Enterasys Security Information and Event Manager, Configuration Manual

Page: 159 / 426

Configuring DSMs
IBM RACF 143
You must update the file with your installation specific information for parameters,
such as, jobcard, data set naming conventions, output destinations, retention
periods, and space requirements.
The .trs input file is an IBM TERSE formatted library and is extracted by running
the JCL, which calls the TRSMAIN. This tersed file, when extracted, creates a PDS
linklib with the QEXRACF program as a member.
Step 5
You can STEPLIB to this library or choose to move the program to one of the
LINKLIBs that are in the LINKLST. The program does not require authorization.
Step 6
After uploading, copy the program to an existing link listed library or add a
STEPLIB DD statement with the correct dataset name of the library that will
contain the program.
Step 7
The
qexracf_jcl.txt
file is a text file containing a sample JCL deck to provide
you with the necessary JCL to run the IBM IRRADU00 utility. This allows SIEM to
obtain the necessary IBM RACF events. Configure the job card to meet your local
standards.
An example of the
qexracf_jcl.txt
file includes:
//QEXRACF JOB (<your valid jobcard>),Q1LABS,
// MSGCLASS=P,
// REGION=0M
//*
//*QEXRACF JCL version 1.0 April 2009
//*
//*************************************************************
//* Change below dataset names to sites specific datasets
names *
//*************************************************************
//SET1 SET SMFOUT='<your hlq>.CUSTNAME.IRRADU00.OUTPUT',
// SMFIN='<your SMF dump ouput dataset>',
// QRACFOUT='<your hlq>.QEXRACF.OUTPUT'
//*************************************************************
//* Delete old datasets *
//*************************************************************
//DEL EXEC PGM=IEFBR14
//DD2 DD DISP=(MOD,DELETE),DSN=&QRACFOUT,
// UNIT=SYSDA,
// SPACE=(TRK,(1,1)),
// DCB=(RECFM=FB,LRECL=80)
//*************************************************************
//* Allocate new dataset *
//*************************************************************
//ALLOC EXEC PGM=IEFBR14
//DD1 DD DISP=(NEW,CATLG),DSN=&QRACFOUT,
// SPACE=(CYL,(1,10)),UNIT=SYSDA,
// DCB=(RECFM=VB,LRECL=1028,BLKSIZE=6144)
//************************************************************
//* Execute IBM IRRADU00 utility to extract RACF smf records *