Re: Updating IEEMB846
>From a manual out on manualwiki.. An installation can use the IBM-supplied IEEMBS46 or create its own module in SYS1.LlNKLIB. The SMFTSOCM member of SYS1.SAMPLIB is provided so that the user can add or delete commands for the installation. The SMFTSOCM member contains the source code for the IBM-supplied IEEMB846 Rob On Thu, Aug 24, 2023, 11:29 Lennie Dymoke-Bradshaw < 032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: > I placed a modified copy in a later library in the linklist. Then I renamed > the version in SYS1.LINKLIB. LLA REFRESH was done. So I expected it to be > found. But it behaved as if it did not find it. No SMF 32s were being > logged > at all. > Lennie > > -Original Message- > From: IBM Mainframe Discussion List On Behalf > Of > Peter Relson > Sent: 24 August 2023 15:46 > To: IBM-MAIN@LISTSERV.UA.EDU > Subject: Re: Updating IEEMB846 > > > it appears that if IEEMB846 is placed in a library other than SYS1.LINKLIB, > then it is not found. > > > That should not be a surprise. The module is LOADed. Normal search rules > apply. > SYS1.LINKLIB is the first data set in the LNKLST concatenation unless you > have used the SYSLIB LINKLIB statement of PROGxx, so a copy in a "later" > data set will not be found. If you put your copy of the module in LPA > (dynamic or other) it will be the one found. > > Peter Relson > z/OS Core Technology Design > > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, send email > to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
I placed a modified copy in a later library in the linklist. Then I renamed the version in SYS1.LINKLIB. LLA REFRESH was done. So I expected it to be found. But it behaved as if it did not find it. No SMF 32s were being logged at all. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Peter Relson Sent: 24 August 2023 15:46 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 it appears that if IEEMB846 is placed in a library other than SYS1.LINKLIB, then it is not found. That should not be a surprise. The module is LOADed. Normal search rules apply. SYS1.LINKLIB is the first data set in the LNKLST concatenation unless you have used the SYSLIB LINKLIB statement of PROGxx, so a copy in a "later" data set will not be found. If you put your copy of the module in LPA (dynamic or other) it will be the one found. Peter Relson z/OS Core Technology Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
it appears that if IEEMB846 is placed in a library other than SYS1.LINKLIB, then it is not found. That should not be a surprise. The module is LOADed. Normal search rules apply. SYS1.LINKLIB is the first data set in the LNKLST concatenation unless you have used the SYSLIB LINKLIB statement of PROGxx, so a copy in a "later" data set will not be found. If you put your copy of the module in LPA (dynamic or other) it will be the one found. Peter Relson z/OS Core Technology Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
On Wed, 23 Aug 2023 19:58:07 +0100, Lennie Dymoke-Bradshaw wrote: >Excellent. Now why didn't I think of that? >Thank you Walt. You're welcome, Lennie :) -- Walt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
Excellent. Now why didn't I think of that? Thank you Walt. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Walt Farrell Sent: 23 August 2023 16:30 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 On Tue, 22 Aug 2023 13:07:01 +0100, Lennie Dymoke-Bradshaw wrote: >I am trying to determine which users are using the TSO CONSOLE command. > >This is controlled one of those TSOAUTH checks that are done at LOGON >time and the results of the RACF check are stored in the PSCB in bit >PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access >Monitor) are of no use. I want to know who is using it, rather than who can >use it. Have you considered defining CONSOLE in the RACF PROGRAM class, allowing READ access to everyone, and setting appropriate AUDIT options? -- Walt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
On Tue, 22 Aug 2023 13:07:01 +0100, Lennie Dymoke-Bradshaw wrote: >I am trying to determine which users are using the TSO CONSOLE command. > >This is controlled one of those TSOAUTH checks that are done at LOGON time >and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So >many normal RACF checking monitors (such as zSecure Access Monitor) are of >no use. I want to know who is using it, rather than who can use it. Have you considered defining CONSOLE in the RACF PROGRAM class, allowing READ access to everyone, and setting appropriate AUDIT options? -- Walt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
Its has to load with the system Regards, Steve -Original Message- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Lennie Dymoke-Bradshaw Sent: Wednesday, August 23, 2023 10:17 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 Yes, they will, but IEEMB846 still needs updating for various TSO commands that IBM have omitted from it. I have done tests and it appears that if IEEMB846 is placed in a library other than SYS1.LINKLIB, then it is not found. I can update it in-flight in SYS1.LINKLIB and after an LLA refresh and restart of the TSO user's address space, the updates are picked up. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lionel B. Dyck Sent: 23 August 2023 16:02 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 Will SMF Type 32 records suffice? Lionel B. Dyck <>< Website: https://www.lbdsoftware.com Github: https://github.com/lbdyck “Worry more about your character than your reputation. Character is what you are, reputation merely what others think you are.” - - - John Wooden -Original Message- From: IBM Mainframe Discussion List On Behalf Of Jon Perryman Sent: Wednesday, August 23, 2023 9:57 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 TSO console has user exits and I'm guessing that it has an init exit. It should be simple to code the exit and write the tso userid to a file (dynalloc with disp=mod). I don't recommend this as a permanent solution. An abend could leave the dataset allocated locking out other users and it wastes space even if you specify blksize=lrecl. It would be a little more work but you could use a VSAM KSDS with the userid as the key to collect the userid only once and eliminate potential alloc problem. I would think the exit could be dynamically activated and deactivated. On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw <032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
