MODIFY command

Name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Name of the subtask

You can use one of the following subtasks:

• For alert automation, $IPAUTO

• For z/VM subtasks (SPE2010):

  • VMCON
  • VMSECURE
  • VMRACF

  (Prior to SPE2010, see z/VM connection subtasks.)

List TCP/IP connections

Lists all connections from remote BMC AMI Command Center for Security systems.

Stop TCP/IP connections

Terminate one or all BMC AMI Command Center for Security connections. For example:

F czagentName,$IPAUTO,STOP 1

Force stop TCP/IP connections

Force the termination of one or all BMC AMI Command Center for Security connections using an S222-10 abend code. For example:

F czagentName,$IPAUTO,FORCE ALL

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

BACKLOG(Send)

(Does not apply to Datastream for Ops)Causes BMC AMI Defender to display message CZA0386 with queue utilization data on the console and in the listing on CZAPRINT

If you specify Send (or S), then a BACKLOG syslog message is transmitted to the BMC Defender Server or another syslog console as a syslog message. For more information about the BACKLOG syslog message, see BACKLOG-statement.

Causes BMC AMI Defender to transmit the Clock message CZA0352I to the SIEM server and display the message on the console and in CZAPRINT

Causes BMC AMI Defender to display the currently active settings for the indicated parameters

The values are displayed on the console (except for Display(APF)) and in CZAPRINT in the following format:

Specifies that BMC AMI Defender is to close and reopen the LOCAL syslog data set

Before using this command, consider the effect of the use or absence of system variable symbols in the specified data set name, and the use or absence of MOD.

Specifies the data set from which BMC AMI Defender takes new operating parameters

Because the parameter file is an input file, specifiying * (SYSOUT) is invalid and the output variable symbols are not supported. CZAJOBLG processes uppercase, unquoted command operands, so you can specify a zFS file as one of the examples:

• F CZAGENT,PARMS('/u/myfiles/czaparms')
• F CZAGENT,'PARMS(/u/myfiles/czaparms)'

The default PDS(E) is DD:CZAPARMS, the library specified by the CZAPARMS DD statement.

If you omit this value, it defaults to the last parameter file specified. For example, the data set specified or defaulted to in any preceding MODIFY PARMS or, if none, the data set specified or defaulted to in START PARMS.

For more information about the parameter file, see Parameter-file-statements.

Parameter processing starts over each time you read in a parameter file with MODIFY CZAGENT,PARMS with the exception of OPTIONS TRACE, SUBSYS, and QUEUE. Every parameter assumes its default value except for the three parameters named.

OPTIONS QUEUE and SUBSYS are ignored during MODIFY processing. To change their values, you must stop and restart BMC AMI Defender.

To change the setting of TRACE, you must explicitly specify TRACE. So if BMC AMI Defender is running with a LOCAL data set, FORMAT(ALL), and an SMF 119 statement, and you read in a new parameter file with FORMAT, LOCAL, and SMF 119 omitted, then FORMAT assumes its default value of ERGONOMIC, the LOCAL data set is closed, and no further SMF 119 records are formatted and transmitted.

Causes BMC AMI Defender to re-initialize the table of APF-authorized data sets

The table is refreshed from the current APF list and the defined LNKLST sets. BMC AMI Defender updates this table automatically in most circumstances, so this command is superfluous unless at least one of the following situations occurs:

• You are running a release of z/OS below V2R2.
• SMF 90 subtype 37 is not enabled for BMC AMI Defender processing.
• You have added non-APF-listed files to the active LNKLST.

For more information, see "Other Limitations" under APF status enrichment in the "SMF record enrichment" topic. Use caution with SET(APF) because it freezes SMF record processing for about one second, depending on the number of APF-authorized data sets and the speed and processor load of your system.

