By file do you mean dataset or UNIX file? For a dataset: 1. Potentially an SMF Type 15. Type 15 would have to be enabled in SMFPRMxx. Potentially an SMF Type 80 (assuming RACF) if the dataset is audited.
2. Yes. Details would be different but it would still be an SMF Type 15. Potentially an SMF Type 80. For a UNIX file: 1. Potentially an SMF 92. Type 92 would have to be enabled in SMFPRMxx. I don't recall if RACF can audit USS file access. 2. Yes. Details would be different but it would still be an SMF Type 92. The above answers are for the access to the file or dataset. I am assuming you are referring to the receiving end. If the sending end is MVS, then same answers except SMF 15 becomes SMF 14. Other SMF records might also be cut: Job or TSO session start and end. Some SFTP implementations cut their own SMF records. Perhaps others. I know of no distinction in any SMF records for "the first time you do something" versus "re-doing it a little later." SMF records tend to stand on their own. SMF record cutting is essentially stateless. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Sasso, Leonard Sent: Tuesday, May 16, 2017 2:47 PM To: [email protected] Subject: SMF Records A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file. 1. What SMF Record Type was cut when the first file was transmitted? 2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
