MODIFY command


You can use the MODIFY (abbreviated as F) command to change BMC AMI Defender operating parameters or to display BMC AMI Defender configuration or statistics. The displayed statistics might optionally be transmitted as a syslog message.

Note

  • MODIFY is not available until BMC AMI Defender for z/OS initialization completes and you receive message CZA0205I, which confirms successful initialization.
  • Attempting to run MODIFY before initialization can cause z/OS to generate message IEE342I:
    MODIFY REJECTED-TASK BUSY

The following sections of this topic present the format of the MODIFY command:

MODIFY syntax

As shown in the following examples, you must insert at least one space immediately following the MODIFY command (or its abbreviation, F). However, no other spaces are allowed in the statement.

The following syntax is valid:

✅️ MODIFY CZAGENTJOB1,DISPLAY(DISPLAYPARM1,DISPLAYPARM2)

The following examples are invalid. The first one omits the required space after MODIFY and the second one incorrectly inserts a space before DISPLAY:

❌️ MODIFYCZAGENTJOB1,DISPLAY(DISPLAYPARM1,DISPLAYPARM2)
❌️ MODIFY CZAGENTJOB1, DISPLAY(DISPLAYPARM1,DISPLAYPARM2)

MODIFY command for BMC AMI Defender for z/OS

MODIFY-zos_5.9.02.png

For information about traceSpecification, see Using-the-TRACE-facility.


(Version 5.9.02) Enable a new license

MODIFY_LICENSE_5.9.02.png

CZAGENT for BMC AMI Defender for z/OS

Display specification

Information displayed

czagentName | taskName

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

BACKLOG(Send)

Causes BMC AMI Defender to display message CZA0386 with queue utilization data on the console and in the listing on CZAPRINT

If Send is specified, then a BACKLOG syslog message is transmitted to the BMC Defender Server or another syslog console as a syslog message. SEND might be abbreviated as S. For more information about the BACKLOG syslog message, see BACKLOG-statement.

CLOCKmsg

Causes BMC AMI Defender to transmit the Clock message CZA0352I to the SIEM server, and display the message on the console and in CZAPRINT

Display(...)

Causes BMC AMI Defender to display the currently active settings for the indicated parameters

The values are displayed on the console (except for Display(APF)) and in CZAPRINT in the following format:

CZA0251I|  LOCAL           
CZA0251I|  DATASET (*) 
CZA0251I|  FOLD  (133)
CZA0251I|  NOMOD

DISPLAY specification

Information displayed

APF

Displays the BMC AMI Defender table of APF-authorized data sets in data set name collating sequence

The table is displayed only in CZAPRINT and there is no console output. The display is in the following format:

Click here to see the format.
CZA0356I APF enrichment activity:  List All: Z21A00, SYS1.LINKLIB   
CZA0356I APF enrichment activity:  List All: SMS, SYS3.CICS.LOAD

COMPILE

Displays the BMC AMI Defender compilation information, including ARCH level, optimization, and tuning

CONSOLE(SETS)

Displays the SELECTed CONSOLE SETs in the order of selection

The information displayed includes the set name, the PREFIX (if any), the SEVerity, and the count of matching console messages. For more information, see CONSOLE-statement.

CPUTime

Displays the total CPU time consumed by BMC AMI Defender

EVENTs

Displays the SELECT status for each API1 event

For each SMF type, its processing class, selection code and INHIBIT status

INSTances

Displays the running BMC AMI Defender instances with their instance names (if any) and their job or started task names

For more information, see START-command.

LICENSE (version 5.9.02)

Displays current license information and enables new license keys in a running agent

LICENSE has two forms: DISPLAY(LICENSE) command and LICENSE command.

Run the F czagent,DISPLAY(LICENSE) command to display the valid licenses and number of days remaining on the license, such as in the following example:

Click here to see the example.
CZA0014I Processing MODIFY command 'DISPLAY(LICENSE)'
CZA0472I AMI Defender for z/OS license expires in 862 days.
CZA0472I AMI Defender for Db2 license expires in 862 days.
CZA0472I AMI Defender for IMS license expires in 862 days.
CZA0472I AMI Defender for Predictive license expires in 862 days.
CZA0026I MODIFY processing completed

Run the F czagent,LICENSE command to reprocess the licenses or enable a new license, such as in the following example:

Click here to see the example.
CZA0014I Processing MODIFY command 'LICENSE'
CZA0460I AMI Defender for z/OS license verification successful. License expires in 862 days.
CZA0460I AMI Defender for Db2 license verification successful. License expires in 862 days.
CZA0460I AMI Defender for IMS license verification successful. License expires in 862 days.
CZA0460I AMI Defender for Predictive license verification successful. License expires in 862 days.
CZA0026I MODIFY processing completed

The licenses are validated and processing is adjusted appropriately. License validation automatically occurs at agent startup.

