List of console commands issued?

vasanthz · Posted: Fri Feb 21, 2014 11:45 pm

Hi,

Could you please let me know if it would be possible to find the list of all console commands issued by a USER, from SMF.

A pointer to the SMF record type contaning the console command and the userid would suffice.

I understand that we could do this from SYSLOG, but our SYSLOG is archived to a un-user firendly archival system which I believe does not support batch retrieval. So stuck with SMF only.

Thanks & Regards,

dick scherrer · Posted: Sat Feb 22, 2014 12:39 am

Hello,

Yup, whenever i've done something like this, i've used SYSLOG as the input.

Possibly you can extract what you want from the active SYSLOG before it is archived?

As i recall, what you want is not captured in the SMF data - but - don't completely trust my memory

vasanthz · Posted: Sat Feb 22, 2014 7:37 pm

Hello D,
Thank you for the response.
I am a little paranoid in accessing active SYSLOG, also there are other difficulties in looking at older archived syslog.
Hence was looking if it could be done from SMF. Guess I don't have any other alternatives.

Regards,

dick scherrer · Posted: Sun Feb 23, 2014 5:07 am

If this is something that will be run for some length of time (rather than a one-time process) possibly you could read the SYSLOG after it is switched and before the archive?

Just curious, how is the SYSLOG archived that makes less than friendly?

d

vasanthz · Posted: Sun Feb 23, 2014 12:37 pm

The SYSLOG gets routed to a software which I think is called ON-DEMAND.
The archive gets stored in DB2 with CICS front end, I did some initial searching but was unable to get job details from ON-DEMAND using batch.

aah.. i hate that tool :S

PeterHolland · Posted: Sun Feb 23, 2014 2:03 pm

Maybe this will help :

pic.dhe.ibm.com/infocenter/zos/v1r12/index.jsp?topic=%2Fcom.ibm.zos.r12.e0ze100%2Fe0z2e16041.htm

The part about RACF auditing.

vasanthz · Posted: Tue Feb 25, 2014 1:00 am

Hello Peter,
Thank you for the link, I am a newbie with RACF. Let me do some learning on the link you provided to see if it could be of help to me.

Regards,
Vasanth.S

vasanthz · Posted: Thu Feb 27, 2014 7:16 pm

Hello,
An update.
I was able to get the details from OPERLOG by using PGM=IEAMDBLG.

I would require one more favour from you guys.

Thanks & Regards,

dick scherrer · Posted: Thu Feb 27, 2014 9:03 pm

Hi Vasanthz,

vasanthz · Posted: Thu Feb 27, 2014 10:47 pm

Hello D,
I changed my mind mid flight and posted that favor as a separate topic
www.ibmmainframes.com/viewtopic.php?t=62462&sid=ee1e4aad70d2a7f06d24bf36f0c7d813

Forgot to remove "I would require one more favour from you guys. "

Thanks & Regards,