z/OS Encryption Readiness Technology (zERT) aggregation

z/OS® V2R3 Communications Server, introduced a new function called z/OS Encryption Readiness Technology (zERT). With zERT, the TCP/IP stack acts as a focal point in collecting and reporting the cryptographic security attributes of IPv4 and IPv6 application traffic that is protected using the TLS/SSL, SSH, and IPSec cryptographic network security protocols. The collected connection level data is written to SMF in SMF 119 subtype 11 records.

In certain environments, the volume of SMF 119 subtype 11 records can be large. z/OS V2R3 Communications Server, with APAR PI83362, provides the zERT aggregation function. The zERT aggregation function provides an alternative SMF view of the collected security session data. This alternate view is written in the form of new SMF 119 subtype 12 records that summarize the use of security sessions by many application connections over time and which are written at the end of each SMF/INTVAL interval. This alternate view condenses the volume of SMF record data while still providing all the critical security information.

Decreasing the frequency at which zERT summary records are written may increase the amount of 64-bit pageable, private memory needed, because the zERT aggregation information is held longer in memory before being written out to SMF.

Restrictions:

No restrictions beyond those described for the zERT Discovery function that was initially provided with z/OS V2R3 Communications Server. The interval at which the SMF 119 subtype 12 records are created will be determined by the ZERT AGGregation sub-parameter INTVAL. (INTVAL/SYNCVAL sub-parameters are available in z/OS V2R3 Communications Server with APAR PH25049.)

Note: With Network Configuration Assistant (NCA) APAR PI94208, this function is available in the TCP/IP security resources, and in the SMF and real time Network Management services.

For video resources of zERT, see zERT video gallery.

Table 1. zERT aggregation
Task/Procedure	Reference
Plan for collection and storage of zERT summary SMF records and decide whether or not you want to discontinue collection of zERT connection detail records.	Monitoring cryptographic network protection: z/OS encryption readiness technology (zERT) in z/OS Communications Server: IP Configuration Guide z/OS MVS System Management Facilities (SMF)
Enable the zERT aggregation function.	GLOBALCONFIG statement in z/OS Communications Server: IP Configuration Reference
If you want zERT summary records to be available in the System Management Facility data sets or log streams, specify SMFCONFIG TYPE119 ZERTSUMMARY.	SMFCONFIG statement in z/OS Communications Server: IP Configuration Reference
If you want zERT summary records to be available to a real-time NMI application: Perform the necessary RACF® processing to authorize the NMI application to use the zERT Summary SMF NMI service (SYSTCPES). Specify NETMONITOR ZERTSUMMARY in the TCP/IP profile.	Requests sent by the client to the server: SYSTCPES service in z/OS Communications Server: IP Programmer's Guide and Reference NETMONITOR statement in z/OS Communications Server: IP Configuration Reference
Display zERT aggregation configuration settings	Netstat CONFIG/-f report in z/OS Communications Server: IP System Administrator's Commands
Enable the zERT aggregation INTVAL and SYNCVAL.	GLOBALCONFIG statement in z/OS Communications Server: IP Configuration Reference
Display zERT aggregation INTVAL and SYNCVAL configuration settings.	Netstat CONFIG/-f report in z/OS Communications Server: IP System Administrator's Commands

To find all related topics about zERT aggregation, see Table 2.

Table 2. All related topics about zERT aggregation
Book name	Topics
z/OS Communications Server: IP Configuration Guide	Monitoring cryptographic network protection: z/OS encryption readiness technology (zERT) What are the limitations for zERT discovery? What does zERT aggregation collect? How does zERT aggregation summarize the information? How does zERT aggregation provide the information? How does zERT aggregation determine the server port? Using z/OS Encryption Readiness Technology (zERT) Enabling zERT discovery Enabling zERT aggregation Enabling a longer zERT aggregation recording interval Selecting a destination for zERT discovery SMF records Selecting a destination for zERT aggregation SMF records Disabling zERT discovery Disabling zERT aggregation
z/OS Communications Server: IP Configuration Reference	GLOBALCONFIG statement SMFCONFIG statement NETMONITOR statement
z/OS Communications Server: IP System Administrator's Commands	Netstat CONFIG/-f report
z/OS Communications Server: IP Programmer's Guide and Reference	Real-time TCP/IP network monitoring NMI Connecting to the AF_UNIX stream socket Authorizing the applications Real-time NMI: Connecting to the server Real-time NMI: Interacting with the servers Real-time NMI: Common record header Real-time NMI: Requests sent by the client to the server Requests sent by the client to the server: SYSTCPES service Records sent by the server to the client: Initialization record Records sent by the server to the client: Token record EZBTMIC1 or EZBTMIC4 parameters Processing the cte records for SYSTCPER Processing the cte records for SYSTCPES SMF type 119 records TCP/IP profile record Global configuration section TCP/IP profile record management section zERT Summary record (subtype 12)