Customizing IND$Detect to report IND$FILE activity
Configure IND$Detect by adding the IND$Detect configuration parameters to a small assembler module found in amihlq . CZAGENT.SAMP, then assemble it, and bind it with the distributed IND$Detect. To complete this task, you must be comfortable with programming in simple assembly language and understand the basics of using the z/OS binder (refer to IBM documentation for details).
Editing the IND$JCL module (formerly IND$CONF)
The following is the IND$JCL module that is found in amihlq.SAMP.
* See manual "BMC AMI Datastream for z/OS SIEM Agent for IND$Detect"
IND$JCL AMODE ANY31
IND$JCL RMODE ANY
IND$JCL CSECT
DC C'IND$JCL: Config for BMC AMI IND$Detect' Eyecatcher
*
* *** Do not alter the next four statements ***
ENTRY IND$DOPT
IND$DOPTDC A(IND$PARM)
DC A(0) Required end-of-list delimiter
IND$PARM EQU *
* Place any configuration parameters here
DC X'0' End of parameters -Required
*
END
To add parameters to the module, open it in an editor and insert one or more parameters where indicated, formatted as character constants. Look at the following instance:
* Place any configuration parameters here
DC C'LIBRARY(SYS2.PROD.CMDLIB)'
DC X'0' End of parameters - Required
To separate multiple parameters with one or more blanks, look at the following instance:
*
Place any configuration parameters here
DC C'INSTANCE(1)'
DC C' ' Separator blank
DC C'SEND(API SMF)'
DC X'0' End of parameters - Required
Do not to delete or change the position of the X'0' that terminates the parameters.
Assembling, binding, and testing IND$JCL
After editing IND$JCL, run the following job, found in amihlq.SAMP as member IND$JCL.
//*
//* Re-configure IND$Detect
//*
//* Assemble the config module
//ASM EXEC PGM=ASMA90,COND=(12,LE),REGION=2M,
// PARM=''
//SYSLIB DD DISP=SHR,DSN=hlq. CZAGENT.SAMP
//SYSPUNCH DD DUMMY
//SYSIN DD DISP=SHR,DSN=hlq. CZAGENT.SAMP(IND$JCL)
//SYSLIN DD DISP=(NEW,PASS)
//SYSPRINT DD SYSOUT=*
//SYSUT1 DD UNIT=SYSDA,SPACE=(CYL,(2,2))
//*
//* Re-bind IND$Detect
//REBIND EXEC PGM=IEWBLINK,REGION=2M,COND=(4,LE,ASM),
// PARM='AMODE=31,MAP,NORENT,NOREUS'
//OLDMOD DD DISP=SHR,DSN=hlq.CZAGENT.LOAD
//SYSLIN DD DSN=*.ASM.SYSLIN,DISP=(OLD,DELETE)
// DD *
INCLUDE OLDMOD(CZAIND$D)
REPLACE IND$JCL,IND$JCL
ALIAS IND$FILE(CEESTART)
ALIAS APVUFILE(CEESTART)
ENTRY CEESTART
NAME CZAIND$D(R)
/*
//SYSLMOD DD DSN=hlq.CZAGENT.LOAD,DISP=(OLD,KEEP)
//SYSUT1 DD UNIT=SYSALLDA,SPACE=(32000,(30,30))
//SYSPRINT DD SYSOUT=*
Configuring with BMC AMI Datastream
See also Customizing-for-IND-Detect.
You will need the following statements
- For IND$FILE events written to SMF, SELECT SMF(CORRELOG) and SMF CORRELOG …
- For IND$FILE events sent to API1, SELECT EVENT(IND$FILE) and EVENT IND$FILE …