Auditing the MVS.CANCEL command.

Products

• Top Secret

Issue/Introduction

 In order to track who issues the MVS.CANCEL command a permit was put in the Audit record:

TSS ADD(AUDIT) OPERCMDS(MVS.CANCEL)

The Top Secret TSSUTIL report shows JES2, not the user as the acid who issued the command:

08/07/08 12:18:22 08R1 JES2 JES2  S F  $HASPWTO UPDATE  ALL  OK+A  22 r MVS.CANCEL.JOB.JJCPROD1 

Resolution

When the MVS.CANCEL command is issued SDSF requests JES2 to cancel the job. When a user enters MVS.CANCEL it kicks off a JES2.CANCEL command and JES2 then performs the MVS.CANCEL and cancels the job.

In order to audit who is actually entering the MVS.CANCEL command you need to audit the JES2.CANCEL command:

TSS ADD(AUDIT) OPERCMDS(JES2.CANCEL)