The routine that primes an area for use by SMF 32 runs at job/step start when SMF 32's are being collected. It loads and deletes IEEMB846. That means that an update to 'sys1.linklib(IEEMB846)' will be picked up "the next time" that this routine runs, if you have updated LLA's directory for that member or for all of sys1.linklib or refreshed LLA (or are not using LLA). By the way, the notion of understanding what is authorized by the security product to be used can be used to track what actually is used if you have the profile defined to log successes. That "log" can then be looked at. Peter Relson z/OS Core Technology Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
Yes, they will, but IEEMB846 still needs updating for various TSO commands that IBM have omitted from it. I have done tests and it appears that if IEEMB846 is placed in a library other than SYS1.LINKLIB, then it is not found. I can update it in-flight in SYS1.LINKLIB and after an LLA refresh and restart of the TSO user's address space, the updates are picked up. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lionel B. Dyck Sent: 23 August 2023 16:02 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 Will SMF Type 32 records suffice? Lionel B. Dyck <>< Website: https://www.lbdsoftware.com Github: https://github.com/lbdyck “Worry more about your character than your reputation. Character is what you are, reputation merely what others think you are.” - - - John Wooden -Original Message- From: IBM Mainframe Discussion List On Behalf Of Jon Perryman Sent: Wednesday, August 23, 2023 9:57 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 TSO console has user exits and I'm guessing that it has an init exit. It should be simple to code the exit and write the tso userid to a file (dynalloc with disp=mod). I don't recommend this as a permanent solution. An abend could leave the dataset allocated locking out other users and it wastes space even if you specify blksize=lrecl. It would be a little more work but you could use a VSAM KSDS with the userid as the key to collect the userid only once and eliminate potential alloc problem. I would think the exit could be dynamically activated and deactivated. On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw <032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
> Will SMF Type 32 records suffice? It's been way too long but if I remember correctly, SMF Type 32 records are not collected for batch TSO. Check into it if batch TSO is important. On Wednesday, August 23, 2023 at 08:01:59 AM PDT, Lionel B. Dyck wrote: Will SMF Type 32 records suffice? Lionel B. Dyck <>< Website: https://www.lbdsoftware.com Github: https://github.com/lbdyck “Worry more about your character than your reputation. Character is what you are, reputation merely what others think you are.” - - - John Wooden -Original Message- From: IBM Mainframe Discussion List On Behalf Of Jon Perryman Sent: Wednesday, August 23, 2023 9:57 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 TSO console has user exits and I'm guessing that it has an init exit. It should be simple to code the exit and write the tso userid to a file (dynalloc with disp=mod). I don't recommend this as a permanent solution. An abend could leave the dataset allocated locking out other users and it wastes space even if you specify blksize=lrecl. It would be a little more work but you could use a VSAM KSDS with the userid as the key to collect the userid only once and eliminate potential alloc problem. I would think the exit could be dynamically activated and deactivated. On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw <032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
Will SMF Type 32 records suffice? Lionel B. Dyck <>< Website: https://www.lbdsoftware.com Github: https://github.com/lbdyck “Worry more about your character than your reputation. Character is what you are, reputation merely what others think you are.” - - - John Wooden -Original Message- From: IBM Mainframe Discussion List On Behalf Of Jon Perryman Sent: Wednesday, August 23, 2023 9:57 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 TSO console has user exits and I'm guessing that it has an init exit. It should be simple to code the exit and write the tso userid to a file (dynalloc with disp=mod). I don't recommend this as a permanent solution. An abend could leave the dataset allocated locking out other users and it wastes space even if you specify blksize=lrecl. It would be a little more work but you could use a VSAM KSDS with the userid as the key to collect the userid only once and eliminate potential alloc problem. I would think the exit could be dynamically activated and deactivated. On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw <032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
TSO console has user exits and I'm guessing that it has an init exit. It should be simple to code the exit and write the tso userid to a file (dynalloc with disp=mod). I don't recommend this as a permanent solution. An abend could leave the dataset allocated locking out other users and it wastes space even if you specify blksize=lrecl. It would be a little more work but you could use a VSAM KSDS with the userid as the key to collect the userid only once and eliminate potential alloc problem. I would think the exit could be dynamically activated and deactivated. On Tuesday, August 22, 2023 at 05:07:20 AM PDT, Lennie Dymoke-Bradshaw <032fff1be9b4-dmarc-requ...@listserv.ua.edu> wrote: I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
You can do it in flight, but at some risk if you do it in place. The safest way is to link it into a separate library, activate dynamic linklist and then loggon. -- Shmuel (Seymour J.) Metz http://mason.gmu.edu/~smetz3 From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of Lennie Dymoke-Bradshaw [032fff1be9b4-dmarc-requ...@listserv.ua.edu] Sent: Tuesday, August 22, 2023 8:07 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Updating IEEMB846 I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Updating IEEMB846
I am trying to determine which users are using the TSO CONSOLE command. This is controlled one of those TSOAUTH checks that are done at LOGON time and the results of the RACF check are stored in the PSCB in bit PSCBCNAU. So many normal RACF checking monitors (such as zSecure Access Monitor) are of no use. I want to know who is using it, rather than who can use it. The TSO command table in IEEMB846 is used by the TMP and by ISPF to record commands issued in SMF type 32 records. (ISPF uses an interface via SVC 109.) However, IEEMB846 is old. In fact it is so old that it does not contain TESTAUTH, PARMLIB, CONSOLE, ISPF. The source is in SYS1.SAMPLIB(SMFTSOCM). I wish to update IEEMB846 to include the CONSOLE command. IEEMB846 is in a distinct load module in SYS1.LINKLIB. So can I update this table in flight, or do I need to IPL? Thanks, Lennie -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
