TSS how to manage the audit/track file

[Anon Anon]

the message guide states that after msg TSS9208i (audit file 90 % full) , you can create a backup or archive of this.
I can not find any info on how this should be don , nor can I find info on how this archive could be used for inquiries.
What is the normal process if I want to save at least 90 days of data (without losing anything due to wrap around)
Copy the records to smf and running a daily dump to smf is an option , but the data can not be easily read from SMF
Any idea's ?

#TopSecret

[Anon Anon]

We use TSSUTIL on a daily basis (at 0600) to extract the previous day's data to a GDG with a 90 generation limit. Ours goes to tape, but could be put to DASD if necessary.

//UT0010R EXEC PGM=TSSUTIL
//SMFIN DD DSN=SYS2.SS.PRODPART.AUDIT,
// DISP=SHR
//SMFOUT DD DSN=PDC.SC.DATA.XTRACT.AUDIT(+1),
// DISP=(NEW,CATLG),
// RETPD=90,
// UNIT=VTAPE
//UTILOUT DD SYSOUT=*
//UTILIN DD *
EXTRACT DATE(-01,-01)
/

#TopSecret

[DAVID Low]

You can of course set up automation on TSS9208I message to dump to GDG. In our case we are making use of AUDIT and AUDIT2 and TSS switches back and forth between the two files when it fills. We set up automation on message TSS9203I and kick off a job to dump it to GDG. At midnight, we force an audit switch.

As for processing the GDG for daily reporting we do this:
1. Extract previous days data, EXTRACT EVENT(ALL) DATE(-01)
2. Sort the extract file by time, SORT FIELDS=(92,3,PD,A,96,4,CH,A) and save to a second GDG for longer retention.
3. Run reports against the sorted data, REPORT EVENT(VIOL), etc.

Hope that helps!

#TopSecret

[Anon Anon]

Easy, we send our data to SMF and we keep this info for a year.Easy to extract and then run TSSUTIL against it.
We even store our recovery file info on a dataset which allows us to retreive all admin commands for the past 12 months.
We only use our Audit files for day to day queries and we made them large enough in our PROD environment to last at least a week.

#TopSecret