Top Secret TSSAUDIT CHANGES Records Only Back 2 Months

Products

• Top Secret

Issue/Introduction

When running TSSAUDIT CHANGES report, the earliest records only go back a couple months. How do you find the changes that occurred earlier than that?

Environment

Release : 16.0

Resolution

If the recovery file is backed up, you can restore the recovery file that contains the records for the date range and run TSSAUDIT CHANGES against that recovery file.

If LOG(CMDA) and/or LOG(CMDS) is set, you can run TSSUTIL with CLASS(O) to get the commands from the audit/tracking file (LOG(CMDA) or SMF (LOG(CMDS)) ).

If none of the above are feasible, in the future, you can have an automations package kick off a job when either of the following messages occur:

TSS9011W RECOVERY FILE HAS WRAPPED AROUND
TSS9012W  RECOVERY FILE IS AT LEAST 90% FULL

The job can either backup the recovery file to a GDG or be a TSSAUDIT CHANGES job that extracts all the current entries in the recovery file to either GDG or MOD to a previous TSSAUDIT CHANGES output file.