z/OS Encryption Readiness Technology (zERT) aggregation

z/OS® V2R3 Communications Server, introduced a new function called z/OS Encryption Readiness Technology (zERT). With zERT, the TCP/IP stack acts as a focal point in collecting and reporting the cryptographic security attributes of IPv4 and IPv6 application traffic that is protected using the TLS/SSL, SSH, and IPSec cryptographic network security protocols. The collected connection level data is written to SMF in SMF 119 subtype 11 records.

In certain environments, the volume of SMF 119 subtype 11 records can be large. z/OS V2R4 Communications Server provides the zERT aggregation function. The zERT aggregation function provides an alternative SMF view of the collected security session data. This alternate view is written in the form of new SMF 119 subtype 12 records that summarize the use of security sessions by many application connections over time and which are written at the end of each SMF/INTVAL interval. This alternate view condenses the volume of SMF record data while still providing all the critical security information.

Decreasing the frequency at which zERT summary records are written may increase the amount of 64-bit pageable, private memory needed, because the zERT aggregation information is held longer in memory before being written out to SMF.

Restrictions:

The following restrictions apply to both zERT discovery and zERT aggregation functions.

zERT collects information for TCP and Enterprise Extender (EE) connections. Information is not collected for non-EE UDP traffic or traffic using other IP protocols.
zERT collects cryptographic security attributes for the TLS, SSL, SSH, and IPSec protocols. No other cryptographic security protocols are supported.
The following z/OS cryptographic protocol providers are fully enabled for zERT: z/OS Communications Server IPSec and AT-TLS, z/OS Cryptographic Services System SSL, and z/OS OpenSSH. Detailed security attribute data is available for connections using these protocol providers. Other TLS, SSL, and SSH implementations running on z/OS are monitored through stream observation only. A limited amount of security attribute data is available for these connections.
The interval at which the SMF 119 subtype 12 records are created will be determined by the ZERT AGGregation sub-parameter INTVAL. (INTVAL/SYNCVAL sub-parameters are available in z/OS V2R4 Communications Server with APAR PH25049.)
For information on the specific cases where security attribute data is limited or unavailable, see What are the limitations for zERT discovery? in z/OS Communications Server: IP Configuration Guide.

Dependency: In order to properly monitor IBM® Sterling Connect:Direct traffic when it is protected through SecurePlus TLS/SSL support, you must apply Connect:Direct APAR PI77316.

For video resources of zERT, see zERT video gallery.

Using z/OS Encryption Readiness Technology (zERT) aggregation

To enable z/OS Encryption Readiness Technology (zERT) aggregation, perform the tasks in Table 1.

Table 1. zERT aggregation
Task/Procedure	Reference
Plan for collection and storage of zERT summary SMF records and decide whether or not you want to discontinue collection of zERT connection detail records.	Monitoring cryptographic network protection: z/OS encryption readiness technology (zERT) in z/OS Communications Server: IP Configuration Guide z/OS MVS System Management Facilities (SMF)
Enable the zERT aggregation function.	GLOBALCONFIG statement in z/OS Communications Server: IP Configuration Reference
If you want zERT summary records to be available in the System Management Facility data sets or log streams, specify SMFCONFIG TYPE119 ZERTSUMMARY.	SMFCONFIG statement in z/OS Communications Server: IP Configuration Reference
If you want zERT summary records to be available to a real-time NMI application: Perform the necessary RACF® processing to authorize the NMI application to use the zERT Summary SMF NMI service (SYSTCPES). Specify NETMONITOR ZERTSUMMARY in the TCP/IP profile.	Requests sent by the client to the server: SYSTCPES service in z/OS Communications Server: IP Programmer's Guide and Reference NETMONITOR statement in z/OS Communications Server: IP Configuration Reference
Display zERT aggregation configuration settings	Netstat CONFIG/-f report in z/OS Communications Server: IP System Administrator's Commands
Enable the zERT aggregation INTVAL and SYNCVAL.	GLOBALCONFIG statement in z/OS Communications Server: IP Configuration Reference
Display zERT aggregation INTVAL and SYNCVAL configuration settings.	Netstat CONFIG/-f report in z/OS Communications Server: IP System Administrator's Commands

To find all related topics about zERT aggregation, see Table 2.

Table 2. All related topics about zERT aggregation
Book name	Topics
z/OS Communications Server: IP Configuration Guide	Monitoring cryptographic network protection: z/OS encryption readiness technology (zERT) What are the limitations for zERT discovery? What does zERT aggregation collect? How does zERT aggregation summarize the information? How does zERT aggregation provide the information? How does zERT aggregation determine the server port? Using z/OS Encryption Readiness Technology (zERT) Enabling zERT discovery Enabling zERT aggregation Enabling a longer zERT aggregation recording interval Selecting a destination for zERT discovery SMF records Selecting a destination for zERT aggregation SMF records Disabling zERT discovery Disabling zERT aggregation
z/OS Communications Server: IP Configuration Reference	GLOBALCONFIG statement SMFCONFIG statement NETMONITOR statement
z/OS Communications Server: IP System Administrator's Commands	Netstat CONFIG/-f report
z/OS Communications Server: IP Programmer's Guide and Reference	Real-time TCP/IP network monitoring NMI Connecting to the AF_UNIX stream socket Authorizing the applications Real-time NMI: Connecting to the server Real-time NMI: Interacting with the servers Real-time NMI: Common record header Real-time NMI: Requests sent by the client to the server Requests sent by the client to the server: SYSTCPES service Records sent by the server to the client: Initialization record Records sent by the server to the client: Token record EZBTMIC1 or EZBTMIC4 parameters Processing the cte records for SYSTCPER Processing the cte records for SYSTCPES SMF type 119 records TCP/IP profile record Global configuration section TCP/IP profile record management section zERT Summary record (subtype 12)