|
|
|
The SMF files or log streams that collect SMF records are as important to system security as the SMF options chosen and the SMF exits in effect.
Each SMF MANx file collects records until it is full. Recording is automatically switched to the next file in sequence. At the same time, the operator receives a message that indicates that a dump of the full SMF file is required. This process continues through the rest of the files. When the last file is full, the process starts over again with the first file in the sequence, but only if the first file is empty.
The computer operator must ensure that the SMF files are dumped on a timely basis. If an SMF file becomes full and the next SMF file in sequence was not dumped, SMF cannot write any more data to disk, and it stops recording data. SMF does keep count of how many records it cannot capture. Once the SMF files are cleared, SMF generates a type 7 record, indicating how many SMF records were lost. You can review the SMF Scan Display for a record type 7.
The IFASMFDP program unloads the SMF files from the online SMF disk data sets. The archive data sets can be on disk or other storage media, such as tape or MSS. Just as SMF can select the SMF record types to record, so does the SMF dump program. The IFASMFDP program has three exits that can suppress SMF records from its output data sets. You should review these SMF dump program exits to determine their purpose, use, and function.
The SMF log streams are an alternate recording mechanism for all system SMF records.
A site can have several SMF log streams defined and active. Each log stream record a range of SMF record types, by using the SMFPRMxx PARMLIB member. The log stream structures use LOGR services to maintain buffer data in the LOGR subsystem. The LOGR services offload the data when the buffer full threshold specified in the log stream definition is reached and purges the data according to criteria specified in the log stream definition.
The IFASMFDL dump program is provided for log streams. This program dumps the contents of the log streams to sequential data sets on tape or DASD. It also routes different records to separate files. During the dump process, SMF records the following:
For information about IBM‑supplied SMF record types, see the SMF section of the Technical Reference Guide.
| Copyright © 2009 CA. All rights reserved. | Tell Technical Publications how we can improve this information |