Enterasys Security Information and Event Manager, Configuration Manual

Page: 48 / 426

Configuring DSMs
32 CA T
ECHNOLOGIES
tar -zxvf qexacf2_bundled.tar.gz
The following files are contained in the archive:
QexACF2.JCL.txt - Job Control Language file
QexACF2.load.trs - Compressed program library (requires IBM TRSMAIN)
trsmain sample JCL.txt - Job Control Language for TRSMAIN to decompress the
.trs file
Step 3
Load the files onto the IBM mainframe using the following methods:
a
Upload the sample
QexACF2_trsmain_JCL.txt
and
QexACF2.JCL.txt
files
using the TEXT protocol.
b
Upload the
QexACF2.load.trs
file using a BINARY mode transfer and
append to a pre-allocated data set. The
QexACF2.load.trs
file is a tersed file
containing the executable (the mainframe program QexACF2). When you
upload the .trs file from a workstation, pre-allocate a file on the mainframe with
the following DCB attributes: DSORG=PS, RECFM=FB, LRECL=1024,
BLKSIZE=6144. The file transfer type must be binary and not text.
NOTE
QexACF2 is a small C mainframe program that reads the output of the TSSUTIL
(EARLOUT data) line by line. QexACF2 adds a header to each record containing
event information, for example, record descriptor, the date, and time. The program
places each field into the output record, suppresses trailing blank characters, and
delimits each field with the pipe character. This output file is formatted for SIEM
and the blank suppression reduces network traffic to SIEM. This program does
not consume CPU or I/O disk resources.
Step 4
Customize the
trsmain sample_JCL.txt
file according to your
installation-specific parameters.
For example, jobcard, data set naming conventions, output destinations, retention
periods, and space requirements.
The
trsmain sample_JCL.txt
file uses the IBM utility TRSMAIN to extract the
program stored in the
QexACF2.load.trs
file.
An example of the
QexACF2_trsmain_JCL.txt
file includes:
//TRSMAIN JOB (yourvalidjobcard),Q1labs,
// MSGCLASS=V
//DEL EXEC PGM=IEFBR14
//D1 DD DISP=(MOD,DELETE),DSN=<yourhlq>.QEXACF2.LOAD.TRS
// UNIT=SYSDA,
// SPACE=(CYL,(10,10))
//TRSMAIN EXEC PGM=TRSMAIN,PARM='UNPACK'
//SYSPRINT DD SYSOUT=*,DCB=(LRECL=133,BLKSIZE=12901,RECFM=FBA)
//INFILE DD DISP=SHR,DSN=<yourhlq>.QEXACF2.LOAD.TRS
//OUTFILE DD DISP=(NEW,CATLG,DELETE),
// DSN=<yourhlq>.LOAD,
// SPACE=(CYL,(10,10,5),RLSE),UNIT=SYSDA
//