Is there a way using Auditor to automate repetitive auditing tasks?

Products

• Auditor for z/OS

Issue/Introduction

With the batch job facility and batch scripts, you can use Auditor to run time-consuming and repetitive audit functions in batch. These batch scripts can then be run automatically using automated job scheduling solutions such as  CA-7.

Data center users can combine Auditor batch scripts with SNMP trap support to automatically audit parts of their systems periodically and send messages to a Unicenter workstation regarding any exceptional conditions found.

 

 

Resolution

Batch Scripts

Batch scripts are a set of instructions that you select(record) that you want Auditor to perform in a batch job.

You can create any number of scripts for different sets of review procedures. Each script can contain any number of Auditor functions. Each script is stored in a data set that you select on the Select Batch Functions screen (0.4.2).

After you enter a data set name that contains the script and press Enter, you are placed in Batch Script Create mode and a warning message is displayed. You can enter SCRIPT ON or SCRIPT OFF to turn scripting on or off as needed. While you are in this mode, you are creating the script of the functions that you want Auditor to perform. Initially, you see the Auditor Primary Option menu. Select any option just as you do during any online Auditor session. You can also use the JUMP function (=) to tell Auditor what functions to perform. Auditor does not perform these options at this time, but records them in a script file that is used later when you run the Auditor batch job. When a display requires input, enter the information just as you do for online Auditor displays and it will be stored for the function in the script.

Note: Certain Auditor functions are not available in this mode. For example, you cannot access the Batch Job Facility menu (0.4) or the JES2 Proclib Display option (4.2) while you are writing a script. Any options that start with "0" can not be used in a SCRIPT.

After you select all of the options to include in your script, enter SCRIPT OFF to exit Batch Script Create mode. Auditor returns to its normal operating mode and saves the script in your script file. You can also exit Auditor(=X) to save the script.

Note: Do not attempt to edit the script data set from ISPF/PDF. The script can contain variable data that can consist of hexadecimal data that is not displayable. Editing the script from ISPF/PDF can damage the script and cause your batch job to fail, or cause other unpredictable results.

Once you create a script and your batch JCL, you can execute the batch job (0.4.3). Certain sites have restrictions about job submission (for example, your TSO logon ID must be authorized to submit jobs, and you need read or allocate access to certain data sets), so you need to follow local procedures. You do not need allocate access to any system dataset. Allocate access is only needed if report output is directed to a dataset. Also, the Auditor DBASE1 data set might not be available to you online while functions such as freezing files are accessing this data set from a batch mode.

As an experienced user, you can submit batch JCL while you are in ISPF/PDF Edit on the batch JCL data set using the SUBMIT subcommand. Or, you can use the TSO SUBMIT command to execute your job without being in ISPF/PDF Edit.

Note: When using batch scripts, it is possible to define special symbolic date variables for use in specifying the "TO" and/or "FROM" date. This allows you to generate scripts that are more flexible in that they can be captured once and then rerun many times without modification.

The SYMBPARM member is used to supply symbolic substitution variable names and corresponding data values for date fields. This substitution capability is not available for normal TSO-based sessions and is meant to be used only in a batch, or "silent auditing" environment.

The only valid fields for which this substitution process is performed are the TO and FROM date fields for the following functions:

• SMF record search (1.5.4)
  
  
• Job history SMF search (4.4)
  
  
• Program history SMF search (5.4)
  
  
• File history SMF search (6.5)

Specify one or more statements as appropriate to define each symbolic variable name and its substitution value. The specific syntax is as follows:

      Col         Col 
       1           10 
       |           | 
       symname     symvalue

Where:

symname Specifies the one-to-eight character symbolic substitution name that the user will specify as a date value when they create the actual batch auditing script. The symname name must begin in column 1 and start with an ampersand (&). For example, &symname.

symvalue Specifies the actual substitution value that Auditor will substitute when the batch script is actually run. The symvalue value must begin in column 10.

Use the following format to specify symvalue:

     &TODAY{-n}

Where &TODAY is a reserved Auditor variable that is equivalent to the current date value at the time the batch script is executed, and -n is an optional algebraic value to be subtracted from the current date. For example, &TODAY-1 can be used to select SMF records starting with yesterday.

Summary

The Following steps can be used to set up a batch script that runs periodically:

• Use the Batch Script option (0.4.2) to set up the audits you want to perform. Remember to begin with a SCRIPT ON command.
  
  
• Use the JCL Edit option (0.4.1) to set up the JCL to run the batch script.
  
  
• If you have a scheduling package, such as CA-Scheduler or CA-7, schedule the job to run every day, every four hours, or however often you need.

If you do not have a scheduling package, make the JCL a started task and use JES2 automatic commands to run it periodically:

• Remove the JOB statement from the batch JCL and copy it to a member of a procedure library, such as SYS1.PROCLIB.
  
  
• Issue a JES2 automatic command to start the task:
  $TA,T=hh.mm,'S BATCHAUD'