Top Secret

  • 1.  SMF 231 Supression

    Posted Sep 08, 2017 04:48 AM

    Hi,

     

    Is there any way to prevent Top Secret to write SMF 231 records? In case of an emergency  to stop it immediately.

    Removing SMF from LOG(....) option doesn't stop TSS producing SMF 231 records.

     

    Thank you.

     

    Erdem.



  • 2.  Re: SMF 231 Supression
    Best Answer

    Posted Sep 08, 2017 05:04 AM

    Hello Erdem,

     

    The CA Top secret control option LOG() should deactivate all SMF and ATF logging, except for violations and audited events,
    which continue being written to the ATF.
    If the user facility is in DORMANT mode, no logging takes place unless the permitted resource is specified with ACTION(FAIL)

    If you issue a TSS MODI LOG(NONE) all facility is affected, it can be overridden at facility level, e.g.

     

    tss modi fac(cicsprod=log(init,sec9,smf,msg)) will reestablish those logging for the CICSPROD facility, others will stay with NONE.

     

    Sincerely, Jacques.



  • 3.  Re: SMF 231 Supression

    Posted Sep 08, 2017 06:39 AM

    I removed SMF from LOG global option. So I changed it from LOG(INIT,MSG,SEC9,SMF) to LOG(INIT,MSG,SEC9). User had AUDIT attribute and SMF231 logging for the user id was still running. I mean, regardsless from the AUDIT in the user / acid record SMF logging for both SMF 80 and 231 should be disabled completely.



  • 4.  Re: SMF 231 Supression

    Posted Sep 08, 2017 08:00 AM

    Hello Erdem,

     

    What you noticed having still the SMF records cut for audited events it's how it works.

     

    A new idea should be pin on the wall to change this, I assume.

     

    Let's see what the community may add on this.

     

    Sincerely, Jacques.



  • 5.  Re: SMF 231 Supression

    Posted Sep 14, 2017 03:38 PM

    Erdem -

     

    You could suppress the writing of the SMF records in SYS1.PARMLIB(SMFPRMxx) via SYS(NOTYPE(231)) or in the IEFU83/84 SMF exits. 

     

    HOWEVER:  Either method will send a return code to TSS saying the record was suppress by the system.  I'm not sure how TSS will react - it might get upset if it can't write the record.  Maybe support knows the answer.

     

    - Don



  • 6.  Re: SMF 231 Supression

    Posted Nov 16, 2017 02:46 AM

    Hi Don,

     

    Thanks you for your reply.

    This was how we stop SMF 231 records to be written. But there should be a way to do it via TSS control options. It seems to be a bad solution to define LOG(NONE), which stops logging completely.