ACF2: Audit trail for SET NORULE(null|jobname|ALL) command

Products

• ACF2 - z/OS

Issue/Introduction

Audit trail for security admin person issuing NORULE(null|jobname|ALL).

TSO: SET NORULE [(jobname|ALL)]"

Environment

Release : R16

Z/OS

 

Resolution

The ACFRPTNV report is able to report on the issuing of the TSO: SET NORULE [(jobname|ALL)]" command from TSO.

An SMF record is generated and it is an implied modify type even though you didn't enter it as a modify.

Below is a sample report output.

ACF2 MODIFY            userid    yy.ddd mm/dd  hh:mm         00  sysid   sysid  
   PARM='SETNORUL(ALL)'                                                       
                                                                              
   MSG ='ACF79931 RULES RESET FOR ALL ADDRESS SPACES'        

Additional Information

SET Subcommand

ACFRPTNV - The Environment Report