I *think* z/OS is now shipping header files for C/C++ for many SMF records. If not, EDCDSECT does a halfway decent job. (I know -- been there, done that, got the T-shirt.) There is someone I think who offers SMF layouts in Java, perhaps at no charge. Google might be your friend.
Yes, for "old" SMF records types 128 to 255 are reserved for non-IBM use. There is no official repository of who uses what, but Cheryl Watson has the best list I know of. Google is your friend. For the "new" SMF record format with 16-bit types, yes, there is a large range reserved for non-IBM but I do not have it memorized. Yes, I think it may be possible to run z/OS with no security subsystem but I doubt that anyone does so. Yes, you would need a SAF stub that always said "yes, go ahead, you have access" or perhaps made some very simplistic determination: GILMART is allowed to do anything; anyone else only gets read access to datasets unless they have their HLQ. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Paul Gilmartin Sent: Sunday, October 25, 2020 9:00 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: SMF to capture user login history On Sun, 25 Oct 2020 15:07:20 +0000, Seymour J Metz wrote: >Well, if I didn't have an IBM or third party tool like SAS/MXG, I'd write a >small PL/I program to process the SMF data. The records to look at depend on >the types of logon you're concerned with, > >"Note: IBM recommends that you use record type 30 rather than record types 4, >5, 20, 34, 35, and 40." You may also need type 70 (RMF). > Are there PL/I header files mapping SMF record types? C? Rexx? For Rexx, the ideal would be a facility similar to OMVS ADDRESS SYSCALL which returns not a storage object with mapped offsets but a compound symbol with a programmer-specified stem and tail values mapped by mnemonic SYSCALL_CONSTANTS. Is there (a range of) SMF record types reserved for ISVs? Or even a single type further distinguished by ISV-assigned component prefix? Is it possible to operate z/OS with neither RACF nor a competing product? I'd suspect many SAF calls would need to be stubbed. Data set passwords, UADS, etc.? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
