Just a stab but maybe the below applies....
Record Type 7 (07) - Data Lost z/OS V1R12.0 MVS System Management Facilities (SMF) SA22-7630-22 If all SMF buffers become full (either a result of no available output data sets for SMF to write to OR the system generating records at a rate faster than SMF can physically write them), SMF data will be lost. When this condition occurs, record type 7 tracks the number of lost records. It contains a count of the SMF records that were not written and the start and end times of the period when data was lost. (The end time is the time recorded in SMF7TME at offset 6). Record type 7 is not built until SMF buffers become available again. Data existing in the SMF buffer, prior to data lost, is written to available SMF data sets before record type 7 is written to a data set. -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Greg Shirey Sent: Wednesday, August 07, 2013 12:33 PM To: [email protected] Subject: RACF User ID resumed without an SMF record? Hello group, Does anyone know of a method to resume a RACF revoked ID without having an SMF record be written? We produce a daily listing of RACF commands from our SMF type 80s (using RACFRW) and we list ADDUSER ADDGROUP ALTUSER ALTGROUP CONNECT DELUSER DELGROUP PASSWORD PERMIT RALTER RDEFINE REMOVE. We also produce a daily listing of our CICS user IDs and their RACF status. On July 8 we had a user ID on our report that was listed as REVOKED and a LAST-ACCESS date and time of 07/17/07 17:01:28. On July 9, the report showed the ID was no longer revoked and the LAST-ACCESS reported as 07/08/13 19:24:14. However, our SMF report listed no ALTUSER command or any other command against this ID. (No DELUSER or ADDUSER, for instance). I dumped the SMF records for both July 7 and July 8 and ran a RACFRW to list all the records and there is no reference to this User ID. I'm a sysprog, so I can't blame it on magic or elves - I could try blaming it on the software, but I'm finding that hard to believe - so I have to think there's something I'm missing. I've just looked at everything I know to look at. (Did someone modify SMF for a period? No. Does the COBOL program that lists the RACF users have a bug in it? No.) If anyone has a suggestion for what to look for, I'd appreciate hearing about it. Thanks, Greg Shirey Ben E. Keith Company ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