SET(CICS(NEWMCT))

(Does not apply to Datastream for Ops)Requires BMC AMI Defender, for performance reasons, to cache any DFHMCT customization on a per-CICS-applid basis

If you recustomize and stop and start a CICS subsystem, you can force BMC AMI Defender to purge and refresh its CICS DFHMCT customization cache with the command SET(CICS(NEWMCT)).

SET(DB2(STArt))

(Does not apply to Datastream for Ops)Causes BMC AMI Defender to reissue any relevant START TRACE commands for DB2See STArt in the SMF-DB2-statement .

Causes BMC AMI Defender to attempt to reconnect to the active syslog server

This command is valid only if the syslog server is disconnected (due to an error) and using TCP/IP or SSL/TLS transport. This command would be suitable for use when a previously disconnected communication link is restored.

SET(SERVER(USEALT(number)))

SET(SERVER(USEPRImary))

(Does not apply to Datastream for Ops)Causes BMC AMI Defender to change the active syslog server to the primary or the specified alternate

For more information, see Multiple-syslog-server-support.

USEPRIMary and USEALT(0) are equivalent.

Causes BMC AMI Defender to display message CZA0215I with counts of SMF records processed and similar statistics on the console and in the listing on CZAPRINT

In addition, counts by SMF record subtype are displayed only in the CZAPRINT listing. If RESET is specified, then the various statistical counters are reset to zero after being displayed. If Send is specified, then the statistics (not including the subtype counts) are also transmitted to the BMC Defender Server or another syslog console as syslog messages. Send can be abbreviated as S. For more information about various statistics except the subtypes, see Counters. See Messages CZA0300 through CZA0399 for information about the subtype statistics in messages CZA0323I through CZA0327I.

Tells BMC AMI Defender to use one or more trace types (in any order) or no trace type, as described in Using-the-TRACE-facility

TRACE can be useful for diagnosing certain problems. Diagnostic messages of the specified type are output to the CZAPRINT data set. If TRACE is completely omitted or specified as TRACE(), it defaults to the previous state of TRACE. If TRACE(-ALL) is specified, all tracing is turned off.

Prefix any of the trace specifications with a minus sign (-) to indicate negation. The specifications are processed from left to right. In the following example, the statement indicates that all TRACE output is used except that related to translation and the operating environment:

After processing TRACE, BMC AMI Defender displays the trace specifications that are in effect. To display the current trace specifications only, enter the following statement:

For more information about TRACE, see TRACE-facility-syntax.

Defines the name of the BMC AMI Defender for z/OS job or started task, as specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Causes BMC AMI Defender for z/OS to display the currently active settings for the indicated parameters

Causes BMC AMI Defender for z/OS to display a summary list of all active DAM sessions

The sessions are displayed in session-unique order. The first 20 or fewer sessions are displayed on the console and in CZAPRINT. Any sessions beyond 20 are displayed only in CZAPRINT. The display has the following format:

Displays details for the specified session ID. Enter one or more leading hex digits of a session-unique from the summary session display (or the DAM console)

You must enter enough hex digits to uniquely identify the session.

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Reloads the REXX execs located in amihlq.CZAGENT.EXEC in the SYSEXEC DD of the BMC AMI Defender job or started task

For changes made to the REXX execs in the exec data set to take effect, you must reload them.

(SPE2101) Displays the status of the REXX manager

Provides a detailed list of the status of REXX manager including:

• Time that the REXX EXECs were last loaded
• Number of automated alert threads and their timeout value
• Total number of automated alerts that haven't been executed, pending a THREAD becoming available
• Total number of automated alerts that have been executed so far by BMC AMI Defender

An example of the output for the LIST command is as follows:

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Lists the BMC AMI Defender servers in your XCF group

Defines the name of the BMC AMI Defender job or started task specified on the START command or in the JCL

For a description of how this name is determined and specified, see "MODIFY command" in the "MVS system commands reference" section on the IBM Knowledge Center website.

This parameter is required.

Forces a scan on the specified job or started task