On Wed, 1 Feb 2006 19:19:10 -0600, Rugen, Len <[EMAIL PROTECTED]> wrote:
>I'm working on a mystery "changed data" where the people who created the process are long gone, others have made changes and nobody knows what is REALLY happening. > >My question, for now anyway, are there any types of dataset access that don't cut 14 or 15 records? > >I think I've ran into concatenated datasets before that don't appear, but that shouldn't apply here. This is a data or even data and JCL PS dataset. I think IND$FILE is involved. The only access outside the known jobs are by a TSO account, who is the one confused, so I think it's something THEY are doing to themselves. > This is a perfect scenario for the use of DAF. Feed DAF all of the SMF records that it supports for a particular window of time, and it will reveal all that is know about the datasets in question. IND$FILE itself does not cut any SMF records (SHARE requirement?), but the OS audit trails cut SMF records for the action that is taken. I uploaded a file via IND$FILE that didn't exist and got the following in DAF. Date Time SID Job User Rty Sty ZTGP01.XMI.SLPALIB 2006034 14.59.03.93 BBC1 ZT15 ZT15 080 (RACF) 2006034 14.59.04.05 BBC1 ZT15 ZT15 060 (VVDS) 2006034 14.59.04.07 BBC1 ZT15 ZT15 061 (ICF Catalog Define) 2006034 14.59.11.80 BBC1 ZT15 ZT15 015 (Close) 2006034 14.59.11.80 BBC1 ZT15 ZT15 042 006 (Close) I uploaded a file via IND$FILE that did exist and got the following in DAF. Date Time SID Job User Rty Sty ZTGP01.XMI.SLPALIB 2006035 11.19.16.23 BBC1 ZT15 ZT15 015 (Close) 2006035 11.19.16.23 BBC1 ZT15 ZT15 042 006 (Close) When a dataset is closed, a 14/15 and 42.6 is cut. Depending on certain situations, all fields are not populated (member/ddname,etc...). SMF Exits (IEFU8*) can prevent SMF records from not being cut - they are called for every SMF record that is written. I hope this helps... Michael ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
