Top Secret Determining Facility from SMF 80 records

Products

• Top Secret

Issue/Introduction

Where can one find the respective Facility from SMF 80 records. 

For example; if a security event occurred in TSO or BATCH, where to find the corresponding Facility in the SMF 80 record? 

 

Environment

Release : 16.0

Component : Top Secret for z/OS

Resolution

 Field called FLJOBTYP

This field is the TYPE= field on the facility. The possible
 values are:
 BATCH,             FLJOBTYP=1,   | USER30,            FLJOBTYP=52
 STC,                  FLJOBTYP=2,   | USER31,            FLJOBTYP=53
 TSO,                  FLJOBTYP=3,   | USER32,            FLJOBTYP=54
 CICSPROD,      FLJOBTYP=4,   | USER33,            FLJOBTYP=55
 IMSPROD,        FLJOBTYP=5,   | USER34,            FLJOBTYP=56
 NCCF,               FLJOBTYP=6,   | USER35,            FLJOBTYP=57
 ROSCOE,         FLJOBTYP=7,   | USER36,            FLJOBTYP=58
 VM,                   FLJOBTYP=8,   | USER37,            FLJOBTYP=59
 VAMSPF,          FLJOBTYP=9,   | USER38,            FLJOBTYP=60
 WYLBUR,          FLJOBTYP=10,  | USER39,            FLJOBTYP=61
 IDMSPROD,       FLJOBTYP=11,  | USER40,            FLJOBTYP=62
 JES,                   FLJOBTYP=12,  | USER41,            FLJOBTYP=63
 TONE,                FLJOBTYP=13,  | USER42,            FLJOBTYP=64
 INTERACT,          FLJOBTYP=14,  | USER43,            FLJOBTYP=65
 ENVIRON,           FLJOBTYP=15,  | USER44,            FLJOBTYP=66
 USER5,                FLJOBTYP=16,  | USER45             FLJOBTYP=67
 CICSTEST,          FLJOBTYP=17,  | USER46,            FLJOBTYP=68
 IMSTEST,            FLJOBTYP=18,  | USER47,            FLJOBTYP=69
 USER0,                FLJOBTYP=19,  | USER48,            FLJOBTYP=70
 USER6,               FLJOBTYP=20,  | USER49,            FLJOBTYP=71
COMPLETE,        FLJOBTYP=21,  | USER50,            FLJOBTYP=72
 IDMSTEST,         FLJOBTYP=22,  | USER51,            FLJOBTYP=73
 USER7,               FLJOBTYP=23,  | USER52,            FLJOBTYP=74
 USER8,               FLJOBTYP=24,  | USER53,            FLJOBTYP=75
 CA7,                    FLJOBTYP=25,  | USER54,            FLJOBTYP=76
 USER9,              FLJOBTYP=26,  | USER55,            FLJOBTYP=77
 ACEP,                 FLJOBTYP=27,  | USER56,            FLJOBTYP=78
 USER4,             FLJOBTYP=28,  | USER57,            FLJOBTYP=79
 USER3,             FLJOBTYP=29,  | USER58,            FLJOBTYP=80
 USER2,             FLJOBTYP=30,  | USER59,            FLJOBTYP=81
 USER1,             FLJOBTYP=31,  | USER60,            FLJOBTYP=82
 USER10,            FLJOBTYP=32   | USER61,            FLJOBTYP=83
 USER11,            FLJOBTYP=33   | USER62,            FLJOBTYP=84
 USER12,            FLJOBTYP=34   | USER63,            FLJOBTYP=85
 USER13,            FLJOBTYP=35   | USER64,            FLJOBTYP=86
 USER14,            FLJOBTYP=36   | USER65,            FLJOBTYP=87
 USER15,            FLJOBTYP=37   | USER66,            FLJOBTYP=88
 USER16,            FLJOBTYP=38   | USER67,            FLJOBTYP=89
 USER17,            FLJOBTYP=39   | USER68,            FLJOBTYP=90
 USER18,            FLJOBTYP=40   | USER69,            FLJOBTYP=91
 USER19,            FLJOBTYP=41   | RESERVE1           FLJOBTYP=92
 USER20,            FLJOBTYP=42   | RESERVE2           FLJOBTYP=93
 USER21,            FLJOBTYP=43   | RESERVE3           FLJOBTYP=94
 USER22,            FLJOBTYP=44   | RESERVE4           FLJOBTYP=95
 USER23,            FLJOBTYP=45   | RESERVE5           FLJOBTYP=96
 USER24,            FLJOBTYP=46   | RESERVE6           FLJOBTYP=97
 USER25,            FLJOBTYP=47   | APPC,              FLJOBTYP=98
 USER26,            FLJOBTYP=48   | HSM,               FLJOBTYP=99
 USER27,            FLJOBTYP=49   | DB2PROD,           FLJOBTYP=100,
 USER28,            FLJOBTYP=50   | DB2TEST,           FLJOBTYP=101,
 USER29,            FLJOBTYP=51   | CONSOLE,           FLJOBTYP=102,

The values above are in decimal. The field itself will contain a
hex value (ie FLJOBTYP for USER38 will be x'3C', which is decimal 60).