I can confirm Walt's accurate thoughts, and thank Mark for
data to confirm this for MXG users:
Change 30.162 Documentation. The RACF field AUDITFID is MXG variable
VMAC80A RACF264 in RACF event datasets TYPE8028/29/30/44/45/8055,
VMACRACF created from SMF 80 records, a 16-byte $HEX32 formatted
Aug 21, 2012 variable because it contains both hex and text:
e.g.: 'C8C6E2F0F0F93D0B00000000004D385B'X.
and the RACF field AUDITFID is MXG variable AUDITID in
dataset RACF0900 from IRRDBU00 RACF UNLOAD UTILITY data,
a $32 character variable with the above hex as text.
Both variables have been in MXG for years, but I have
added "AUDITFID" text to both variable's label.
Thanks to Mark Jacobs, Time Customer Service, USA.
Barry Merrill
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf
Of Jousma, David
Sent: Tuesday, August 21, 2012 11:44 AM
To: [email protected]
Subject: Re: zFS auditfid support
Glad to see you still participating Walt, post-retirement.
_________________________________________________________________
Dave Jousma
Assistant Vice President, Mainframe Services [email protected]
1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H p 616.653.8429 f 616.653.2717
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf
Of Walt Farrell
Sent: Tuesday, August 21, 2012 11:43 AM
To: [email protected]
Subject: Re: zFS auditfid support
On Mon, 20 Aug 2012 13:53:01 -0700, retired mainframer
<[email protected]> wrote:
>Both MXG (which requires SAS) and RACFICE (from SAMPLIB) provide the
>capability to adjust the selection criteria to anything you wish.
>
>But this assumes the data of interest is actually recorded. I found
>references to auditid in the BPXYATTR and BPXYSTAT macros. I could not
>find any reference in the SMF type 80 record description.
I -think- it would be extended relocate section #264 (x'108'), listed in the
RACF documentation for the type 80 record as File Identifier (16 bytes,
binary), and in the IRRADU00 output as the File ID (e.g, FACC_FILE_ID, 32 bytes
character in the "check file access record extension").
I have no way to check that, but a question on RACF-L might get a response from
a developer or Level 2. Or someone with access to SMF records and especially an
ICH408I containing the audit ID should be able to confirm it.
--
Walt
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to
[email protected] with the message: INFO IBM-MAIN
This e-mail transmission contains information that is confidential and may be
privileged. It is intended only for the addressee(s) named above. If you
receive this e-mail in error, please do not read, copy or disseminate it in any
manner. If you are not the intended recipient, any disclosure, copying,
distribution or use of the contents of this information is prohibited. Please
reply to the message immediately by informing the sender that the message was
misdirected. After replying, please erase it from your computer system. Your
assistance in correcting this error is appreciated.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to
[email protected] with the message: INFO IBM-MAIN
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
