RACF Sentinel

The architecture of RACF Sentinel comprised several key components designed to monitor and manage RACF security events in real-time. The core component was the Sentinel task, a z/OS started task responsible for monitoring RACF events. This task communicated with the RACF security system to receive event notifications.

The configuration files, typically stored in a partitioned data set, defined security policies, alert thresholds, and other operational parameters. The security event log, also stored on z/OS, recorded all security-related events, providing a detailed audit trail. Communication between components primarily occurred through z/OS system services and TCP/IP.

The product used a proprietary data storage mechanism for event logs. The main components included the Event Monitor, Policy Engine, and Alert Manager. The Event Monitor captured RACF events, the Policy Engine evaluated them against defined policies, and the Alert Manager triggered notifications based on policy violations.

The product did not use any external databases. Network requirements included TCP/IP connectivity for communication. It is important to note that RACF Sentinel is no longer supported; consider alternatives like IBM Security zSecure for ongoing security.