Suppress The FACILITY Related Entries From A Top Secret TSSUTIL Report With CLASS(O)

Products

• Top Secret

Issue/Introduction

Is there a way to suppress or remove the FACILITY related audit entries from a TSSUTIL CLASS(O) audit report? CLASS(O) reports on changes that have been made to TSS control options via the TSS MODIFY command as well as changes to the security file via TSS commands if LOG(CMDA) or LOG(CMDS) is set.

Environment

Release: TOPSEC00200-15-Top Secret-Security
Component:

Resolution

Currently there is no built in functionality to suppress the FACILITY specific audit entries from a TSSUTIL CLASS(O) audit report.

This type of custom report can be achieved by a user written or 3rd party reporting application.

A TSSUTIL EXTRACT CLASS(O) can be run to create a dataset with audit entries.

Then the user written reporting program or 3rd party reporting application can use the dataset as input to generate the custom report by excluding FACILITY audit entries.

TSSUTIL is documented here:

TSSUTIL Utility