Last changed date for a Loadlib member.

Vishnupriyan Pandiyan · New User Joined: 26 Apr 2011 Posts: 16 Location: India

Hi all,

I have a requirement in my shop we use Endevor to move elements from Stage1 to Stage2...but some one have copied the member to the production Loadlib manually...if there is anyway possible to obtain the date when the PDS member was last changed (or actually probably copied into this PDS from somewhere else)?

Nic Clouston · Posted: Mon Jun 11, 2012 10:42 am

Oh dear - looks like you have a SEVERE security breach and improper security rules set up in your security product. Unless you can search the SMF records I do not think you can find when the module was moved. You can find when it was created, or compiled, by looking at the timestamp inside it.

Vishnupriyan Pandiyan · New User Joined: 26 Apr 2011 Posts: 16 Location: India

yep I can see the complied date...as said I need to search through SMF records only.

Pedro · Posted: Tue Jun 12, 2012 6:32 am

It is not clear what else you are doing, but I think the current load module is suspicious / not trustworthy. I recommend that you immediately replace the rogue copy with the official copy.

We had a similar problem some years ago... people would make adhoc changes without proper review or approval. They finally changed the process to, every night, replace the working copy with the official copy. In that way, if people made adhoc changes that their unofficial changes would be lost. It became easier to determine who was doing the adhoc changes.

note: you never hear of viruses, Trojan Horses, worms, etc... on z/OS, but it is certainly possible for someone to write one. As far as I can tell, the only deterrent is the lack of access for testing.

fyi. I used to do system penetration testing: I would visit a customer and take a normal userid and try to escalate the RACF authorities to get SPECIAL and OPERATIONS. One method was to replace a commonly used program with my own version. Perhaps you do not worry that someone like me is there, but you should.

Marso · Posted: Tue Jun 12, 2012 8:59 pm

I would explore this option:
- use Endevor's CSV Utility (BC1PCSV0) to list members with their generation date.
- use AMBLIST to get the modules dates.
- compare the results.

That could even make a nice REXX Tool...