Skip to Main Content
IBM Z Software
Hide about this portal


This portal is to open public enhancement requests against IBM Z Software products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas
  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

New Alerts based on DB2 SMF audit records

See this idea on ideas.ibm.com

Although we are using zSecure Alert to trigger dataset or RACF events there is no capability to catch DB2 SMF audit records. It is a PCI-DSS requirement to trigger alerts on the DB2 insufficient access on sensitive tables or modification of a users privileges (e.g. GRANT a role to a user). 

 

Kind regards

Konstantinos

Idea priority High
  • Guest
    Reply
    |
    Feb 11, 2025

    Thank you for your response:


    You can start with the following IFCIDs:


    IFCIDs 23, 24, 25, 219, 220 : Utilities

    IFCIDs 55, 83, 87 : Set Current SQLID, Identify and End of Signon

    IFCIDs 62 : DDL

    IFCIDs 90, 91, 140, 142, 143 : Commands and other Audit data

    IFCID 141 : DCL

    IFCIDs 144, 316, 318, 400, 401 : DML

    IFCID 270 : Trusted context CREATE / ALTER

    IFCID 271 : Column Mask/Row Permission – CREATE / DROP / ALTER


    Regards

    Konstantinos

  • Admin
    Michael Zagorski
    Reply
    |
    Jan 31, 2025

    Hi.. Which IFCids do you want to alert on?

  • Guest
    Reply
    |
    Jan 23, 2025

    Thank you for the response.

    Note that we don't compress DB2 SMF records.

  • Admin
    HANS SCHOONE
    Reply
    |
    Jan 22, 2025

    The crucial question is whether you have asked Db2 to compress the Db2 SMF records. If so, we will not support it in Alert because it is costs too much CPU overhead to decompress every DB2 SMF record to see if we need to alert on it. We have asked Db2 development to move or clone the IFcid to the non-compressed piece of the record, but that has not been built so far. If you actually have non-compressed DB2 SMF records, we can think about supporting it. Which IFCids do you want to alert on?

  • Guest
    Reply
    |
    Jan 16, 2025

    Note that we have implemented native DB2 security  (not in RACF).