eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Tracing UNIX System Services (OMVS)Stopping the SECTRACE for OMVSTo disable the SECTRACE for OMVS, issue the following command, where xxxxis the identifier assigned to the SECTRACE:ST DISABLE,ID=XXXX,ENDYou can restart a disabled trace by entering an enable command. To start adisabled trace, issue the following command, where xxxx is the identifierassigned to the SECTRACE:ST ENABLE,ID=XXXX,ENDTo stop the SECTRACE for OMVS, issue the following command, where xxxx isthe identifier assigned to the SECTRACE:ST DEL,ID=XXXX,ENDUNIX System Services ReportingTSSOERPT UtilityAuthority and ScopeThe batch utility program, TSSOERPT, processes security-related activityrecorded in SMF data sets. To monitor user activity in a UNIX System Servicesenvironment, eTrust CA-Top Secret logs security events under UNIX SystemServices to SMF using the standard eTrust CA-Top Secret SMF record. Logrecords are written for any security event that denies the acid access to a UNIXSystem Services facility. These records can assist you in determining the UID andGID of the acid involved in the attempted access.eTrust CA-Top Secret performs authorization checking to determine whether theperson submitting the TSSOERPT job is authorized to view or manipulate theinput SMF data. You can only extract those incidents that are generated for acidswithin the scope of your authority. The scopes are:■■■■■■SCA—every eventLSCA—every event within the LSCAs scopeZCA—entire zone or specific divisions, departments or acids within the zoneVCA—entire division or specific departments or acids within the divisionDCA—entire department or specific acids within the departmentUSER—himselfImplementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–21