>-----Original Message----- >From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Scott Barry >Sent: Thursday, August 14, 2008 10:25 PM >To: [email protected] >Subject: Re: SMF Subtype 132 record > >On Thu, 14 Aug 2008 20:52:01 -0500, Rogers Laine <[EMAIL PROTECTED]> wrote: > >>We are trying to research what software is producing SMF subtype of 132? >>We see these records being created every 1-2 minutes when a TSO user is >>log on the system. >>Any ideas? >> > > >Dump a few of these records and look for an eye-catcher in the header, presuming you are looking for SMF "type" 132. You can use some DFSORT / COPY and IDCAMS PRINT utility commands - example JCL below: > > >//S1 EXEC PGM=SORT,PARM=ABEND >//SYSOUT DD SYSOUT=* >//SORTIN DD DISP=SHR,DSN=_your_smf_input_file_ >//SORTOUT DD DSN=&&amp;SORTTEMP, >// UNIT=SYSDA,SPACE=(CYL,(10,10)), >// DISP=(NEW,PASS) >//SYSIN DD * > OPTION STOPAFT=5 > SORT FIELDS=COPY > INCLUDE COND=(6,1,BI,EQ,132) >/* >//DUMP EXEC PGM=IDCAMS >//IN1 DD DISP=(OLD,DELETE),DSN=&&amp;SORTTEMP >//SYSPRINT DD SYSOUT=* >//SYSIN DD * > PRINT INFILE(IN1) DUMP >/* > > >Scott Barry >SBBWorks, Inc. > On Fri, 15 Aug 2008 07:40:49 -0500, Laine, Rogers <[EMAIL PROTECTED]> wrote:
>Scott, > >This is what I see when dumping this SMF record. >I see nothing that jumps out at me that would indicate who this belongs to. > > d k¬ "SYSBOPER004 \" > d k¬ "SYSBOPER007 A | > d "SYSBOPER007 A | > d "SYSBOPER004 \" > d "SYSBOPER004 \" > d "SYSBOPER007 A | > How unfortunate. Some, hopefully most, ISVs mark their record with some small eye-catcher string, just in case two products are writing to the same record type. Then any SMF data post-processing utility/code can validate that the record is really their own. So, it's time to back-track to your PARMLIB(SMFPRMxx) member and/or your intra-day DUMPXY/SMFDUMP job or your nightly SMF collection processing. Sure hope you might have some DOC reference indicating who's writing that record type. Any authorized software product or application program could be writing this record type to your MAN dataset. Another option is to disable the record type in SMFPRMxx and see what program gripes about it when the SMFWTM invocation gets a non-zero RC. Then your prairie dog will pop out of its den! Scott Barry SBBWorks, Inc. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
