TSO console has user exits and I'm guessing that it has an init exit. It
should be simple to code the exit and write the tso userid to a file (dynalloc
with disp=mod). I don't recommend this as a permanent solution. An abend could
leave the dataset allocated locking out other users and it wastes space even if
you specify blksize=lrecl. It would be a little more work but you could use a
VSAM KSDS with the userid as the key to collect the userid only once and
eliminate potential alloc problem.
I would think the exit could be dynamically activated and deactivated.
On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw
<[email protected]> wrote:
I am trying to determine which users are using the TSO CONSOLE command.
This is controlled one of those TSOAUTH checks that are done at LOGON time
and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So
many normal RACF checking monitors (such as zSecure Access Monitor) are of
no use. I want to know who is using it, rather than who can use it.
The TSO command table in IEEMB846 is used by the TMP and by ISPF to record
commands issued in SMF type 32 records. (ISPF uses an interface via SVC
109.) However, IEEMB846 is old. In fact it is so old that it does not
contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in
SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE
command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I
update this table in flight, or do I need to IPL?
Thanks,
Lennie
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
