Safeguard Management Programming Manual (G06.24+, H06.03+)

Event Management
Safeguard Management Programming Manual—422086-012
8-48
ZSFG-EVT-PROC-KILL
ZEMS-TKN-EVENTNUMBER
is the event number. Its value is ZSFG-EVT-PROC-KILL.
ZEMS-TKN-SUBJECT-MARK
marks the token that follows it in the event-message buffer as the subject of the
event message. In this message, the subject token is ZCOM-TKN-SUBJ-PROC.
ZCOM-TKN-SUBJ-PROC
is the name of the Safeguard process ($ZSMP). The value of this token
corresponds to the value <1> in the text message.
ZSPI-TKN-MANAGER
is the name of the Safeguard Manager Process ($ZSMP).
ZEMS-TKN-EMPHASIS
contains the value ZSPI-VAL-FALSE, indicating that this event is noncritical.
ZEMS-TKN-CONSOLE-PRINT
contains the value ZSPI-VAL-TRUE. See the EMS Manual.
ZEMS-TKN-CPU
ZEMS-TKN-CRTPID
ZEMS-TKN-GENTIME
ZEMS-TKN-LOGTIME
ZEMS-TKN-PIN
ZEMS-TKN-SYSTEM
ZEMS-TKN-USERID
are standard EMS tokens. See the EMS Manual.
ZCMK-TKN-XPNAME
contains the name of the process that was terminated by Safeguard. This value
corresponds to the value <2> in the text message.
Subsystem Action
The SMP attempts to kill the running process at 2-second intervals until the process is
stopped.
Recommended Action
If the running process is valid, change the process name for the event exit. Otherwise,
investigate the running process to determine if it is part of a security attack.