LICENSE (version 5.9.01)

Displays the license information, including the expiration date

LOCal

Displays the settings related to LOCAL (see LOCAL-statement ) such as the data set name and FOLD, MOD, REOPEN and SPACE parameters

OPTions

Displays the settings that might be specified on the OPTIONS statement (see OPTIONS-statement ) such as delimiters, framing, host name options, and so forth

PARMs

Displays the data set equivalent to LOCAL,OPTIONS,SERVER,TIME

SERVers

Displays the settings related to the syslog server, including any alternatives

For more information, see Multiple-syslog-server-support and SERVER-statement.

TIME

Displays the settings related to TIME, such as the date and time formats, time zone

For more information, see TIME-statement.

TIMERs

Displays the currently pending internal timers such as for timeouts, alternative server reversion, and automatic parameter refresh

For more information, see TIMEout and ALTRevert in SERVER-statement and REFResh in OPTIONS-statement.

LOCal(REOPen)

Specifies that BMC AMI Defender is to close and re-open the LOCAL syslog data set

Before using this command, you should consider the effect of the use or absence of system variable symbols in the specified data set name, and the use or absence of MOD.

Example

REOPEN might be meaningless for a data set specified with MOD because additional records simply get appended to the already-open data set. If REOPEN is specified for a local MVS data set without the &HHMMSS. variable symbol in its name and without MOD, BMC AMI Defender overwrites the existing data set and any existing messages are lost.

PARMs

PARMs( datasetSpecification )

Specifies a data set from which BMC AMI Defender takes new operating parameters

Because the parameter file is an input file, a specification of * (SYSOUT) is invalid, and the output variable symbols are not supported. z/OS command processes uppercase, unquoted command operands, so you can specify a zFS file as follows: 

Example

F CZAGENT,PARMS('/u/myfiles/czaparms')

or

F CZAGENT,'PARMS(/u/myfiles/czaparms)

The default PDS(E) is DD:CZAPARMS, that is, the library specified by the CZAPARMS DD statement. If the data set specification is omitted then it defaults to the last parameter file specified, that is, the data set specified or defaulted in any preceding MODIFY PARMS, or if none, the data set specified or defaulted in START PARMS.

This file is described in Parameter-file-statements.

Parameter processing starts over each time you read in a parameter file with MODIFY CZAGENT,PARMS with the exception of OPTIONS TRACE, SUBSYS, and QUEUE. Every parameter assumes its default value except for the three parameters named. OPTIONS QUEUE and SUBSYS are ignored during MODIFY processing; to change their values, you must stop and restart BMC AMI Defender; to change the setting of TRACE you must explicitly specify TRACE. So if BMC AMI Defender is running with a LOCAL data set, FORMAT(ALL), and an SMF 119 statement, and you read in a new parameter file with FORMAT, LOCAL, and SMF 119 omitted, then FORMAT assumes its default value of ERGONOMIC, the LOCAL data set is closed, and no further SMF 119 records are formatted and transmitted.

SET(APF)

Causes BMC AMI Defender to re-initialize the table of APF-authorized data sets

The table is refreshed from the current APF list and the defined LNKLST sets. BMC AMI Defender updates this table automatically in most circumstances so this command is superfluous unless one or more of the following situation occurs:

  • You are running a release of z/OS below V2R2
  • SMF 90 subtype 37 is not enabled for BMC AMI Defender processing
  • You have added non-APF-listed files to the active LNKLST

For more information, see "Other Limitations" under APF status enrichment in the "SMF record enrichment" topic. Use caution with SET(APF) as it freezes SMF record processing for about one second, depending on the number of APF-authorized data sets and the speed and processor load of your system.

SET(CICS(NEWMCT))

Requires BMC AMI Defender, for performance reasons, to cache any DFHMCT customization on a per-CICS-applid basis

If you re-customize and stop and start a CICS subsystem you can force BMC AMI Defender to purge and refresh its CICS DFHMCT customization cache with the command SET(CICS(NEWMCT)).

SET(DB2(STArt))

Causes BMC AMI Defender to re-issue any relevant START TRACE commands for DB2

See STArt in the SMF-Db2-statement .

SET(SERVER(RECONnect))

Causes BMC AMI Defender to attempt to reconnect to the active syslog server

This command is only valid if the syslog server is disconnected (due to an error) and using TCP/IP or SSL/TLS transport. This command would be suitable for use when a previously disconnected communication link is restored.

SET(SERVER(USEALT( number )))

SET(SERVER(USEPRImary))

Causes BMC AMI Defender to change the active syslog server to the primary or the specified alternate

For more information, see Multiple-syslog-server-support.

