Setting Real Time Activities and Internal Logging

To set whether Anti-Ransomware is to monitor activity, either real time or in FYI Simulation mode, and to set whether it is to keep an internal log, select 21. Protection from the main AntiVirus & AntiRansomware (ATP) Configuration screen (STRAR > 81).

The Real-Time Activities Setting screen appears:

​                      ​ Anti-Ransomware Protection Setting​    ​ 11/02/25​ 14:20:11​                                                                        ​ RLDEV   ​  ​ Anti-Ransomware active  . . .​  ​ Y​          ​ Y=Yes, I=FYI, N=No​                  ​ *FYI* is an acronym for "For Your Information".​                                 ​ In this mode, notifications are sent, but no stop occurs.     ​                  ​          ​  ​      ​ ​      ​                                                        ​ Skip activity of users  . . .​  ​           ​           ​           ​           ​                                     ​           ​           ​           ​           ​                                                                                      ​ Internal log  . . . . . . . .​  ​ Y​          ​ Y=Yes, N=No​                         ​ Activate only as per Raz-Lee instruction, for limited time. Data is collected​   ​ in SMZVDTA/TPFILSL* and SMZVDTA/TPATCKP*.                                    ​   ​ Clear files after sending it to Raz-Lee.                                     ​   ​ Changes to the above are auto activated within 1 minute.                    ​    ​ You can use the SMZV/CHGRTAR command in your CL for similar settings.        ​                                                                                    ​ Enable Multithread  . . . . .​  ​ N​          ​ Y=Yes, N=No​                         ​ Check Ransomware Asynchronous​  ​ N​          ​ Y=Yes, N=No​                         ​ Changes to the above settings require reactivation.  ​                                                                                                                                                                                                                                                                              ​ F3=Exit​  ​ F12=Cancel​                                                            ​                                                                                 ​

The Anti-Ransomware active field controls whether Anti-Ransomware runs in real time. The choices are:

• Y: Anti-Ransomware runs in real time, monitoring activity and acting on what it detects.
• I: Anti-Ransomware runs in FYI Simulation mode, monitoring activity and logging what its responses would be if it were running in real time without taking action.
• N: Anti-Ransomware does not run in real time.

The Skip activity of users field controls users whose activities are excluded from Anti-Ransomware monitoring.

The Internal log field controls whether Anti-Ransomware events are captured to a log in SMZVDTA/TPFILSL*. The files can grow large. Set this field to Y only if directed to do so by Raz-Lee support. Remove them when they are no longer needed.

The Enable Multithread field controls whether Anti-Ransomware operates in multithreaded mode. When set to Y=Yes, Anti-Ransomware runs in a thread-safe environment, allowing the IBM File Server to handle multiple user activities within a single job.

NOTE: Changes require the reactivation of Anti-Ransomware to take effect. Additional information on multithreading is available in the ZRANSOM Subsystem and Its Jobs.

The Check Ransomware Asynchronous field determines whether Anti-Ransomware performs its checks asynchronously. When set to Y=Yes, a significant portion of the ransomware detection process is offloaded to the TPSRV job within the ZRANSOM subsystem.

NOTE: Changes require the reactivation of Anti-Ransomware to take effect. Additional information on multithreading is available in the ZRANSOM Subsystem and Its Jobs.