XMA: How to generate email alerts for priviliged ID usage when PRMTMAC is used

XMA: How to generate email alerts for priviliged ID usage when PRMTMAC is used

This example shows how to generate an email when PRMPTMAC is used in conjunction with a privileged AC Command.

The FILTER below looks for an XAC-O (output) record type with "REASON: " in the result field. Tokens are then used to customize the email subject showing the subject and target user, with the email body showing additional information.

To receive an email for a specific XAC command without the need to capture the reason, the STRINGFILTER can be modified to exclude the search for the reason.

FILTERDEFBEGIN $EMAIL-TACL-255-REASON
STATUS ACTIVE
EVALUATE_MSG CONTINUE
 MOVER_BEGIN
  MOVER_SELECT_BEGIN
    PRODUCT = XYGATEAC
  MOVER_SELECT_END
 MOVER_END
 DATA_BEGIN
    DATA_SELECT_BEGIN
    FILTERTYPE STRINGFILTER
    AUDIT.RESULT LIKE "REASON: "
    AUDIT.MESSAGEID = XAC-O  
    ! AUDIT.RULENAME use the exact XAC Command i.e. TACL-255
    AUDIT.RULENAME = TACL-255
    DATA_SELECT_END
 DATA_END
 ACTIONCOLL_BEGIN
    ACTION_BEGIN
    ACTIONTYPE   MAIL 
    MAIL_FROM   ALERT@xypro.com
    MAIL_IPPROCESS $ZTC0
    MAIL_SRV    mail.server.example.com
    MAIL_PORT   25
    MAIL_TO    example.user@xypro.com     
    MAIL_SUBJECT   |(AUDIT.SUBJECTLOGIN)|XACed to SUPER.SUPER:|(AUDIT.RESULT)|
    !If you want to format the message using a file, specify a file.
    !MAIL_BODY   \<node>.$<vol>.<subvol>.<file>
    !If you want to format using "format tokens", leave out MAIL BODY
    !commented out and design the message using quoted lines:
    MAIL_TEXT
     "Node:   |(INSTALL.SYSTEMNAME)|"
     "Source:  |(AUDIT.PRODUCTCODE)|"
     "Time:   |(AUDIT.RECORDLCT)|"
     "Operation: |(AUDIT.OPERATION)|"
     "Type:   |(AUDIT.OBJECTTYPE)|"
     "Name:   |(AUDIT.OBJECTNAME)|"
     "Attempted: |(AUDIT.SUBJECTLOGIN)|"
     "IP Addr:  |(SESSION.IPADDRV46)|"
     "Result:  |(AUDIT.RESULT)|"
     "Outcome:  |(AUDIT.OUTCOME)| (Success = 1; Fail = 3)"
    MAIL_TEXT_END
ACTION_END

 

If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.

 

 

    • Related Articles

    • XMA: Filter to send an email alert when using XCF to update XYGATE configuration files

      This is an example filter you can modify to use in your own environment to generate email alerts when XYGATE configuration files are updated with XCF. !====================================================================== ! Alert when ACL or CONF ...

    • XMA: Msg#:217 Level:Critical Msg:ServerClass MQREADER (\node.$XMA) Maximum retries (24) reached on email alerts

      The setting for the max retries can be configured from XMA_MANAGER. The steps to change the configuration of the max retries are as follows: TACL> Volume <XMA installation SUBVOLUME> (ie. VOLUME $<VOL>.XYGATEMA) TACL> XMA INSTALL (To attach the ...

    • XMA: SLSENDER is busy

      Use the XMA_SQLCOMPALL macro to generate a new optimized query plan, which will then be used when compiling the objects. TACL> VOLUME $SYSTEM.XYGATEMA TACL> RUN XMA INSTALL TACL> XMA_PWSTOP TACL> XMA_SQLCOMPALL TACL> XMA_PWCOOL The XMA_SQLCOMPALL ...

    • XMA: How to generate the SQL explain plan for movers.

      To produce an explain plan to show the SQL/MP cost and table usage for XMA movers. Using XMA_MANAGER stop the Mover Volume $<XUGATEMA Installation volume>.XYGATEMA RUN NEWDEFS SQLCOMP /IN <Object>/CATALOG =XMA_CAT,EXPLAIN Using XMA_MANAGER start the ...

    • XMA: how to resend XMA alerts when using IPALERT

      Add Alert-Only movers to resend the messages with a FILTER that will not send the records created later than the end DateTime. - The Start DateTime can be specified (e.g. "2022-05-09:00:00:00.000000") when the commands to start the added Alert-Only ...