USEPRIMary and USEALT(0) are equivalent.

STATs

STATs(RESET,Send)

Causes BMC AMI Defender to display message CZA0215I with counts of SMF records processed and similar statistics on the console and in the listing on CZAPRINT

In addition, counts by SMF record subtype are displayed only in the CZAPRINT listing. If RESET is specified then the various statistical counters are reset to zero after being displayed. If Send is specified then the statistics (not including the subtype counts) are also transmitted to the BMC Defender Server or another syslog console as syslog messages. Send can be abbreviated as S. For more information about various statistics except the subtypes, see Counters. See Messages CZA0300 through CZA0399 for information about the subtype statistics in messages CZA0323I through CZA0327I.

TRACE( traceSpecification )

Requires BMC AMI Defender to output additional diagnostic messages of the specified type in the CZAPRINT data set

TRACE can be useful for diagnosing certain problems.

If TRACE is completely omitted or specified as TRACE(), it defaults to the previous state of TRACE. If TRACE(-ALL) is specified, all tracing is turned off.

Specify zero or more of the trace types described in Using-the-TRACE-facility (in any order). Prefix any of the specifications with  (a minus sign or hyphen) to indicate negation. The specifications are processed left to right. For instance, TRACE(ALL -XL -ENV) indicates all TRACE output except related to translation and the operating environment.

After processing TRACE, BMC AMI Defender displays the trace specifications in effect. To simply display the current trace specifications, enter F CZAGENT,TRACE().

For more information, see Using-the-TRACE-facility.

MODIFY command for BMC AMI Defender for McAfee DAM

MODIFY_DAM_5.9.02.png

For information about additional MODIFY operands, see the following topics:

CZAGENT for BMC AMI Defender for McAfee DAM

Display specification

Information displayed

czagentName | taskName

Defines the name of the BMC AMI Defender for z/OS job or started task, as specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Display(...)

Causes BMC AMI Defender for z/OS to display the currently active settings for the indicated parameters

DAM(SESSions)

Causes BMC AMI Defender for z/OS to display a summary list of all active DAM sessions

The sessions are displayed in session-unique order. The first twenty or fewer sessions are displayed on the console and in CZAPRINT. Any sessions beyond twenty are displayed only in CZAPRINT. The display has the following format:

CZA0360I 3 active DAM sessions
CZA0361I Session-Unique   SSID User ID   Logon   Activity Conn   Stmts
CZA0362I ---------------- ---- -------- -------- -------- ------ -----
CZA0363I 01e68ccb6d5bd88f DB1T DB1TADMT 19:08:41 19:08:42 LOCAL      4
CZA0363I 0ae29e057e4acc85 DB1T RU018P   19:08:50 19:08:51 LOCAL    131
CZA0363I 79e39263f13b171a DB1T RU018P   19:08:43 19:08:47 LOCAL    143

DAM(SESSions(id))

Displays details for the specified session ID. Enter one or more leading hex digits of a session-unique from the summary session display (or the DAM console)

You must enter enough hex digits to uniquely identify the session.

Example

Given sessions are shown in DAM(SESSions). You can specify D(DAM(SESS(7))) because only one session-unique begins with 7, but you can not specify D(DAM(SESS(0))) because more than one session-unique begins with 0. You can however specify D(DAM(SESS(01))) or D(DAM(SESS(0A))). Always specify as many additional digits of the session-unique as you want. D(DAM(SESS(01E6))) and D(DAM(SESS(79E39263F13B171A))) both are valid. You might specify alphabetic hex characters in any mix of upper and lower case. 79E and 79e both are valid. The detail display has the format as follows:

 CZA0251I SESSION     79e39263f13b171a  
 CZA0251I     Activity   2017-07-04T14:29:04.891-0400     
 CZA0251I     Collid  
 CZA0251I     Connection LOCAL    
 CZA0251I     Date       2017-07-04T14:29:04.920-0400 (1499192944920)
 CZA0251I     Facility   BATCH    
 CZA0251I     Job name   RU018PR -BATCH
 CZA0251I     Location   NA01DB1T
 CZA0251I     Logon time 2017-07-04T14:28:50.506-0400 (1499192930506)
 CZA0251I     Package
 CZA0251I     Plan    
 CZA0251I     Program
 CZA0251I     Remote txn    
 CZA0251I     SQLID      RU018P   
 CZA0251I     SSID       DB1T     
 CZA0251I     Stmt-cmd
 CZA0251I     Stmts      565
 CZA0251I     System     SYSC     
 CZA0251I     Trans-tok  15179512282545455104
 CZA0251I     Userid     RU018P   
 CZA0251I     Worksta'n  BATCH 


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*