File Information › File History Search

File History Search

Just as you might want to monitor the activity of a given program, so you might want to monitor data files. The System Management Facility (SMF) creates a record every time a data file is opened, scratched, or renamed. The File History Search display (6.5) can show you only the records that pertain to files. The SMF file record types that can display include:

Types 14 and 15

Data set access.

Types 17 and 18

Scratch and rename data sets.

Types 60, 62, 63, 64, 67, and 68

VSAM‑related activity.

Types 61, 65, and 66

Integrated catalog facility activity.

It can be important to check the key z/OS files periodically for updates or renames. Ensure that only authorized users are making updates. The File History Search (6.5) can also find unauthorized updates to a file.

If you detect a change in a file that you had previously frozen with the File Freezer display (6.6), you can use the File History Search display (6.5) to find out who updated it last. You can also use this option to track the use of files that contain source code for production jobs. If unauthorized users were updating the source code, control procedures should be reviewed.

The File History Search display (6.5) detects files that are used more frequently than others. This could indicate if the direct access storage devices (DASD) are balanced correctly. All of the most highly accessed data sets should not be on the same volume.

Ensure that not only the authorized users are using the data sets, but also the authorized jobs and programs. Ensure that the type of access for each file is consistent with the job function.

One final warning: Because the File History Search display (6.5) requires that the SMF types indicated above are being journaled, your display is not complete if the data center does not record all of these types. Because SMF recording can be turned on and off, do not jump to conclusions about the information provided in the display. You should check the SMF Options Display (1.5.1) to determine if the correct SMF record types are being recorded. You should also check the SMF Exits display to determine if the IEFU83 and IEFU84 SMF exits can cancel SMF records.

See System Management Facility in the “Management Information” chapter for more information about the SMF options and exits in effect at the data center. Also see the System Review Checklist for specific tests that you can perform to verify the integrity of your SMF records.