What is in TSO command statistics? How do you control what users TSO Command Statistics are logged?

Document ID : KB000025191
Last Modified Date : 14/02/2018
Show Technical Document Details

Question:  

What is in TSO command statistics? How do you control what users TSO Command Statistics are logged?

Answer: 

TSO command statistics can be tracked by SMF records that are written for selected users or all users to trace TSO commands issued. The tracking can be turned on globally by the GSO OPTS CMDREC|NOCMDREC or for individual users by the logonid TSO-TRC|NOTSO-TRC setting. The ACFRPTCR report utility formats the TSO command statistics audit information collected by the ACF2/TSO interface routines.

TSO command statistics can be activated globally for all users or for select logonids to track all TSO commands issued by a single user or all users.

To activate TSO command statistics globally the ACF2 GSO OPTS CMDREC|NOCMDREC can be used:

 ACF 
 SET CONTROL(GSO) 
 CHANGE OPTS CMDREC 
 F ACF2,REFRESH(OPTS) 
 END 

CMDREC|NOCMDREC
Specifies whether the TSO command statistics SMF records are written for all users. If you specify CMDREC, ACF2 displays TSO command statistics records in the COMMAND SMF RECORDS= field in the SHOW TSO display. For example:

  show tso                                                                       
                                                                              
  -- TSO RELATED DEFAULTS ACTIVE --                                             
  LOGON ACCOUNT STRING=40100000                         CMD LIST BYPASS CHAR=#  
  CHAR DELETE CHAR=NONE      TSO CMD LIST=NONE          COMMAND SMF RECORDS=NO  
  TSOGNAME=NONE              LINE DELETE CHAR=NONE      LOGON CHECK=YES         
  PERFORMANCE GROUP=NONE     TSO LOGON PROC=            QUICK LOGON=YES         
  TSO REGION SIZE=147,890    SUBMIT CLASS=NONE          SUBMIT HOLD CLASS=NONE  
  SUBMIT MESSAGE CLASS=NONE  SESSION TIME=1,400         SYSOUT CLASS=A          
  TSO UNITNAME=3390          LOGON WAIT TIME=NONE       FSRETAIN=YES            
  TSO LOGON PRE-PROMPT=NO

TSO command statistics can be activated for an individual by setting the TSO-TRC setting is the user's logonid.

TSO-TRC|NOTSO-TRC
Specifies whether eTrust CA-ACF2 for z/OS traces all TSO commands issued by this user for the Command Statistics Report (ACFRPTCR). TSO-TRC will appear in the "CANCEL/SUSPEND" seciton of a logonid display. For example:

ACF
SET LID
CHANGE USER01 TSO-TRC
 
 USER01               SSS99999999  USER01     
                      COMPANY(S) DEPT() IDNUM() LEVEL(S) LOCATION(LLLL)        
                      OWNER(USER01) OWNTYPE(P) POSITION(ZS)    
                      PROJECT(99) SITE(H)
 CANCEL/SUSPEND       TSO-TRC                                      
 PRIVILEGES           AUDIT CICS DUMPAUTH JOB MOONSHOT REFRESH TAPE-LBL TSO VM
 ACCESS               ACC-CNT(14,654) ACC-DATE(11/05/08) ACC-SRCE(A55TG037)    
                      ACC-TIME(10:11)                                          
 PASSWORD             KERB-VIO(0) KERBCURV() MAXDAYS(90) PSWD-DAT(00/00/00)    
                      PSWD-INV(0) PSWD-SRC(A55TG008) PSWD-TIM(15:55)           
                      PSWD-TOD(09/22/08-06:49) PSWD-VIO(0) PSWD-XTR            
                      PSWDCVIO(22) PWP-DATE(00/00/00) PWP-VIO(0)               
 TSO                  ATTR2(9999) CHAR(BS) DFT-PFX(USER01) DFT-SOUT(A)        
                      DFT-SUBM(A) INTERCOM JCL LGN-ACCT LGN-PROC LINE(ATTN)    
                      MAIL MODE MSGID NOTICES OPERATOR PROMPT TSOFSCRN         
                      TSOPROC($SKKISPF) TSORGN(4,096) TSOSIZE(4,096)           
                      TSOTIME(1,440) VLD-ACCT WTP                              
 STATISTICS           CRE-TOD(00/00/00-00:00) SEC-VIO(352)                     
                      UPD-TOD(11/05/08-10:11)                                  
 CICS                 CICSCL(999999) CICSRSL(999999)                           
 RESTRICTIONS         PREFIX(USER01)                                          

SAMPLE ACFRPTCR OUTPUT

The following ACFRPTCR report output is a result of the following sample TSO commands:

  1. logon
  2. acf
  3. SDSF
  4. lista st
  5. ispf
  6. logoff

 

eTrust CA-ACF2 Security - ACFRPTCR - TSO COMMAND STATISTICS - PAGE    1        
DATE 11/05/08 (08.310) TIME 18.09 MDBTEST  SAMPLE ACFRPTCR                     
                                                                               
08.310 11/05 18.09       JOB=USER002   UID=     USER002              SYSTEM ID= SYS1
  SEQUENCE  COMMAND   TIME OF     CALLING                        
   NUMBER    NAME       DAY       PROGRAM                        
       00 C $PROF     18.07       IKJEFT02                       
            %$PROF                                               
       01 C $PROF     18.07       IKJCT429                       
            %$PROF                                               
       02   SYSTEM    18.07       IKJCT429                       
            SYSTEM                                               
       03   SYSTEM    18.07       IKJEFT01                       
            SYSTEM                                               
       04   SYSTEM    18.07       IKJEFT02                       
            SYSTEM                                               
       05   ALLOC     18.07       IKJCT429                       
            ALLOC F(ISPPROF) DA('USER002.ISPF.ISPPROF') SHR      
       06   ALLOC     18.07       IKJCT429                       
            ALLOC F(SMPTABL) DA('USER002.ISPF.ISPPROF') SHR REU  
       07   ALLOC     18.07       IKJCT429                       
            ALLOC F(TEMPREXX) DA('USER002.ISPF.ISPPROF') SHR REU 
       08   CONCAT    18.07       IKJCT429                       
            CONCAT FILE(ISPTLIB TEMPREXX)                        
       09   ACF       18.07       IKJEFT02                       
            ACF                                                              
       10   SDSF      18.07       IKJEFT02                                   
            SDSF                                                             
       11   LISTA     18.08       IKJEFT02                                   
            LISTA st                                                         
       12   ISPF      18.08       IKJEFT02                                   
            ISPF                                                             
       13   LOGOFF    18.09       IKJEFT02                                   
            LOGOFF                                                           
NOTE: 'C' INDICATES CLIST OR INVALID COMMAND, * INDICATES COMMAND WITHIN CLIST

Additional Information:

Details on the ACFRPTCR report and all available parameters can be found in "Chapter 3: ACFRPTCR-TSO Command Statistics Log" of the CA ACF2 for z/OS Report and Utilities Guide.