Report entities and attributes for IMS

Use this information to find reporting attributes for IMS.

Table 1. Attributes for Client/Server Entity (IMS)
Attribute	Description
Timestamp	All attributes in this session are static, so this timestamp is created only once, when Guardium observes a request on the defined connection for the first time.
Service Description	IMS Subsystem ID
Server Type	IMS. If more than one type of database is writing events to the Guardium system, this field helps separate the events
Client IP	IP address of LPAR . Usually the same as the server IP.
Server IP	IP Address of LPAR.
Network Protocol	Reflects each type of IMS S-TAP Audit Event collection component: DLI- online or batch DL/I activity SMF- data from SMF Data Collector activity monitor, which can collect events on data sets related to IMS. IMS_LOG – data from the IMS Archived Log Data Collector, used to collect events such as IMS user signon and signoff, changes to DBD and PSB status and IMS online region stops and starts IMS_MIS_LOG – data collected from the IMS Missing Log Utility, which analyzes IMS RECON data sets to confirm existence of log data sets.
DB Protocol	IMS
DB User Name	Not populated here for IMS. Use IMS/DATA SET User ID from the FULL SQL entity instead.
Server Host Name	Hostname of LPAR
Source Program	Region type of the access. For batch: 'DLI BTC' 'DBB BTC' . For online: MPP (Message processing region), JMP (Java Message Processing), BMP (Batch message processing-Transaction oriented) JBP (Java Batch Processing). Other possible values: AER (Application Execution Region), IFP (IMS Fast Path)
Service Name	Subsystem name from IMS Definitions panel. If more than one IMS is being audited, Service Name sorting or filtering allows reporting by IMS system.
OS User	Not used for IMS.

Table 2. Attributes for Session Entity (IMS)
Attribute	Description
Timestamp	Initially, a timestamp created for the first request on a connection. Later, it is updated when it is marked inactive following an extended period of time with no observed activity.
Session ID	Unique identifier generated by Guardium. Because IMS does not have the concept of ‘sessions’, this is not particularly meaningful in IMS reporting.
Access ID	Uniquely identifies the access period

Table 3. Attributes for Access Period Entity (IMS)
Attribute	Description
Application User	IMS Program Specification Block (PSB). Appears as psb_name=name. Use the IMS PSB Name attribute instead to report on the name alone.
Failed SQLs	Not used.
Total records affected	Not used. -1
Successful SQLs	Not applicable for IMS.
IMS PSB Name	IMS Program Specification Block (PSB)
Timestamps (microsec)	Not used. Always contains 0.

Table 4. Attributes for Full SQL Entity (IMS)
Attribute	Description
Full SQL	Contains all information about an event. Computed attributes for other report fields are created from this data, which includes: uid=; prog=; job=; step=; tran=; job#=; term=; pcb=; pcb#; dli_sts=; befor=; desc=; dbd=; seg=;
Timestamp	Timestamp of the event in the collector’s timezone.
Records Affected	Not used for IMS. Always -1.
Returned Data	Segment data, in hex, as returned to the application. Enabling the return of this data requires the assistance of IBM support to enable the correct policy action. This option is almost never recommended because it means that potentially sensitive data is stored on the collector.
Full SQL ID	Unique, sequenced identifier for this event. Can be helpful for sorting events in sequence.
Ack Response Time	Microsecond value from Timestamp on the event from the mainframe. Example: 677032 It is not recommended to use this field for sorting as it does not include leading zeros; use FullSQL ID instead.
Statement Type	Not used for IMS. Always contains ‘SQL’
Blind Variables Values	This is the same as the fieldDB2 z/IMS/DATA SET Unit of Work, prefixed with the SSID. To correlate unit of work IDs across subsystems, it is recommended to use the DB2 z/IMS/DATA SET Unit of Work field instead of this one.
IMS/DATA SET Program Name	The name of the application program issuing the DLI calls or other access.
IMS/DATA SET Step Name	JCL step name for the executing program.
IMS/DATA SET Step Number	JCL step number for the executing program.
IMS Transaction	IMS transaction identifier
IMS Terminal	Terminal ID of the originating request.
IMS PCB Name	The name of the IMS Program Communications Block (PCB)
IMS PCB Number	The PCB in the PSB that the program used to access the database
IMS/DATA SET	Data set name before an SMF rename.
Previous DSN
IMS Database	IMS database descriptor (DBD)
IMS Segment	IMS Segment name in the database.
IMS/DATA SET Name	When SMF is used, the IMS Data Set name that was accessed.
IMS/DATA SET Context	Type of activity (such as IMS Segment level GET)
IMS SMF/DATA SET Expiration Days	SMF data has expired due to data sitting in the spill file for this number of days. There could be incomplete data. This should be a rare event.
IMS SMF/DATA SET Expiration IPL Time	SMF data has expired due to an IPL occurring on the host. This could indicate incomplete data.
IMS Segment Data Length	The length of the IMS data segment.
IMS/DATA SET Type	The type of data set such as database, image copy, log type, LDS type, recon, and unknown. Applicable only when SMF data collection is used.
IMS/DATA SET Job Name	Job name
IMS/DATA SET Job Number	Job number
IMS/DATA SET User ID	ID of originating request, such as the TSO or RACF authid.
IMS PART/AREA	The name of the partition or area. A DEDB can use multiple data sets, called areas, with each area containing the entire data structure. A partition is a subset of a high availability large database (HALDB).
IMS/DATA SET Event Time	Timestamp of the event as recorded on the host in UTC format. The collector timezone is in the Timestamp field.
IMS DLI Status Code	Status code from DLI. ‘bb’ means blank (no status code). This is available only when status code collection is specified in the IMS Collection Profile policy as described in https://www.ibm.com/support/knowledgecenter/SSMPHH_10.1.0/com.ibm.guardium.doc.zos/ibm_stap_ims/AUI/V1013_AUI/DITA/auiur009.html
Timestamp(microsec)	Not used.
DB2 z/IMS/DATA SET Unit of Work	Unit of work ID (recovery token), in hex. When the token is from a CICS transaction, it can be used to correlate data access across DB2, IMS and Data Sets within a transaction. (Unlike Data Sets, this token is included even for non-CICS transactions).

Table 5. Attributes for SQL Entity (IMS)
Attribute	Description
SQL	Event type (desc=), DBD name (dbd=), and segment name (seg=)
Truncated SQL	Not used for IMS.

Table 6. Attributes for Command Entity (IMS)
Attribute	Description
SQL Verb	The event type, which depends on what is collected from the policy. Example: Segment Level GET, REPLACE, INSERT and DELETE

Table 7. Attributes for Object Entity (IMS)
Attribute	Description
Object Name	DBD name and segment name separated by a colon.
Object Type	For SMF, the type of data set such as database, image copy, log type, LDS type, recon, and unknown.
IMS Segment/DSN/PART/AREA	Name of the segment, data set name (if SMF) partition name, or area.

Table 8. Attribute for Field Entity (IMS)
Attribute	Description
Field	Not used for IMS

Exception Domain: There is no useful information logged in exception domain for IMS. You can collect events that receive particular status codes, but those are reported in the FULL SQL domain (IMS DLI Status Code attribute).