Missing Audit Records In Top Secret TSSUTIL With Multiple Audit Tracking Files

Products

• Cleanup
• WEB ADMINISTRATOR FOR TOP SECRET
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

When running a TSSUTIL report in Top Secret from two ATFs (Audit Tracking File), there are missing records.

When running a TSSUTIL report one file at a time, all audit records are there.

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component:

Resolution

The issue comes from the way the ATFs are selected within the JCL to run the TSSUTIL report.

If you assign AUDIT File 1 to //SMFIN and AUDIT File 2 to //SMFIN2, you will "lose" all audit records from AUDIT File 2.

The Top Secret documentation states the supported DD statements are //SMFIN and //SMFIN1.

Although it isn't mentioned in the documentation, you can use //SMFIN2 as a third file (and //SMFIN3, //SMFIN4, etc. up to //SMFIN999), but the files are processed in sequence. If you don't have //SMFIN1, //SMFIN2 will be ignored. So the results from AUDIT File 2 won't be found in TSSUTIL. If you change the DD statement for AUDIT2 so that it is //SMFIN1, it will work as expected.

For more information about TSSUTIL jcl, see here