Is there a report that will only show successful signon ('INIT') events for all users/tasks/processes logging on to various sub-systems (e.g., TSO, CICS, IMS, CNTL-M, etc...). LOG(INIT) is set in the Top Secret control options so Top Secret should be collecting the 'INIT' events.
Can this be accomplished with TSSTRACK? If not, is there a way in TSSUTIL to get this same report data?
Release : 16.0
Component : CA Top Secret for z/OS
EVENT(INIT) is not a valid option in TSSTRACK. There isn’t a way in TSSTRACK to display just the successful signon events.
TSSUTIL can be run with the following to see just the successful signon events:
REPORT EVENT(INIT) DRC(00) LONG END
EVENT(INIT) will limit the output to only job/session initiations.
DRC(00) will only include the successful signons. If the signons that were unsuccessful such as invalid password, etc are needed, do not specify DRC(00) on the REPORT statement.
With the LONG option, the facility name will be spelled out instead of a 2 character code that will need to be looked up with TSS MODIFY(FAC(ALL)). If the facility name is not needed, then the LONG option can be removed. LONG prints 2 lines of output per event. Without LONG, there is only 1 line per event.