© 2009 IBM Corporation IWS z/OS SPEs Auditing enhancements

© 2011 IBM Corporation IBM Confidential Agenda Auditing improvements for CP: PI48075 New auditing feature for database objects PI48133, PI54662

© 2011 IBM Corporation Tracking operation completion in case of MCP actions taken at occurrence level: – Occurrence manual "set to complete“ – Automatic completion of internal not completed predecessors when an operation is manually set to complete. IBM Confidential Enhancing Auditing for CP Activities: PI48075 Adding more information on the operation event => in the Audit Report: The indication of the old status for operations, in the operation event and in the Audit Report A new TRL record (66) replaced the old operation event (23) to contain also the added information about status change

© 2011 IBM Corporation IBM Confidential Agenda Auditing improvements for CP: PI48075 New auditing feature for database objects PI48133, PI54662

© 2011 IBM Corporation IBM Confidential Extended Auditing Highlights We need to log much more information than today. The JT logs are currently used also for auditing purposes but their main functionality is to be used for internal turn over and recovery processing. Thus we should not add new data to the JT logs that is not useful for this purpose and avoid overloading the JT files. We needed new JT-like sequential files (DB logs) to log all the DB records before and after the changes. This files need to be saved and archived, and we use the same processing currently running for the JT. The new data are logged optionally. Anew value is available for the AMOUNT parameter of the AUDIT statement to indicate to switch to Extended Auditing. These are the main considerations coming from customers’ needs:

© 2011 IBM Corporation IBM Confidential Extended Auditing Infrastructure: PI48133, PI54662 A new set of JT-like sequential datasets to log database activities: EQQDB*  EQQDBARC  EQQDB01-EQQDBnn  EQQDB01-EQQDBnn (where nn is the same number as JTs)  EQQDROUT TRL67 Apart from the standard (JT-like) TRL records for opening and closing datasets such as TRL 37 (20) 36, all the DB activities for which the Extended Auditing is enabled are logged in EQQDB* datasets by means of a new record: TRL67 that extends the old TRL32. When a TRL67 is logged in EQQDB*, the old, known TRL32 will NOT be logged in the EQQJT* (except when the Hot Standby Controller feature is active) All the controller messages regarding JT datasets switch and archiving have been changed to refer also to DB datasets when appropriate Here are the main internal highlights that support the design of Extended Auditing infractructure (1/2):

© 2011 IBM Corporation IBM Confidential Extended Auditing Infrastructure: PI48133, PI54662 BEFORE AFTER In case of MODIFY, both the old and new record of the database (BEFORE and AFTER) are logged in EQQDB* The EQQDB* MUST be the same number as EQQJT* and the SWITCH processing is always synchronized (e.g. At each CP backup)  EQQJTARC EQQDBARC  EQQJT01 EQQDB01... EQQJTnn EQQDBnn  EQQTROUT EQQDROUT In case EQQDBARC gets full, the Extended Auditing is automatically deactivated without causing the abend of the NMM task EQQDROUT is filled in by Daily Plan batch by using the same criterium used for EQQTROUT Here are the main internal highlights that support the design of Extended Auditing infractructure (2/2):

© 2011 IBM Corporation IBM Confidential Enabling Extended Auditing: PI48133, PI54662 Run EQQJOBS to create sample JCLs and set Y to activate the Extended Auditing. Run EQQJOBS to create Skeletons. EQQPCS14 Run the sample JCL EQQPCS14 to allocate the new EQQDB* datasets. Modify Controller JCL and Daily Plan batch jobs procedures to address the new DD EQQDB* statements (or copying the updated samples from the sample library). AMOUNT EXTENDED A new value to be assigned to the AMOUNT keyword of the AUDIT parameter, as an alternative to the already existing ones (INDEX and DATA) : EXTENDED At this point you are ready to start! Take the following steps to configure your environment for using the Extended Auditing Feature:

© 2011 IBM Corporation The EQQAUDIT code has been enhanced to read also the new DB logs. The processing of each DB record saved before and after the change allows to provide information about:  who (the user under which the request was executed);  how (Dialog, PIF, DWC), when (timestamp);  what (list of fields modified with old and new value) was changed. IBM Confidential Formatter

© 2011 IBM Corporation Formatter New INPUT DATASETs are now passed in the SYSIN to the EQQAUDIT program to produce DB logs reports: IBM Confidential

© 2011 IBM Corporation New PARMS can be passed in the SYSIN to the EQQAUDIT program to produce DB logs reports: – DBX, DBR to specify the input files – K (KEY),S (SUMMARY) or F (FULL) to select the report level for records and sections added or deleted – Record type (AD, WS, RD, RG, OI, JV, PER, CAL) – Object names (or keys) – Dates IBM Confidential Formatter

© 2011 IBM Corporation IBM Confidential Formatter //* IF YOU ARE USING DBX or DBR AS INPUT: //* ========================================================= //* POS 01-03: 'DBX','DBR' TO DEFINE WHAT INPUT FILES TO USE //* POS 04-04: EXTENDED AUDITING REPORT Level of information: //* Valid for delete or add action //* K - print key only //* S - print summary info (default) //* F - print complete info //* POS 05-08: FILE FILTERING: //* 'WS ','RD ','AD ','RUN ','OI ','JV ', //* 'PER ','CAL ',' ' //* POS 09-52: ACCORDING TO FILE FILTERING, ADDITIONAL KEY //* FILTERING: //* - WS WSNAME POS: //* - RD RESOURCE NAME POS: //* - AD AD NAME POS: //* - RG RUN CYCLE GROUP POS: //* - OI OIKEY POS: //* ADID POS: //* OPNO POS: //* - JV TABLE NAME POS: //* - PER PERIOD NAME POS: //* - CAL CALENDAR NAME POS: //* POS 53-57: FREE //* POS 58-67: FROM_DATE/TIME AS YYMMDDHHMM OR BLANK //* POS 68-77: TO_DATE/TIME AS YYMMDDHHMM OR BLANK

© 2011 IBM Corporation IBM Confidential Formatter Example to get a report:  from the DBX files  with all possible data (full)  for Application Description file  and just for application ANNARAFFACOND006

© 2011 IBM Corporation IBM Confidential Formatter Header and Common Section…

© 2011 IBM Corporation IBM Confidential Formatter Operation Section…

© 2011 IBM Corporation IBM Confidential Formatter..with Dependencies sections

© 2011 IBM Corporation IBM Confidential Formatter …with Conditions and Condition Dependencies sections

© 2011 IBM Corporation IBM Confidential Formatter …with Special Resource, Extented Info, User Fields, Var. Dur/Dead sections

© 2011 IBM Corporation IBM Confidential Formatter Run Cycle Section…

© 2011 IBM Corporation Questions?