ftp://public.dhe.ibm.com/eserver/zseries/zos/racf/pdf/r05_unix_file_security.pdf
Scott ford www.identityforge.com Tell me and I'll forget; show me and I may remember; involve me and I'll understand. - Chinese Proverb On Nov 7, 2012, at 8:45 AM, "McKown, John" <[email protected]> wrote: > Which "log"? And what is the source of the command? I can do an UNMOUNT in > TSO (interactive or batch) to remount a filesystem to READ. I can also do a > "chmount" command from a UNIX shell session (interactive or batch) to do the > same. I don't think either of these commands writes to the z/OS SYSLOG or the > UNIX syslog daemon (assuming the OP is running it). > > -- > John McKown > Systems Engineer IV > IT > > Administrative Services Group > > HealthMarkets(r) > > 9151 Boulevard 26 * N. Richland Hills * TX 76010 > (817) 255-3225 phone * > [email protected] * www.HealthMarkets.com > > Confidentiality Notice: This e-mail message may contain confidential or > proprietary information. If you are not the intended recipient, please > contact the sender by reply e-mail and destroy all copies of the original > message. HealthMarkets(r) is the brand name for products underwritten and > issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake > Life Insurance Company(r), Mid-West National Life Insurance Company of > TennesseeSM and The MEGA Life and Health Insurance Company.SM > > >> -----Original Message----- >> From: IBM Mainframe Discussion List [mailto:[email protected]] >> On Behalf Of Scott Ford >> Sent: Tuesday, November 06, 2012 6:17 PM >> To: [email protected] >> Subject: Re: Who changed the mount attrib of a zFS? >> >> Roger, >> >> No problem, so that leaves an Operator or someone authorized to issue >> the command. >> Another possibility would be a software product, maybe. >> >> If you have you sys logs you could try to find who issued the command >> >> Scott ford >> www.identityforge.com >> >> Tell me and I'll forget; show me and I may remember; involve me and >> I'll understand. - Chinese Proverb >> >> >> On Nov 6, 2012, at 3:26 PM, Roger Lowe <[email protected]> wrote: >> >>> Scott, >>> I should have been a little more clear on my original post - >>> the BPXRMxx parmlib member has the file being mounted in RW mode, but >>> somehow during normal operations, the file mount attribute got >> changed >>> from RW to R. I can't use the SMF Type 92 records as they are >>> currently not being recorded :( I have also looked at the Type 80 >>> records and RACF Event Codes 44 and 55 (Mount and UnMount) but that >>> has also been unsuccessful >>> >>> Roger >>> >>> On Tue, 6 Nov 2012 10:21:29 -0500, Scott Ford >> <[email protected]> wrote: >>> >>>> Roger, >>>> >>>> If Its the member of parmlib, look at the security subsystems >>>> definitions for that library, I.e.; DATASET >>>> >>>> Scott ford >>>> www.identityforge.com >>>> >>>> Tell me and I'll forget; show me and I may remember; involve me and >>>> I'll understand. - Chinese Proverb >>>> >>>> >>>> On Nov 5, 2012, at 8:50 PM, Roger Lowe <[email protected]> >> wrote: >>>> >>>>> Hi, >>>>> is there an easy way to identify who might have changed the MOUNT >> attribute of a zFS from RW to R? >>>>> >>>>> Thanks, Roger >>>>> >>>>> ------------------------------------------------------------------- >> - >>>>> -- For IBM-MAIN subscribe / signoff / archive access instructions, >>>>> send email to [email protected] with the message: INFO >>>>> IBM-MAIN >>> --------------------------------------------------------------------- >> - >>> For IBM-MAIN subscribe / signoff / archive access instructions, send >>> email to [email protected] with the message: INFO IBM-MAIN >> >> ---------------------------------------------------------------------- >> For IBM-MAIN subscribe / signoff / archive access instructions, send >> email to [email protected] with the message: INFO IBM-MAIN > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
