RACF auditing
Recording security events, such as failed access and changes to profiles, so they can be reviewed later.
Also written SMF 80 records, AUDIT option, UAUDIT, LOGOPTIONS, IRRADU00
RACF can record security events as SMF records, mostly type 80. What it records is controlled at several levels.
Profiles have an AUDIT setting that says which access attempts to log, such as all failures, or every successful update to a sensitive dataset. SETROPTS LOGOPTIONS sets logging for whole classes. UAUDIT on a user logs everything that user does, which is used for very powerful IDs. RACF also logs changes to its own profiles and every use of special attributes.
Failed access attempts are logged by default and also produce a message, such as ICH408I, in the job or session. That is often the first sign of a missing permission.
The records are only useful if someone reads them. Sites unload them with the IRRADU00 utility or reporting tools, and review them for things like repeated failures, use of firecall IDs and access to sensitive data. Users with the AUDITOR attribute can set audit options and see all the settings, which lets auditors check the system independently of the people who run it.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- SMFSystem Management Facilities: the z/OS feature that writes a detailed record of what happened on the system, used for billing, performance and security.
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- SETROPTSThe RACF command that sets and shows the security options for the whole system, such as password rules and which classes are active.
- RACF user attributesSettings on a RACF user ID that give it special powers, such as managing security or auditing, or limit it, such as being revoked.
- Warning modeA RACF profile setting that allows access that would normally be refused, but records a warning every time.
- Security administratorThe person who manages mainframe security day to day: user IDs, access requests, security rules and audits.