Losing Data With Frequent TSS9209I AUDIT FILE HAS WRAPPED Messages?

book

Article ID: 52837

calendar_today

Updated On:

Products

CA Cleanup CA Datacom - DB CA Datacom CA Datacom - AD CA Datacom - Server CA CIS CA Common Services for z/OS CA 90s Services CA Database Management Solutions for DB2 for z/OS CA Common Product Services Component CA Common Services CA Datacom/AD CA ecoMeter Server Component FOC CA Easytrieve Report Generator for Common Services CA Infocai Maintenance CA IPC Unicenter CA-JCLCheck Common Component CA Mainframe VM Product Manager CA Chorus Software Manager CA On Demand Portal CA Service Desk Manager - Unified Self Service CA PAM Client for Linux for zSeries CA Mainframe Connector for Linux on System z CA Graphical Management Interface CA Web Administrator for Top Secret CA CA- Xpertware CA Top Secret CA Top Secret - LDAP CA Top Secret - VSE

Issue/Introduction

Description:

The TSS9209I AUDIT FILE HAS WRAPPED message is occurring frequently. Is this causing a loss of data if the message is occurring more than once a day?

Solution:

If the audit file is wrapping more than once a day, it is possible data is lost. The following is recommended:

Run TSSUTIL with EVENT(ALL) to see what's being logged. Decide if everything that is logged should continue to be logged. If not, take out the source of the logging.

For example, LOG(ACCESS) logs all resource accesses except a few resources. If it is not desired to have all these accesses logged, take ACCESS out of the LOG control option.

If it is desired to have everything logged, continue to be logged, then do one of the following:

  1. Allocate a larger audit file and recycle CA Top Secret pointing to the new audit file.

  2. Allocate a second audit file and concatenate this in the CA Top Secret startup proc with the first audit file using AUDIT and AUDIT2 DD statements. (This also requires a recycle of TSS to pick up.)

When one file wraps, a TSS9203I SWITCHED TO AUDIT/TRACKING OUTPUT FILE dddddddd is issued and the new audit records are written to the other file.

An automations package could be set up to intercept this message and backup the audit file from the file that just wrapped.

Environment

Release:
Component: AWAGNT