Using the CZALDFIL program

CZALDFIL is a program that sends or loads one or more MVS data sets or z/OS UNIX files into a SIEM console through BMC AMI Defender. CZALDFIL might be invoked with JCL, from a calling program, or from a Rexx script, although the latter two options require that the calling program be APF-authorized, and so are not generally recommended.

CZALDFIL supports the following types of data sets and files:

• Traditional sequential data sets, including spooled, GDG, in-line, tape and Extended-Format data sets, of any z/OS-supported LRECL and BLKSIZE, and any RECFM, including VBS. ISO/ANSI (Format F) tapes and Large Format data sets are not supported.
• PDS and PDSE members of any z/OS-supported LRECL, BLKSIZE and RECFM.
• z/OS UNIX files.
• VSAM clusters, including ESDS, KSDS and RRDS data sets.

In the remainder of this section, data set includes all types of data sets and files listed preceding, except where the context clearly implies otherwise.

The data set layout must have been previously defined to BMC AMI Defender as an API1 event type. For data sets that consist entirely of printable data, such as typical print reports, you should generally be able to use the predefined GENERIC-event-type. To define your own record layout, see TYPE-and-RETYPE-statements. You must enable the event type in BMC AMI Defender with the appropriate SELECT and EVENT statements. The event specifications are used for formatting the data set records as SIEM-appropriate messages.

The information about CZALDFIL operation does not apply to the BMC AMI Defender dbDefender Package.

CZALDFIL writes a listing of status, diagnostic and error messages on DD CZAPRINT, that typically should be defined as a spooled data set. The messages, numbered from CZA0000 to CZA0199, and from CZA0600 to CZA0699, are documented in the Messages library.

CZALDFIL returns a completion code to the job or the calling program. See the Messages library for a list of possible return codes and their meanings.

CZALDFIL must be APF-authorized.

CZALDFIL populates the API1 event identification field with the record number (absolute record number, before the effect of comments or zero-length records). See EventNonSMFIdent under API1-common-fields.

Invoking CZALDFIL with JCL

This section contains a simple example and a complex example of JCL for invoking CZALDFIL.

The instance name and event name have been specified in PARM=; all other options have been allowed to default. The data set to be transmitted is defined in the default DD statement, CZAINFIL. (This sample JCL is available in amihlq.CZAGENT.CNTL as member CZALDFIL.)

In this jobstep the parameters are in an instream data set specified with PARM='%INCLUDE DD:SYSIN'.