Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 158 / 426

Configuring DSMs
142 IBM
• Pulling Data Using Log File Protocol
Configuring IBM
RACF to Integrate
with SIEM
To integrate an IBM mainframe RACF with SIEM:
Step 1
From the Enterasys Extranet website, download the following compressed file:
qexracf_bundled.tar.gz
Step 2
On a Linux-based operating system, extract the file:
tar -zxvf qexracf_bundled.tar.gz
The following files are contained in the archive:
qexracf_jcl.txt
qexracfloadlib.trs
qexracf_trsmain_JCL.txt
Step 3
Load the files onto the IBM mainframe using any terminal emulator file transfer
method.
Upload the
qexracf_trsmain_JCL.txt
and
qexracf_jcl.txt
files using the
TEXT protocol.
Upload the
QexRACF loadlib.trs
file using binary and append to a
pre-allocated data set. The
QexRACF loadlib.trs
file is a tersed file containing
the executable (the mainframe program QEXRACF). When you upload the .trs file
from a workstation, pre-allocate a file on the mainframe with the following DCB
attributes: DSORG=PS, RECFM=FB, LRECL=1024, BLKSIZE=6144. The file
transfer type must be binary and not text.
Step 4
Customize the
qexracf_trsmain_JCL.txt
file according to your
installation-specific requirements.
The
qexracf_trsmain_JCL.txt
file uses the IBM utility Trsmain to uncompress
the program stored in the
QexRACF loadlib.trs
file.
An example of the
qexracf_trsmain_JCL.txt
file includes:
//TRSMAIN JOB (yourvalidjobcard),Q1labs,
// MSGCLASS=V
//DEL EXEC PGM=IEFBR14
//D1 DD DISP=(MOD,DELETE),DSN=<yourhlq>.QEXRACF.TRS
// UNIT=SYSDA,
// SPACE=(CYL,(10,10))
//TRSMAIN EXEC PGM=TRSMAIN,PARM='UNPACK'
//SYSPRINT DD SYSOUT=*,DCB=(LRECL=133,BLKSIZE=12901,RECFM=FBA)
//INFILE DD DISP=SHR,DSN=<yourhlq>.QEXRACF.TRS
//OUTFILE DD DISP=(NEW,CATLG,DELETE),
// DSN=<yourhlq>.LOAD,
// SPACE=(CYL,(10,10,5),RLSE),UNIT=SYSDA
//