Extracting SMF Records to find the userid who deleted a dataset
On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
Vijay, I would use SMF DUMP (IFASMPDP) and just dump the SMF record I wanted. If you have sas you can then filter through the SMF record for that data set. The SMF Manual is very good to show you how to dump specific records. Or if you have DFSORT, I think there may be some control cards built for a DFSORT process to do this. Lizette -Original Message- From: vijay raj [EMAIL PROTECTED] Sent: Dec 13, 2007 11:51 AM To: IBM-MAIN@BAMA.UA.EDU Subject: Extracting SMF Records to find the userid who deleted a dataset On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
vijay raj wrote: On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay Go to www.cbttape.org and download File 094: DAF from Mike Cleary - Dataset Audit Facility -- Mark Jacobs Time Customer Service Tampa, FL -- The primary purpose of the DATA statement is to give names to constants; instead of referring to pi as 3.141592653589793 at every appearance, the variable PI can be given that value with a DATA statement and used instead of the longer form of the constant. This also simplifies modifying the program, should the value of pi change. - FORTRAN manual for Xerox computers -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
snip On one of our account, a production dataset is deleted snip A simple SAS routine will do the trick too. But i would also include SMF18, SMF65 and SMF66. In general i check SMF14,15,17,18,60-66 although the VSAM SMF6x aren't too useful. Jack Kelly 202-502-2390 (Office) -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
You can try this //SORT EXEC PGM=SORT,REGION=5000K //SYSPRINT DD SYSOUT=* //SYSOUT DD SYSOUT=* //SORTIN DD DISP=SHR,DSN=inputsmf //SORTOUT DD DISP=(NEW,PASS),DSN=TEMP, // SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG //SYSINDD * SORT FIELDS=COPY INCLUDE COND=(6,1,BI,EQ,X'11',, 45,44,CH,EQ, C'deleted.dsn ') OPTION VLSHRT /* //PRINTEXEC PGM=IDCAMS //IN1 DD DISP=(OLD,PASS),DSN=TEMP //SYSPRINT DD SYSOUT=* //SYSINDD * PRINT INFILE(IN1) DUMP /* Type 17 is pretty easy becaue the dsn is part of the header so you know the offset in each record. Some other smf record types are not so simple because you need to use the triplet for the offset to the section that had the data. Also, I used a length of 44 for the dsn field. If your dsn is less tan 44, you can shorten the length and get rid of the trailing blanks. Have a nice day, Dave Betten DFSORT Development, Performance Lead IBM Corporation email: [EMAIL PROTECTED] DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/ IBM Mainframe Discussion List IBM-MAIN@BAMA.UA.EDU wrote on 12/13/2007 11:51:04 AM: On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
There is a freebe on the CBTTAPE.ORG called DAF... this will do everything you should need. Ed On Dec 13, 2007, at 10:51 AM, vijay raj wrote: On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
Frank Yaeger just pointed out to me that the trailing blanks are not necessary since DFSORT will pad the constant on the right with blanks to the length of the field. So you can just code it like this //SORT EXEC PGM=SORT,REGION=5000K //SYSPRINT DD SYSOUT=* //SYSOUT DD SYSOUT=* //SORTIN DD DISP=SHR,DSN=inputsmf //SORTOUT DD DISP=(NEW,PASS),DSN=TEMP, // SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG //SYSINDD * SORT FIELDS=COPY INCLUDE COND=(6,1,BI,EQ,X'11',, 45,44,CH,EQ, C'deleted.dsn') OPTION VLSHRT /* //PRINTEXEC PGM=IDCAMS //IN1 DD DISP=(OLD,PASS),DSN=TEMP //SYSPRINT DD SYSOUT=* //SYSINDD * PRINT INFILE(IN1) DUMP /* Have a nice day, Dave Betten DFSORT Development, Performance Lead IBM Corporation email: [EMAIL PROTECTED] DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/ IBM Mainframe Discussion List IBM-MAIN@BAMA.UA.EDU wrote on 12/13/2007 12:45:18 PM: You can try this //SORT EXEC PGM=SORT,REGION=5000K //SYSPRINT DD SYSOUT=* //SYSOUT DD SYSOUT=* //SORTIN DD DISP=SHR,DSN=inputsmf //SORTOUT DD DISP=(NEW,PASS),DSN=TEMP, // SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG //SYSINDD * SORT FIELDS=COPY INCLUDE COND=(6,1,BI,EQ,X'11',, 45,44,CH,EQ, C'deleted.dsn ') OPTION VLSHRT /* //PRINTEXEC PGM=IDCAMS //IN1 DD DISP=(OLD,PASS),DSN=TEMP //SYSPRINT DD SYSOUT=* //SYSINDD * PRINT INFILE(IN1) DUMP /* Type 17 is pretty easy becaue the dsn is part of the header so you know the offset in each record. Some other smf record types are not so simple because you need to use the triplet for the offset to the section that had the data. Also, I used a length of 44 for the dsn field. If your dsn is less tan 44, you can shorten the length and get rid of the trailing blanks. Have a nice day, Dave Betten DFSORT Development, Performance Lead IBM Corporation email: [EMAIL PROTECTED] DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/ IBM Mainframe Discussion List IBM-MAIN@BAMA.UA.EDU wrote on 12/13/2007 11:51:04 AM: On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
---snip On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. --unsnip-- You need the Dataset Monitor tool from the CBT tape (www.cbttape.org) . It processes SMF data to give you exactly what you're looking for. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Extracting SMF Records to find the userid who deleted a dataset
Thanks - Original Message - Thanks David and all who replied. Thanks - Original Message From: David Betten [EMAIL PROTECTED] To: IBM-MAIN@BAMA.UA.EDU Sent: Thursday, 13 December, 2007 11:15:18 PM Subject: Re: Extracting SMF Records to find the userid who deleted a dataset You can try this //SORT EXEC PGM=SORT,REGION=5000K //SYSPRINT DD SYSOUT=* //SYSOUT DD SYSOUT=* //SORTIN DD DISP=SHR,DSN=inputsmf //SORTOUT DD DISP=(NEW,PASS),DSN=TEMP, //SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG //SYSINDD * SORT FIELDS=COPY INCLUDE COND=(6,1,BI,EQ,X'11',, 45,44,CH,EQ, C'deleted.dsn') OPTION VLSHRT /* //PRINTEXEC PGM=IDCAMS //IN1 DD DISP=(OLD,PASS),DSN=TEMP //SYSPRINT DD SYSOUT=* //SYSINDD * PRINT INFILE(IN1) DUMP /* Type 17 is pretty easy becaue the dsn is part of the header so you know the offset in each record. Some other smf record types are not so simple because you need to use the triplet for the offset to the section that had the data. Also, I used a length of 44 for the dsn field. If your dsn is less tan 44, you can shorten the length and get rid of the trailing blanks. Have a nice day, Dave Betten DFSORT Development, Performance Lead IBM Corporation email: [EMAIL PROTECTED] DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/ IBM Mainframe Discussion List IBM-MAIN@BAMA.UA.EDU wrote on 12/13/2007 11:51:04 AM: On one of our account, a production dataset is deleted. We Greetings, On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it. Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid. Any help is greatly appreciated. Thanks Vijay 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html Get the freedom to save as many mails as you wish. To know how, go to http://help.yahoo..com/l/in/yahoo/mail/yahoomail/tools/tools-08.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
