Thanks @Scott and @Elardus.

I have submitted an RCF and copied @Scott.

@Elardus -- don't forget IEFU86.

> due to security and integrity of the SMF records themselves, IBM is not 
> talking much about it.

Security by obscurity?

Charles

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Elardus Engelbrecht
Sent: Wednesday, June 12, 2019 5:39 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: What happens if an SMF exit modifies the SMF record?

Charles Mills wrote:

>What happens if an SMF exit modifies the SMF record? Do the next exit in the 
>chain, SYS1.MANx and/or the stream see the modified record, or is the exit 
>only modifying a "private copy" of the SMF record?

It should be able to do that provided the SMF exit is getting the address 
(fullword) of the SMF record in register 1. Each SMF record is passed to an 
installation exit (either IEFU83, IEFU84, or IEFU85) before it is written to 
the SMF data set. But there is one catch, Inside the SMF exit, you cannot use 
the SMFWTM or SMFEWTM macro to write to the SMF data set, because the exits are 
called by SMFWTM/SMFEWTM.

Of course, SMF records needed to be collected and then written out instead of 
being suppressed by the exits themselves.

Cheryl Watson and Frank Kyne once wrote in November 2014 this:

"An application would pass a record to SMF using the SMFWTM macro, and SMF 
would call IEFU83 with the record. The exit could choose to delete the record, 
modify it or perform some action based on the record’s contents. "

(From: 
http://enterprisesystemsmedia.com/article/smf-exits-and-the-life-of-a-job )


>It would seem to me to be an important point, and the documentation is pretty 
>much silent (or I am visually challenged). However, I tend to interpret "Word 
>1: The address of the record that SMF is to write" as implying that there is 
>only a single copy that will get passed on down the line.

Your interpretation is correct, but strangely just like you and Scott 
Ballentine, I also don't see it documented specifically that your SMF exits can 
modify a record all the way from one exit to other until it is finally written 
out to the SMF VSAM datasets.

I believe the reason is that due to security and integrity of the SMF records 
themselves, IBM is not talking much about it. 

For IEFACTRT, I see this note: 

"When the data for an SMF record exceeds 32,756 bytes in length, the system 
constructs one or more "continuation" or "additional" records to ensure that no 
individual record exceeds that length. The system invokes IEFACTRT once for the 
original record and once for each continuation record."

So, I believe SMF records can be changed many times until it is written out 
finally.


>I will submit an RCF once I get a definitive answer here.

Please do so.

Groete / Greetings
Elardus Engelbrecht

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Reply via email to