Environment-dependent selection

You must enter the )CM Pass one query section if you want to use environment-dependent selection criteria in your Alert Condition.

The following example is from skeleton member C2PS1204 for IBM® Security zSecure-supplied alerts 1204 and 2204. It shows a stage1 query that finds the data sets that are currently part of the APF list, using the DSN field and APF flag field of NEWLIST TYPE=SENSDSN. For more explanation, see zSecure CARLa SELECT/LIST Fields. These data set names are substituted into another CARLa query. This query is otherwise contained in quotation marks and thus literally copied to the output file to become the start of the reporting step query.

  )CM Pass one query
  )SEL &C2PEPASS = Y
  n type=system outlim=1 nopage
  sortlist,
    "n type=smf name=uapf1204 outlim=0" /,
  )SEL &C2PESECP = RACF
    " select event=access(allowed) intent>=update likelist=recent," /,
  )ENDSEL
  )SEL &C2PESECP = ACF2
    " select likelist=recent acf2_subtype=D," /,
    " acf2_access=(OUTPUT,UPDATE,INOUT,OUTIN,OUTINX)," /,
    " acf2_descriptor=LOGGING, 
  )ENDSEL
    "        dsn=(,"   
n type=sensdsn nopage
  select apf
  sortlist,
    "           " dsn(0) | ","
  n type=system outlim=1 nopage
  sortlist,
    "            )" /,
    " sortlist ''"
      [...]
  )ENDSEL

The generated query is named UAPF1204 by the NAME keyword on the generated N (Newlist) statement. It allows the Alert Condition to refer to it. The NAME ends in the alert ID to avoid name clashes with filters specified in other alerts.

The generated query is meant as a pre-selection only, and thus specifies OUTLIM=0, meaning that no output must be generated. The pre-selection is for SMF records for the following situations:

For the APF data sets obtained from the system
On RACF® systems: for EVENT=ACCESS(ALLOWED) INTENT>=UPDATE
On ACF2 systems: for ACF2_SUBTYPE=D ACF2_ACCESS=(OUTPUT|UPDATE|INOUT|OUTIN|OUTINX)

The LIKELIST=RECENT clause further restricts the selection to the SMF records written during the current reporting interval. The following section explains about the pre-selection filters that are always available to specify what SMF and WTO input data to tie the selection to.