If you can determine which products or functions in your environment can dynamically alter UCB info, you could start there and place slips traps on them.
The first step I would take is to set up an automatic display command (D U,,,xxx,yy) to display all UCBs that have been affected starting at once per hour (or whatever level you are comfortable with) on all LPARs. Then when you get a hit, review syslog and see when the corruption occurred. That way you can narrow the time frame. Next go see what batch jobs or onlines were running during that time frame. What was starting up, shutting down, connecting (like FTP or servers), and what message were produced. Then begin to setup up traces for those functions. Then after you eliminate one, go to the next. Very time consuming but it will eventually shed light on the culprit. The IBM UCB Sniffer is very helpful. If you have products that assist SMS in managing DASD, like PROSMS, you could check with those vender(s) first. Lizette Koehler ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
