IBM GC28-1920-01 manual Auditing Considerations, SMF Records, Auditors Guide and OS/390, Interface

Chapter 8. Auditing Considerations

This

section

summarizes the

changes

to

auditing

procedures

for

the

Ÿ

SMF records

Ÿ

Report

writer

utility

Ÿ

SMF

data

unload

utility

The

auditor

must

decide on

appropriate

global

auditing

options

for t

and

on which auditing reports are to beOS/390producedSecurity. See Server

(RACF)

Auditor's Guideand OS/390

Security

Server (RACF) Macros

and

Interface

for

more

information.

SMF Records

Figure 22 summarizes		the	new	event	codes	for	SMF records created		by
OS/390 Release 2. The new event code is						a general-use programming			inte
(GUPI).
Figure 22.	New Event Codes
Event Code	Description							Support
65	Audits	the	passing	of	access	rights		fromOS/390one
	process	to	another.					OpenEdition

Figure 23 summarizes changes to SMF records created by RACF for OS/39 Release 2. These changes are general-use programming interfaces (GUPI

Figure 23 (Page 1 of 2). Changes to SMF Records

Record Type

80

80

Record

Description

of

Change

Support

Field

SMF80EVT

Event

code

57 is used to audit

OS/390twonew

OpenEdition

services: a

new

console

OpenEdition

communications service (CCS) and a

new

workload

manager

(WLM)

service. Two

new audit function codes, 99 and 100,

cause event 57 records to be generated.

Creation

of the

audit

records

is

controlled

by the existing PROCESS class.

Event code 65 is used to audit the

passing

of

access

rights

from one

process

to another. Three new audit function

codes, 95, 96, and 97, cause event 65

records to be generated. Creation of the

audit records is controlled by

the existing

PROCACT class.

Relocate

For

event

code

2,

this

SMF

recordOS/390

64

contains

a

link

value

to

connect

clientOpenEditionand

server

audit

records.

DCE

 Copyright IBM Corp. 1994, 1996 45