MODIFY command
The MODIFY (abbreviated as F) command is used to change BMC AMI Defender operating parameters or to display BMC AMI Defender configuration or statistics. The displayed statistics might optionally be transmitted as a syslog message.
If you attempt a MODIFY command before BMC AMI Defender initialization has completed you might receive message IEE342I MODIFY REJECTED-TASK BUSY from z/OS.
The format of the MODIFY command for BMC AMI Defender is:
MODIFY command for BMC AMI Defender for z/OS
CZAGENT (for BMC AMI Defender for z/OS)
Display specification | Information displayed |
---|---|
taskname | The name of the BMC AMI Defender job or started task, as specified on the START command or in the JCL. See MODIFY Command in the IBM documentation for a description of how this name is determined and specified. This operand is required. |
BACKLOG(Send) | Causes BMC AMI Defender to display message CZA0386 with queue utilization data on the console and in the listing on CZAPRINT. If Send is specified, then a BACKLOG syslog message is transmitted to the BMC Defender Server or other syslog console as a syslog message. SEND might be abbreviated as S. The BACKLOG syslog message is described under BACKLOG-statement. |
CLOCKmsg | Causes BMC AMI Defender to transmit the Clock message CZA0352I to the SIEM Server, and display the message on the console and in CZAPRINT. |
Display(...) | Causes BMC AMI Defender to display the currently active settings for the indicated parameters. Specify one or more of the following options separated by commas with no embedded spaces. The values are displayed on the console (except for Display(APF)) and in CZAPRINT in the format: CZA0251I|LOCAL CZA0251I| DATASET (*) CZA0251I| FOLD (133) CZA0251I| NOMOD Etc. |
APF | The BMC AMI Defender table of APF-authorized data sets in data set name collating sequence. The table is displayed only in CZAPRINT; there is no console output. The display is of the format: CZA0356I APF enrichment activity: List All: Z21A00, SYS1.LINKLIB CZA0356I APF enrichment activity: List All: SMS, SYS3.CICS.LOAD |
COMPILE | BMC AMI Defender compilation information including ARCH level, optimization, and tuning. |
CONSOLE(SETS) | The SELECTed CONSOLE SETs, in the order of selection. The information displayed includes the set name, the PREFIX if any, the SEVerity, and the count of matching console messages. For more information, see CONSOLE-statement. |
CPUTime | Total CPU time consumed by BMC AMI Defender. |
EVENTs | For each API1 event, its SELECT status. For each SMF type, its processing class, selection code and INHIBIT status. |
INSTances | The running BMC AMI Defender instances with their instance names (if any) and their job or started task names. For more information, see START-command. |
LICENSE | License information including expiration date. |
LOCal | Settings related to LOCAL (see LOCAL-statement ) such as the data set name and FOLD, MOD, REOPEN and SPACE parameters. |
OPTions | Settings that might be specified on the OPTIONS statement (see OPTIONS-statement ) such as delimiters, framing, host name options, and so forth. |
PARMs | Equivalent to LOCAL,OPTIONS,SERVER,TIME. |
SERVers | Settings related to the syslog server, including any alternates. For more information, see Multiple-syslog-server-support and SERVER-statement. |
TIME | Settings related to TIME, such as the date and time formats, time zone. For more information, see TIME-statement. |
TIMERs | The currently pending internal timers such as for timeouts, alternate server reversion, and automatic parameter refresh. For more information, see TIMEout and ALTRevert in SERVER-statement and REFResh in OPTIONS-statement. |
LOCal(REOPen) | Specifies that BMC AMI Defender is to close and re-open the LOCAL syslog data set. Before using this command, you should consider the effect of the use or absence of system variable symbols in the specified data set name, and the use or absence of MOD. |
PARMs PARMs(dataset specification) | Specifies a data set from which BMC AMI Defender takes new operating parameters. Because the parameter file is an input file, a specification of * (SYSOUT) is invalid, and the output variable symbols are not supported. z/OS command processes uppercase, unquoted command operands, so you can specify a zFS file as follows: This file is described in Parameter-file-statements. Parameter processing starts over each time you read in a parameter file with MODIFY CZAGENT,PARMS with the exception of OPTIONS TRACE, SUBSYS, and QUEUE. Every parameter assumes its default value except for the three parameters named. OPTIONS QUEUE and SUBSYS are ignored during MODIFY processing; to change their values, you must stop and restart BMC AMI Defender; to change the setting of TRACE you must explicitly specify TRACE. So if BMC AMI Defender is running with a LOCAL data set, FORMAT(ALL), and an SMF 119 statement, and you read in a new parameter file with FORMAT, LOCAL, and SMF 119 omitted, then FORMAT assumes its default value of ERGONOMIC, the LOCAL data set is closed, and no further SMF 119 records are formatted and transmitted. |
