On Sun, 28 May 2017 14:53:34 -0500, Paul Gilmartin <[email protected]> wrote:
>On Sun, 28 May 2017 11:31:41 -0700, Lizette Koehler wrote: > >>Note: Once you turn on the SMF collection, you will only get data from that >>point in time forward. So if you have something that connects only once a >>month, you will not see it until at least 30 days has passed. >> >Might one selectively block FTP with RACF, UACC=NONE,WARN and collect data? It's an interesting idea, but I don't know if it would work. First, of course, it would only work for outbound not inbound work, but that might be good enough for the OP. Second, the RACF Command Language Reference (for z/OS R13) says that RACF will not issue warning messages for CLASS(PROGRAM). Unfortunately, that is a bit unclear as it does not indicate whether WARNING works at all for CLASS(PROGRAM), and if it does work the book doesn't indicate whether SMF records would be created reflecting the use of WARNING to grant access. I don't remember whether WARNING will work at all for CLASS(PROGRAM); it's possible that it's ignored completely. I'll leave that for someone else to figure out using other books or books from a later release. -- Walt ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
