Find who is changing the file at CICS region?

[durga]

Hi,

We have number of CICS test regions. And there are some common files which are allocated to these regions, used by all. We send email to tell everybody for a changing these files, before changing, but, many a times someone just changes it without notification. How can we find who is changing the file for a given CICS region?

[Anuj Dhawan]

I think you can not find such an information from any logs....

[Nitin Gadge]

We also just send an email to make others aware about such changes.

[durga]

Thanks all but does not any log capture such a thing which can be communicated automatically, is that possible?

[Robert Sample]

Thanks all but does not any log capture such a thing which can be communicated automatically, is that possible?

No, this is not possible. It is not possible because (1) CICS does NOT have any log to capture file changes, and (2) CICS does not capture who is doing what to a file, either. Here are some messages from one of our CICS regions:

Code: Select all

DFHFC0201 05/29/2019 07:20:11 CICSP2 Non-RLS file EDIOEA has been deallocated. Module DFHFCN.                                       
DFHAP1900 05/29/2019 07:20:11 CICSP2  PRODBTCH CEMT SET FILE(EDIOEA) NOWAIT ENABLESTATUS(DISABLED) OPENSTATUS(CLOSED) RESP(NORMAL)  
           RESP2(0).                                                                                                                
DFHFC0200 05/29/2019 07:25:41 CICSP2 Non-RLS file EDIIEA has been allocated to data set PROD.EDI.V66.VSAM.EDI.EDIIEA. Module DFHFCN.
DFHFC0200 05/29/2019 07:25:41 CICSP2 Non-RLS file EDIOEA has been allocated to data set PROD.EDI.V66.VSAM.EDI.EDIOEA. Module DFHFCN.

If you want to look for that type of message, investigate how to parse the MSGUSR log in your CICS regions. And note that there is nothing about who made the change, nor what was changed. Once a CICS file is disabled / closed, ANYONE with CEMT authority can point the DD to a different file name.

Another problem with log parsing on z/OS and CICS in particular is that most file writes are buffered. Hence, depending upon how often the buffer is being flushed, it could be anywhere from a few seconds to many hours between the time CICS writes the log message and the time it can be seen in the log file.

Realistically, there is no way to achieve what you have asked to do on a z/OS CICS system. You either need to figure out an alternative method (such as using your security package to restrict access to just one or a few people) or just accept that the current situation will continue.