY.
3. In the GLOBALCONFIG statement in the TCP/IP profile data set, type ZERT AGGREGATION.

If you do not specify ZERTSUMMARY on the NETMONITOR statement, the connection from the BMC AMI Ops Monitor for IP PAS to the SYSTCPES NMI interface fails, and zERT summary encryption data is not collected. 

To collect zERT Audit by Policy data from the SYSTCPER NMI interface

(BMC.AMIOPS.SPE2110)

1. In the TCP/IP profile data set, specify the ZERTSERVICEBYPOLICY parameter on the NETMONITOR statement.
2. On the MVIPNMID view, set the zERT Audit by Policy Agent field to ON. 
3. In the GLOBALCONFIG statement in the TCP/IP profile data set, type zERT.

To enable security

Perform one of the following tasks:

• Make the user ID that is associated with the BMC AMI Ops Monitor for IP PAS a superuser.

• Add a RACF resource in the SERVAUTH class as follows:

  EZB.NETMGMT.<sysName>.<TCPprocName>.SYSTCPER
  EZB.NETMGMT.<sysName>.<TCPprocName>.SYSTCPES

  The variables are defined as follows:
  • sysName is the name of the MVS system on which the PAS is running.
  • TCPprocName is the name of the job associated with the TCP/IP started task procedure.

Disabling data collection from the zERT NMI interface

Use one of the following procedures to disable data collection from the IBM zERT NMI:

• To disable data collection using NETMONITOR parameters:

  1. Navigate to the NETMONITOR statement in the TCP/IP profile data set.

     Warning

     Important

     For more information about the NETMONITOR statement, see IBM z/OS Communications Server: IP Configuration Reference.

  2. Specify one or more of the following parameters to disable the indicated collection:

     Parameter	Collection
     NOZERTSERVICE	Collection of zERT detailed encryption data
     NOZERTSUMMARY	Collection of zERT summary encryption data
     NOZERTSERVICEBYPOLICY	Collection of zERT Audit data

• To disable data collection in BMC AMI Ops Monitor for IP:
  1. Navigate to the zERT (Encryption) NMI Interfaces section in the MVIPNMID view.

  2. Type OFF in one of the following fields to disable the indicated collection:

     Field	Collection
     zERT Data Collection	Collection of all zERT data
     zERT Audit Data Collection	Collection of zERT Audit data