Skip to Content
Information
Limited support BMC provides limited support for this version of the product. As a result, BMC no longer accepts comments in this space. If you encounter problems with the product version or the space, contact BMC Support.BMC recommends upgrading to the latest version of the product. To see documentation for that version, see BMC AMI Datastream for Db2 7.1.

SMF TSS80 statement

The statement described here is for CA Top Secret (TSS). For RACF SMF Type 80 formatting, see The SMF 80 Statement.

SMF Type 80 records are written by CA Top Secret (TSS) for legacy MVS security events. Security events include both problems such as a user attempting to log on with an invalid password as well as non-problem events such as TSS’s granting access to a particular resource to a particular user. For Unix System Services events see SMF TSS231.

image2019-3-26_11-16-12.png

image2019-3-26_11-16-59.png


Warning

Note

Your installation might have customized TSS to suppress the writing of records on certain events.

You might want to monitor Type 80 records to keep track of security events. The SMF 80 statement indicates that Type 80 records are to be collected and forwarded to your syslog console. If you code an SMF TSS80 statement, then by default, all SMF Type 80 records are forwarded to your BMC Defender Server or syslog console with a facility of Security (4) and a severity of informational, except for those records for which TSS sets bit 0 (the event is a violation) or bit 3 (the event is a warning) in the field SMF80DES. Those records are forwarded by default with a severity of error or warning respectively.

If you code more than one SMF TSS80 statement, then a subsequent SMF TSS80 statement replaces any SMF TSS80 statement(s) that came before.

SMF TSS80

Must be specified as shown.

EVENTs

Specifies one or more SMF record Type 80 event codes and the syslog severity to be assigned to them. Specify the event code or codes in one or more of the following formats.

eventcode

Specifies a single event code.

Information
Example

EVENT(1 SEV(ERR)) specifies that event code 1 events are to be forwarded with a severity of error.

eventcode:eventcode

Specifies a range of event codes.

Information
Example

EVENT(55:59 SEV(NOTICE)) specifies that all event code 55, 56, 57, 58, and 59 records are to be forwarded with a severity of notice.

For both of the previous formats, eventcode might be specified as an integer or as a single character in quotes and must be in the range 1 to 255 (any quoted character satisfies this requirement). If you specify a range of quoted characters such as ‘S’:’T’, then you must enclose the entire operand in quotes, for instance, ’S’:’T’.

Warning

Note

The event code or codes might be specified more than once.

Information
Example

EVENT(52 50:54 SEV(WARN)) specifies that event codes 50, 51, 52, 53 and 54 are to be forwarded with a severity of Warning.

SEVERITY(severity)

Specifies the syslog severity for the specified event codes. See Syslog-facilities-and-severities. There are two possible operands of SEVERITY that are not RFC 3164 severities, SUPPRESS and DEFAULT. SUPPRESS indicates that the specified event records are not to be forwarded to the syslog server at all. DEFAULT restores the default severity processing based on the SMF80DES bit flags as described previously.

Information
Example

You could code EVENT(50:59 SEV(NOTICE) EVENT(52 SEV(DEFAULT)) to indicate that code 50 through 59 events were to have a severity of NOTICE except for 52, that was to have a default severity.

If TRACE(PARM) is specified on the options statement, then the specified severity for each event for which there is an event map entry is displayed in message CZA0242I.

FACILITY(facility-name)

Specifies the RFC 3164 facility that is to be indicated as the origin of the syslog records corresponding to SMF Type 80 records. If you omit this parameter, it defaults to SECURITY4. If you would like a different facility indicated, code one of the RFC 3164 facility names as listed in Syslog-facilities-and-severities.

FIELDs(fieldname…)

Specifies the names of the SMF Type 80 record fields that are to be transmitted to the BMC Defender Server or other syslog console, and the order in that they are to appear in the message. Specify one or more of the fields as described in FIELDS-parameter.

filter-specification

INHibit

Specifies that the writing of the specified SMF record type to the SMF data sets, logstream or both are to be inhibited by BMC AMI Defender. The specified SMF record type is processed by BMC AMI Defender, but then inhibited from further processing by SMF.

LOG

LOG(HEX)

Specifies that the selected SMF records are to be logged on CZAPRINT and optionally dumped in hexadecimal and character format. This parameter is intended primarily for diagnostic purposes. Use care in specifying LOG(HEX) as it might generate a large volume of print records, especially if BMC AMI Defender is left running for several hours or more.

PROCess(‘process-tag’)

Specifies the tag that appears at the start of SMF TSS80 syslog messages, following the priority, timestamp and hostname, and preceding the formatted fields. Specify the exact process tag that you want to include in syslog messages including any spaces and punctuation. Process-tag might be of any length from the null string (‘’) to 32 characters. If SMF 80 PROCess is omitted, it defaults to TSS followed by the leading delimiter from OPTIONS DELIM.

Related topics

Parameter-file-statements

General-SMF-record-type-statement

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC AMI Defender for Db2 6.1