See if the CBT tape file 094 could help. The utility DAF will read any SMF record (this is an assembler program. Just assembler linked and run) and provides:
/* DAF CAN SOLVE MANY COMMON MYSTERIES BY SHOWING: * FILE 094 //* * FILE 094 //* DATASET CREATE, ACCESS, RENAME, DELETE * FILE 094 //* HOW MANY EXCPS ? * FILE 094 //* WHAT DDNAME ? * FILE 094 //* WHAT JOB ? * FILE 094 //* WHAT TIME ? * FILE 094 //* WHAT VOLUME ? * FILE 094 //* * FILE 094 //* DAF CAN SOLVE SOME UNIQUE MYSTERIES BY SHOWING: * FILE 094 //* * FILE 094 //* WHAT VOLUMES DOES AN APPLICATION USE ? * FILE 094 //* WAS A CERTAIN DATASET USED LAST WEEKEND ? * FILE 094 //* * FILE 094 > > Lizette, > > Probably My email didn't explained much. Yes I want to see who Updated or deleted or > inserted obviously in Z/OS(Not in anyother Open platform). > > Unfortunately Our shop is not having a tool like SAS or MXG otherwise I would have > exploited MXG . > > Yes I am good at REXX , COBOL, but I have not tried this similar activity before, but > just a pointer or a hint would help me in performing the stuff.... > > Peter > > On Fri, Jun 29, 2012 at 1:27 PM, Lizette Koehler <[email protected]>wrote: > > > > I am in a process of tracking the changes made to VSAM. Just went on > > > with > > a basic > > > research on performing a audit trail on VSAM and found the below > > information like > > > > > > "Type 60 records updates to the VSAM volume Dataset (VVDS). Updates > > > are > > recorded > > > as INSERTED, DELETED or UPDATED. As SMS puts NVR entries into the > > > VVDS > > for > > non- > > > VSAM files, this can give you comprehensive audit activity for who > > > has > > been creating, > > > deleting and updating files. Some of the information this record > > > provides > > is date, time, > > > jobname, action, filename, volume(s), catalog, sms classes and > > > newname if appropriate. > > > Type 61/65/66 -- These all involve IDCAMS VSAM processing. Type 61 > > > is a > > DEFINE, > > > Type 65 is a DELETE and Type 66 is an ALTER. > > > Type62/64 -- These records relate to VSAM component or cluster > > processing. > > > Type 62 is for a cluster open, and type 64 for a cluster close or > > > volume > > switch. The > > > records include the catalog and volumes that relate to the cluster, > > > the > > date and time > > > the cluster was opened, and the job name. The type 64 record also > > contains > > > information about SMB, NSR and LSR usage." > > > > > > Does anyone have a proven sample JCL to track the VSAM changes ? > > Meanwhile > > I am > > > checking in Fine Manual for a similar Samples. > > > > > > This could really help me in accomplishing my Proof Of Concept. > > > > > > > It will depend on what you have available to you. > > Do you have SAS and MXG or MICS? > > Do you have programming skills in Assembler Language, COBOL, REXX, etc? > > > > What information do you need from the SMF Records? What kind of an > > audit are you wanting to do? Do you just want to know who touched a > > VSAM dataset or do you need to know what inside the VSAM dataset was > > touched? Are there any DB2 files involved or just native VSAM? > > > > What level of the z/OS Operating system are you at? > > > > What kind of a Proof of concept are you doing? Is this for a specific > > product? > > > > These answers can help us to help you. > > > > Lizette ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
