Logging successful attempts was Re: IBM-MAIN Digest - 13 Apr 2008 to 14 Apr 2008 (#2008-105)
On 15 Apr 2008 06:56:28 -0700, in bit.listserv.ibm-main you wrote: On Mon, 14 Apr 2008 17:01:51 -0700, Skip Robinson wrote: -- Date:Mon, 14 Apr 2008 17:01:51 -0700 From:Skip Robinson [EMAIL PROTECTED] Subject: Re: SMF in System Logger In the absence of CF Sizer assistance ;-( I looked at the samples from IBM and thought they seemed awfully big. A structures occupies dedicated real storage, after all; I tend to be stingy with it. After consulting with our SMF data caretaker who saw no obvious advantage is splitting records at the collection point, I set up only a single CF structure like this that captures all records: STRUCTURE NAME(IFASMF_DEFAULT) /* SMF structure for unspecified types */ INITSIZE(1) SIZE(5) Despite occasional IXC585E 'structure full' messages, I haven't increased it from the INITSIZE value. This structure supports only one system. Another member is 1.7 (no can do), and the third is also 1.9 but a 'bronze-plex' member that does not share DASD. Haven't quite figured out how handle that puppy yet. An interesting quirk I just noticed: most (for today, all!) IXC585E messages are being issued by the other 1.9 member, which still uses MANx recording. No messages on the 1.7 guy or on the guy actually using System Logger. We have several non-parallel-sysplex systems that are candidates for DASD-only logging but haven't ventured down that road as yet. Book says it works. We're looking at multiple structures to accommodate the heavy hitters. In our shop, DB/2, the occasional (all right, frequent) CICS looper, and the fact that Audit wants us to log all access attempts to production datasets including successful attempts has caused us in the past to lose SMF data. We may adjust up or down based on our experiences. Already I've dropped the system specific structures I mentioned in an earlier post in favor of SYSPLEX versions. I take your point though and it may be overkill but I may have to prove it to our Capacity folks. If you are capturing the type 14, 15, and 6x records anyway, could you turn off logging the RACF successful attempts to SMF because you have the successful use in the regular SMF data? Clark Morris -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: IBM-MAIN Digest - 13 Apr 2008 to 14 Apr 2008 (#2008-105)
On Mon, 14 Apr 2008 17:01:51 -0700, Skip Robinson wrote: -- Date:Mon, 14 Apr 2008 17:01:51 -0700 From:Skip Robinson [EMAIL PROTECTED] Subject: Re: SMF in System Logger In the absence of CF Sizer assistance ;-( I looked at the samples from IBM and thought they seemed awfully big. A structures occupies dedicated real storage, after all; I tend to be stingy with it. After consulting with our SMF data caretaker who saw no obvious advantage is splitting records at the collection point, I set up only a single CF structure like this that captures all records: STRUCTURE NAME(IFASMF_DEFAULT) /* SMF structure for unspecified types */ INITSIZE(1) SIZE(5) Despite occasional IXC585E 'structure full' messages, I haven't increased it from the INITSIZE value. This structure supports only one system. Another member is 1.7 (no can do), and the third is also 1.9 but a 'bronze-plex' member that does not share DASD. Haven't quite figured out how handle that puppy yet. An interesting quirk I just noticed: most (for today, all!) IXC585E messages are being issued by the other 1.9 member, which still uses MANx recording. No messages on the 1.7 guy or on the guy actually using System Logger. We have several non-parallel-sysplex systems that are candidates for DASD-only logging but haven't ventured down that road as yet. Book says it works. We're looking at multiple structures to accommodate the heavy hitters. In our shop, DB/2, the occasional (all right, frequent) CICS looper, and the fact that Audit wants us to log all access attempts to production datasets including successful attempts has caused us in the past to lose SMF data. We may adjust up or down based on our experiences. Already I've dropped the system specific structures I mentioned in an earlier post in favor of SYSPLEX versions. I take your point though and it may be overkill but I may have to prove it to our Capacity folks. The information contained in this message may be CONFIDENTIAL and is for the intended addressee only. Any unauthorized use, dissemination of the information, or copying of this message is prohibited. If you are not the intended addressee, please notify the sender immediately and delete this message. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
