Controlling Tracking

System Configuration

The System Configuration menu controls the global options for Change Tracker including the authorization code. To access the System Configuration menu, select 81. System Configuration from the Main menu.

Figure 4-1. System Configuration Screen

NOTE: General Activation procedures (71 in the Main menu) are Audit functions and are described in the Audit User Manual.

Activation Mode

To access the Activation Mode screen, select 1. Activation Mode from the System Configuration Main Menu. The Activation Mode screen appears.

Figure 4-2. Activation Mode Screen

Field

Description

Enable Change Tracker

Change Tracker must be enabled even if Audit is running.

Y=Yes; N=No.

Enable Real Time Tracking

Real-time tracking will be performed.

Y=Yes; N=No,

Periodic Tracking runs every ...

Interval for Periodic tracking

0=No periodic tracking will be performed.

1-9999 minutes. For example if 5, then changes are tracked every 5 minutes.

NOTE: If you set both Enable Change Tracker and Enable Real Time Tracking to Y, then even if the Real-Time Auditing (All systems) parameter in Audit is set to N, activating the ZAUDIT subsystem activates the Audit job. You access the parameter from the Auto start activities in ZAUDIT option in the System Configuration menu in Audit (STRAUD -->81-->5)

Native Objects Definitions

To access the Native Objects screen, select 3. Native Objects Definition from the System Configuration Main Menu.

Figure 4-3. Native Objects Screen

Field

Description

Native object types to track, or *ALL

Enter the types of native objects to track or *ALL to track all types.

Function Key

Description

F4=Prompt

Opens a prompt list to select one or more object types.

  1. Type 1 next to the object type to select it.

  2. To select another type select a different line and press F4

    to reopen the prompt list.

Changes on these objects will begin to be tracked after Re-Activation of Change Tracker (and Audit, if necessary).

PTF Objects Definitions

To access the PTF Objects screen, select 4. PTF Objects Definition from the System Configuration Main Menu.

System libraries include objects normally maintained by the users. These include objects with types of *USRPRF, *LIB, *DEVD, history files, QHST, and other objects.

Figure 4-4. PTF Objects Screen

Field

Option

PTF Tracker omits local system objects

Y=Yes. Local objects will not be tracked

N=No. Local objects will be tracked.

Activate Periodic Tracking

To activate periodic tracking, select 71. Activation from the System Configuration Main Menu, and then select 51. Activate Periodic Mode from the Activation Menu. The Add Job Schedule Entry screen appears.

Figure 4-5. Add Job Schedule Entry Screen

Field

Description

Job Name

Name – Name of the job

*JOBD – Job Description

Schedule Date

FIRST-DATE – Invalid date that must be changed to one of the following options: *CURRENT – Submit job on the current date

*MONTHSTR – Submit job on the first day of the month

*MONTHEND – Submit job on the last day of the month

*NONE – No start date is specified

Schedule Time

FIRST-TIME – Invalid time that must be changed to one of the following options:

Time – Submit job at the specified time (24-hour format)

*CURRENT – Submit the job at the current time

Omit Date

Date – Specify a maximum of 20 dates on which the job is not submitted. Enter + and press Enter to open more fields for additional dates.

*NONE – There are no dates when a job is not submitted

Recovery Action

Specifies the recovery action to take if the job cannot be submitted at the designated time because the system is powered down or in restricted state.

*SBMRLS – Job is submitted in the released state

*SBMHLD – Job is submitted in the held state

*NOSBM – Job is not submitted

Message Queue

Specifies the qualified name of the message queue to which message are sent

Name – Specific message queue

*USRPRF – Message queue specified in the user profile under which the submitted job runs is used

*NONE – Completion messages are not sent. Error messages are sent to the QSYSOPR message queue

Library

Library where the message queue resides Name – Specific library

*LIBL – Library List

*CURLIB – Current Library

Text Description

Text that briefly describes the job schedule entry

Deactivate Periodic Tracking

To deactivate periodic tracking, select 71. Activation from the System Configuration Main Menu, and then select 52. Activate Periodic Mode from the Activation Menu. All periodic tracking is immediately stopped.

Retention Period

To define the period of time to save tracking information, select 9. Retention Period from the System Configuration Main Menu. The Change Tracker System Periods screen appears.

Figure 4-6. Retention Periods

Field

Description

Retention period (days)

Use this option to determine how long information will be retained.

0 - 9999

9999=*NOMAX - Information will retained for an unlimited time.

Applies for

The retention period will apply for the following parameters:

Native [objects]

Y=Yes, N=No

Source [objects]

Y=Yes, N=No

IFS [objects]

Y=Yes, N=No

PTF

Y=Yes, N=No

Backup program for removed activity

A specified backup program may run before deleting old information. This information will backed before deletion. The *STD (default) backup program is SMZT/CTSOURCE CTLOGBKP.

Name, *STD, *NONE

Backup program library

Set the location of the backup program.

E-Mail Definitions

A detailed description of this option is provided in the Audit User Manual.

SIEM Support

Change Tracker integrates with SIEM systems by sending security alerts to the Syslog. Message alerts can contain detailed event information about changes to both objects and source files.

Setting Syslog

The Syslog definitions for Change Tracker are defined in Audit. In the Audit System Configuration menu (accessed by option 81 in the Audit main menu), use option 32 to set the specific Syslog parameters. For more details, see the Audit User Manual.

Setting Severity by Event Type

You can define for what level of severity Syslog messages should be sent, to avoid overloading your system with unnecessary information.

  1. Select 72. Setting Severity by Event Type in the Change Tracker System Configuration menu. The Setting Syslog Severity by Event Type screen appears.

Figure 4-7. Setting Severity by Event

Field

Description

Send SYSLOG messages (for SIEM)

Y=Yes N=No

Severity

Enter the severity range from which the SYSLOG message will be sent for the following:

 

  • Native objects

  • IFS objects

  • PTF objects

  • Source file changes The severity levels are:

  • 0 = EMERGENCY

  • 1 = ALERT

  • 2 = CRITICAL

  • 3 = ERROR

  • 4 = WARNING

  • 5 = NOTICE

  • 6 = INFORMATIONAL

  • 7 = DEBUG

  1. Enter your parameter choices and press Enter.

General

Language Support

A detailed description of this option is provided in the Audit User Manual.

Copyright Notice

This screen displays the current Raz-Lee copyright notice and the General Public License (GPL) where necessary.