Example reports for IMS

This section includes queries that you can use as a base for building your own IMS reports.

Note: Performance on the reports will be slower the more runtime parameters using ‘LIKE’ that you add. If you are sending out regularly scheduled batch reports, consider using more hard coded parameters for the query conditions.

The query in the following table is very similar to the IMS Data Detail built in report, but it narrows results to just DLI and also includes some additional fields such as IMS Terminal, IMS Segment, and the SSID (Service Name).

Table 1. IMS DLI Detail Report Query Fields (Main entity: FULL SQL)
Entity Attribute Field Mode Comments
FULL SQL Timestamp Value  
Client/Server Service Name Value SSID as defined in the Guardium IMS Definitions panel.
Client/Server Server Type Value
Example: IMS
FULL SQL MS/DATA SET User ID Value  
Client/Server Network Protocol Value  
FULL SQL Source Program Value  
FULL SQL IMS Transaction Value  
FULL SQL IMS Terminal Value  
FULL SQL IMS Segment Value  
FULL SQL Bind Variable Values Value  
FULL SQL Full SQL Value  
FULL SQL Full SQL ID Value. Order by is checked, sort rank 1, and Descend is checked. This helps to sequence events in a report when the timestamp is not granular enough.
Table 2. IMS DLI Detail Report Query Conditions
Entity Attribute and Operator Comments
Client/Server Server Type LIKE Value IMS  
AND Client/Server Network Protocol LIKE Value DLI  
AND Client/Server Service Name LIKE Parameter ServiceName  
AND FULL SQL IMS/DATASET User ID LIKE Parameter IMSUserID At runtime, use % or specify a user ID or wildcarded user ID.
AND FULL SQL Full SQL LIKE Parameter FULLSQL

At runtime, use % or specify a wild card for a portion of the full SQL string.

Example: %GET%
Table 3. Query for IMS Privileged User Report Query Fields (Main entity: FULL SQL)
Entity Attribute Field Mode Comments
FULL SQL Timestamp Value  
Client/Server Service Name Value SSID as defined in the Guardium IMS Definitions panel.
Client/Server Server Type Value
Example: IMS
Full SQL IMS/DATA SET User ID Value  
Client/Server Network Protocol Value  
FULL SQL IMS/DATA SET Program Name Value  
FULL SQL DBD Value  
FULL SQL IMS/DATA SET Context Value  
FULL SQL IMS/DATA SET Job Name Value  
FULL SQL IMS/DATA SET Job Number Value  
Access Period IMS PSB NAME Value  
FULL SQL IMS Segment Value  
FULL SQL IMS PCB NAME Value  
FULL SQL IMS Transaction Value  
FULL SQL IMS Terminal Value  
FULL SQL IMS DLI Status Code Value If you collected audit events that have non-blank status codes, this field will contain those. Non-blank status codes can indicate that the DLI call failed or completed with a warning.
Client/Server Client IP Value  
Client/Server Server IP Value  
FULL SQL Full SQL ID Value. Order by is checked, sort rank 1, and Descend is checked. This helps to sequence events in a report when the timestamp is not granular enough.
FULL SQL Full SQL Value  
Table 4. Query for IMS Privileged User Report Query Conditions
Entity Attribute and Operator Comments
WHERE Client/Server Network Protocol LIKE Value DLI

Make this a runtime parameter instead if you are concerned with privileged activity related to activities reported by SMF and IMS Log reporting.
AND Client/Server Service Name LIKE Parameter ServiceName SSID as defined in the Guardium IMS Definitions panel.
AND FULL SQL IMS/DATASET User ID LIKE Parameter IMSUserID  
AND FULL SQL Full SQL LIKE Parameter FULLSQL At runtime, use % or specify a wild card for a portion of the full SQL string.
Example: %GET%
AND FULL SQL IMS/DATA SET User ID IN GROUP AdminUserGroup

Use your own group here for where you keep privileged user IDS. This group can be maintained manually, but it more maintainable by regularly scheduling uploads from the external source that maintains these IDs.

Wild cards are not allowed in this field because of the use of IN.