In general, you have to rely on a hex dump of a few of the user SMF records, to look for obvious fields and contents, and ask your SYSPROGs/DBAs etc, what products are installed. Sometimes there is a SUBSYSTEM ID that identifies the creator in bytes 15-18. You can identify lots of EBCDIC text fields by content and length, like the JOB, USERID, JCTJOBID, 44-byte DSNAMES, RACFGRUP names, the SMFSTAMP and TODSTAMP datetime fields, and along with asking what products are installed, you can often identify the creator and find the SYSPROG who chose that SMF record type to confirm!
But often the final identification requires visual examination of the record's hex dump, and to count the recognizable elements (e.g., 2 DSNAMEs, 3 TODSTAMP, 2 SMFSTAMP, JOB JCTJOBID), and then examine a possible product's source member in MXG to count those same elements in the SAS INPUT statements to find a match, and then confirm by comparing field-by-field visually, or just by using that MXG code member to read the record. MXG has only 260 user SMF record members to examine. Barry Herbert W. “Barry” Merrill, PhD President-Programmer MXG Software Merrill Consultants 10717 Cromwell Drive Dallas, TX 75229-5112 ba...@mxg.com Fax: 214 350 3694 – Still works, received as email Tel: 214 351 1966 – Unreliable, please use email www.mxg.com HomePage: FAQ answers most questions ad...@mxg.com License Forms, Invoice, Payment, ftp information supp...@mxg.com Technical Issues MXG-L FREE ListServer http://www.mxg.com/mxg-l_listserver/ -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Lizette Koehler Sent: Friday, January 22, 2016 6:13 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Identifying creator of SMF records Alan, I think the better forum with be either the MICS Community on CA website or MXG.COM If you have SAS and MXG or SAS and MICS, one of them might have a cross reference or way to determine SMF details. I have usually maintained a text file in SYS1.PARMLIB that contains a list of either SVCs or SMF records for non IBM products. If you do not have that, then you may have to find another way. And I am not sure how that can be done if you do not have the ability to search any and all installation libraries for vendor products to see what pops up. Sometimes shops will use the defaults supplied by the Vendors and that will be documented in the vendors installation manual. So I would start with that. Lizette -----Original Message----- >From: "Field, Alan" <alan.fi...@bluecrossmn.com> >Sent: Jan 22, 2016 2:30 PM >To: IBM-MAIN@LISTSERV.UA.EDU >Subject: Identifying creator of SMF records > >Is there a way to identify what is creating user written SMF records? > >We have 210s, 230s and 254s that we can't identify the source. > >We've dumped the records and looked at them. Some give hints (e.g. the 230s >look like perhaps CA OpsMVS, the 254s perhaps something related to SAF). > >TIA > >Alan ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
