i will be curious for technical details if it is possible (i mean what configurations should you do)
On 12/6/06, Schuh, Richard <[EMAIL PROTECTED]> wrote:
The exit code could cut an accounting record, write a monitor record, or record the event in some other way. The difference between this and an EXEC is that the EXEC runs in the user's virtual machine while the exit routine is part of CP. ------------------------------ *From:* The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] *On Behalf Of *Zoltan Balogh *Sent:* Wednesday, December 06, 2006 11:39 AM *To:* IBMVM@LISTSERV.UARK.EDU *Subject:* Re: Are priv CP commands logged somewhere? ok, you will know the user was authorised for using the cp command by getting the exit code. But how will you get it? What other alternates are? If you find a good way for solve this, plz share with us.. On 12/6/06, Schuh, Richard <[EMAIL PROTECTED]> wrote: > > You are on the right track. Instead of relying on an EXEC, CP Exit code > or altered commands might be a better path to take. One can almost always > find a way of circumventing or subverting an EXEC if bypassing the logging > is desired. > > ------------------------------ > *From:* The IBM z/VM Operating System [mailto:[EMAIL PROTECTED] *On > Behalf Of *Zoltan Balogh > *Sent:* Wednesday, December 06, 2006 11:27 AM > *To:* IBMVM@LISTSERV.UARK.EDU > *Subject:* Re: Are priv CP commands logged somewhere? > > i know world of VM's is very new for me but if i were under linux or > windows i would rename the application, and i place (in this case) an EXEC > what calls the original program with all of the given parameters, but then > you can put some logging/any function for traces.. I dont know here is it a > good way too or not > > On 12/6/06, Jim Vincent <[EMAIL PROTECTED]> wrote: > > > > According to my monitoring configurator (aka, Rick B) the CP VARY PROC > > would be system config change and gets monitored. CP SET SHARE is > > another > > puppy. We need to know (without an ESM) when someone enters a command > > like > > that to be able to audit when, who and to what it was done. > > > > _______________________________________ > > James Vincent > > Systems Engineering Consultant > > Nationwide Services Co., Technology Solutions > > Mainframe, z/VM and z/Linux Support > > One Nationwide Plaza 3-20-13 > > Columbus OH 43215-2220 U.S.A > > Voice: (614) 249-5547 Fax: (614) 677-7681 > > mailto: [EMAIL PROTECTED] > > > > > > The IBM z/VM Operating System <IBMVM@LISTSERV.UARK.EDU> wrote on > > 12/06/2006 > > 02:16:36 PM: > > > > > IBMVM@LISTSERV.UARK.EDU > > > > > > Are configuration monitor records cut for these events? > > > > > > Neale > > > On Wednesday, 12/06/2006 at 01:58 EST, Jim Vincent > > > < [EMAIL PROTECTED]> wrote: > > > > I am just starting to dig, but thought I would toss this out to > > the > > > list. > > > > If someone enters a command like CP SET SHARE or CP VARY > > PROCESSOR, are > > > > those logged anywhere? Are they in the monitor data or accounting > > data? > > > >
