Configuring IBM Security Guardium S-TAP for Db2 on z/OS®

After installation, configure IBM Guardium S-TAP for Db2 by completing the steps that are described in this section.

IBM Security Guardium S-TAP for z/OS security recommendations
The following security recommendations apply to S-TAP for Db2, IMS, and Data Sets.
APF authorizing the LOAD library data set
The system programmer must APF authorize the product LOAD library for data collection to work correctly. The system programmer must modify the IEAAPFxx or PROGxx PARMLIB members to define the IBM Guardium S-TAP for Db2 data set, as specified by ADHEMAC1 macro value #SADHLOAD, as an APF authorized library.
Enabling the dynamic LPA facility service CSVDYLPA
The user ID that was used to start the Collector Agent PROC must be enabled to use the dynamic LPA facility CSVDYLPA to enable the collector agent to collect data.
Service class considerations
The collector agent started task must be set at a dispatching priority that is the same as, or higher than, that of Db2.
Customizing JCL members
Use the edit macro ADHEMAC1 to customize the variables in the JCL to be run. Running ADHEMAC1 allows you to modify members without requiring you to remember plan names, creators, and other variables from one editing session to the next editing session.
Creating the IBM Guardium S-TAP for Db2 control file
IBM Guardium S-TAP for Db2 configuration information is stored in a VSAM data set, which is the product control file.
Configuring the IBM Guardium S-TAP for Db2 control file
IBM Guardium S-TAP for Db2 requires information that identifies target Db2 subsystems, product options, and data set attributes. The product configuration is saved in the VSAM product control file data set that you created previously.
Configuring the collector agent
To configure the collector agent, complete the steps provided in each of the subsequent sections. The address space dispatching priority for IBM Guardium S-TAP for Db2 must be the same as, or higher than, that of Db2.
Configuring the collector agent for additional Db2 subsystems
The collector agent must be configured for each Db2 subsystem that is to be audited.
Support Services Address Space overview
IBM Guardium S-TAP for Db2 uses a Support Services Address Space, also referred to as a Primary Address Space. Learn about how the Primary Address Space works, as well as the implications for using and stopping it.
Enabling CICS Login User ID reporting
You can capture the CICS® Login User ID for SQL Statements that are run for CICS. The capture of CICS transactions is limited to CICS versions TS 4.2 or later, until end of support.

Parent topic: Configuring IBM Security Guardium S-TAP for Db2 on z/OS