SMF 15 reports a dataset output CLOSE. SMF 42 reports a member update or delete. Is this a file integrity event? Is this worth correlating, or is it noise?
Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Walt Farrell Sent: Thursday, July 02, 2015 5:12 PM To: [email protected] Subject: Re: How does one definitively recognize a temp dataset by name? On Thu, 2 Jul 2015 13:55:46 -0700, Charles Mills <[email protected]> wrote: >Is there a definitive rule for recognizing *by name* a system temporary >dataset? The actual name, not &&WHATEVER. I am checking for (using >RACF EGN notation here to express my rule) 'SYS*.T*.R*.**'. Is that >sufficient to preclude false positives? Will it produce false >negatives? Is it over-specified? Just to be clear: you are only interested in temporary data sets where the system generated the name? You do not care about temporary data sets where the user specified the name fully, by using something like: DSNAME=X.Y,DISP=(NEW,DELETE),SPACE=... If you really want ALL temporary data sets then you cannot definitively find them by name. It would help if we knew what you were really trying to accomplish :) ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
