MXG creates a SUBTYPE for the many SMF records that contain a logical subtype that is not contained in the standard SMF Header, including fields like the SMF 80 RACF EVENT Code and the SMF 100-102 DB2 IFCID value.
Barry Merrilly yours, Herbert W. Barry Merrill, PhD President-Programmer Merrill Consultants MXG Software 10717 Cromwell Drive technical questions: [email protected] Dallas, TX 75229 http://www.mxg.com admin questions: [email protected] tel: 214 351 1966 fax: 214 350 3694 -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Robert S. Hansel (RSH) Sent: Thursday, December 28, 2017 6:12 AM To: [email protected] Subject: Re: How to find what performed an OMVS unmount? Peter, The type 80 record doesn't have subtypes. 55 is an event code, and event code is a field in the 80 record. I do not know if MXG is aware of and can select records based on type 80 event codes. If your RACF team converts SMF 80 records to text format using RACF's SMF unload utility, you can try searching the unload file for UMNTFSYS events - the text equivalent of event code 55. Various RACF auditing options determine whether such an event would be logged, and such options may not have been in effect when the event occurred, hence no record. Since the NOTYPE ranges do not exclude 80 records, you are correct that they are being collected. Also look for SUBSYS settings that might be excluding them for certain subsystems. Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. *** Celebrating our 25th Year *** 617-969-8211 www.linkedin.com/in/roberthansel http://twitter.com/RSH_RACF www.rshconsulting.com -----Original Message----- Date: Wed, 27 Dec 2017 13:03:41 -0600 From: Peter Ten Eyck <[email protected]> Subject: Re: How to find what performed an OMVS unmount? Thanks for the suggestion on this topic. I have discovered that the LPAR that this un-mount occurred on does not cut type 92 (USS) records so I will be unable to use them to figure what un-mounted my file. Setting: SYS(NOTYPE(16:19,62:69,92) With the help of MXG staff, I was able to run a MXG report looking for type 80 (RACF) sub type 55 records, I did not find any. To me this means that either there were no un-mounts during the time period of the input or no sub type 55 records are cut. Is the above setting what controls the sub type records cut? Type 80 is not excluded so it’s being cut, is the default all 80 sub types? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