SET(APF) | Causes BMC AMI Defender to re-initialize the table of APF-authorized data sets. The table is refreshed from the current APF list and the defined LNKLST sets. BMC AMI Defender updates this table automatically in most circumstances so this command is superfluous unless: (a.) You are running a release of z/OS below V2R2; (b.) SMF 90 subtype 37 is not enabled for BMC AMI Defender processing; or (c.) You have added non-APF-listed files to the active LNKLST. For more information, see "Other Limitations" under APF status enrichment in the "SMF record enrichment" topic. Use caution with SET(APF) as it freezes SMF record processing for about one second, depending on the number of APF-authorized data sets and the speed and processor load of your system. |
SET(CICS(NEWMCT)) | For performance reasons, BMC AMI Defender caches any DFHMCT customization on a per-CICS-applid basis. If you re-customize and stop and start a CICS subsystem you can force BMC AMI Defender to purge and refresh its CICS DFHMCT customization cache with the command SET(CICS(NEWMCT)). |
SET(DB2(STArt)) | Causes BMC AMI Defender to re-issue any relevant START TRACE commands for DB2. See STArt in the SMF-Db2-statement . |
SET(SERVER(RECONnect)) | Causes BMC AMI Defender to attempt to reconnect to the active syslog server. This command is only valid if the syslog server is disconnected (due to an error) and using TCP/IP or SSL/TLS transport. This command would be suitable for use when a previously disconnected communication link is restored. |
SET(SERVER(USEALT(number))) SET(SERVER(USEPRImary)) | Causes BMC AMI Defender to change the active syslog server to the primary or the specified alternate. For more information, see Multiple-syslog-server-support. USEPRIMary and USEALT(0) are equivalent. |
STATs STATs(RESET,Send) | Causes BMC AMI Defender to display message CZA0215I with counts of SMF records processed and similar statistics on the console and in the listing on CZAPRINT. In addition, counts by SMF record subtype are displayed only in the CZAPRINT listing. If RESET is specified then the various statistical counters are reset to zero after being displayed. If Send is specified then the statistics (not including the subtype counts) are also transmitted to the BMC Defender Server or other syslog console as syslog messages. Send can be abbreviated as S. For more inforamation about various statistics other than the subtypes, see Counters. See Messages CZA0300 through CZA0399 for information about the subtype statistics in messages CZA0323I through CZA0327I. |
TRACE(trace_specifications) | Specifies that BMC AMI Defender is to output additional diagnostic messages and the types of diagnostic messages, in the CZAPRINT data set. TRACE might be useful for diagnosing certain problems. If TRACE is completely omitted or specified as TRACE() then it defaults to the previous state of TRACE; if TRACE(-ALL) is specified then all tracing is turned off. Specify zero or more of the trace types described in Using-the-TRACE-facility (in any order). Prefix any of the specifications with - (a minus sign or hyphen) to indicate negation. The specifications are processed left to right. For instance, TRACE(ALL -XL -ENV) indicates all TRACE output except related to translation and the operating environment. After processing TRACE, BMC AMI Defender displays the trace specifications in effect. To simply display the current trace specifications, enter F CZAGENT,TRACE(). For more information, see Using-the-TRACE-facility. |
MODIFY command for BMC AMI Defender for McAfee DAM
CZAGENT (for BMC AMI Defender for McAfee DAM)
Display specification | Information displayed |
---|---|
taskname | The name of the BMC AMI Defender for z/OS job or started task, as specified on the START command or in the JCL. See MODIFY command in the IBM Manual z/OS MVS System Commands for a description of how this name is determined and specified. This operand is required. |
Display(...) | Causes BMC AMI Defender for z/OS to display the currently active settings for the indicated parameters. It specifies one or more options separated by commas with no embedded spaces. |
DAM(SESSions) | Causes BMC AMI Defender for z/OS to display a summary list of all active DAM sessions. The sessions are displayed in session-unique order. The first twenty or fewer sessions are displayed on the console and in CZAPRINT; any sessions beyond twenty are displayed only in CZAPRINT. The display has the format as follows: CZA0360I 3 active DAM sessions CZA0361I Session-Unique SSID User ID Logon Activity Conn Stmts CZA0362I ---------------- ---- -------- -------- -------- ------ ----- CZA0363I 01e68ccb6d5bd88f DB1T DB1TADMT 19:08:41 19:08:42 LOCAL 4 CZA0363I 0ae29e057e4acc85 DB1T RU018P 19:08:50 19:08:51 LOCAL 131 CZA0363I 79e39263f13b171a DB1T RU018P 19:08:43 19:08:47 LOCAL 143 |
DAM(SESSions(id)) | Displays detail for the session identified by ID. For ID, specify one or more leading hex digits of a session-unique from the summary session display (or the DAM console). You must specify enough hex digits to uniquely identify the session. CZA0251I SESSION 79e39263f13b171a CZA0251I Activity 2017-07-04T14:29:04.891-0400 CZA0251I Collid CZA0251I Connection LOCAL CZA0251I Date 2017-07-04T14:29:04.920-0400 (1499192944920) CZA0251I Facility BATCH CZA0251I Job name RU018PR -BATCH CZA0251I Location NA01DB1T CZA0251I Logon time 2017-07-04T14:28:50.506-0400 (1499192930506) CZA0251I Package CZA0251I Plan CZA0251I Program CZA0251I Remote txn CZA0251I SQLID RU018P CZA0251I SSID DB1T CZA0251I Stmt-cmd CZA0251I Stmts 565 CZA0251I System SYSC CZA0251I Trans-tok 15179512282545455104 CZA0251I Userid RU018P CZA0251I Worksta'n BATCH |