z/OS Security Server RACF Security Administrator's Guide
Previous topic | Next topic | Contents | Contact z/OS | Library | PDF


Capturing command output

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

When you direct a command, the results are returned to you and are appended to the bottom of your RRSFLIST user data set. If you do not have a RRSFLIST user data set, RRSF allocates one and adds the results.

The RRSFLIST user data set name is made up of the user's prefix as specified by the user via the TSO PROFILE command, the user ID, and RRSFLIST. When the prefix and the user ID are the same, the duplicate qualifier is dropped. Thus, the data set name would be either prefix.userid.RRSFLIST or userid.RRSFLIST.

You will receive a TSO SEND message when the results are ready for viewing, for example:
LISTUSER was successful at node NODEC. Output written to USER2.RRSFLIST.

You do not receive a TSO SEND message if you had the TSO PROFILE NOINTERCOM setting in effect when you directed the command.

Users are responsible for maintaining their own RRSFLIST data sets. If a user's data set becomes full, RRSF uses TSO TRANSMIT to send the command output to the user. The output begins with a message indicating that the user's RRSFLIST data set was full at the time the output was received.

The contents of the data captured and appended to the RRSFLIST data set varies, but generally it contains:
  • A brief description or summary of the event
  • A reproduction, but not necessarily an exact replica, of the command issued. Command options that are not specified but defaulted by RACF® might be included: security-sensitive data such as passwords or key codes are suppressed.

    The command is reproduced up to 255 characters, including the command options defaulted by RACF, and is truncated at this point. If it is truncated, the last three characters are replaced by a set of ellipses () to indicate that the remaining letters or options of the command had been omitted.

  • The output produced by the command. This output is truncated after 4096 lines.

The following examples show the format of the captured output produced by commands running in the RACF subsystem address space. The format of the output shown is the same for both the user's RRSFLIST data set, and the TRANSMIT issued when the user's data set is full. Figure 1 shows the format of captured output for a directed LISTGRP command. Figure 2 shows the format of captured output for a directed ADDSD command.

Figure 1. Captured output from a directed LISTGRP command
  LG issued at 07:50:39 on 04/21/98 was processed at MVS03.SMITHJ on
  04/21/98 at 07:50:41
 
   COMMAND ISSUED: LG        (SYS1)
 
   COMMAND OUTPUT:
   INFORMATION FOR GROUP SYS1
       SUPERIOR GROUP=NONE         OWNER=SMITHJ
       NO INSTALLATION DATA
       NO MODEL DATA SET
       TERMUACC
       NO SUBGROUPS
       USER(S)=     ACCESS=     ACCESS COUNT=          UNIVERSAL ACCESS=
         IBMUSER      JOIN        000017                    READ
            CONNECT ATTRIBUTES=NONE
            REVOKE DATE=NONE                RESUME DATE=NONE
Figure 2. Captured output from a directed ADDSD command
  ADDSD issued at 11:34:29 on 04/21/98 was processed at MVS02.JWS on
  04/21/98 at 11:34:31
  
   COMMAND ISSUED: ADDSD        'JWS.DEV*'
  
   COMMAND OUTPUT:
   IRRR008I Command succeeded. There are no messages.
All time stamps shown in the RRSFLIST data set are initially recorded as Greenwich Mean Time (GMT). These time stamps are meant to show the relative sequence in which the commands were entered and processed. When output or notify information is written into the RRSFLIST data set, these times are converted from GMT into local times. The time stamps are as accurate as possible, but they are not intended to give the exact, precise times of events. In addition, the accuracy of the time stamps depends on how accurately you have set your system clocks.
Note: RRSF assumes that either all nodes in the RRSF network have their clocks set to GMT and have appropriate local time offsets in SYS1.PARMLIB, or that all nodes have their clock set to local time in the same time zone. Any other configuration will cause errors in the timestamps shown in an RRSFLIST data set.

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014