SMF 100-102 record extract by RACFID

Art McEwen

SMF 100-102 record extract by RACFID
Hi listers,

I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don't suppose the RACFID is in a fixed location that I could filter out with a sort utility?

Thanks,

Art McEwen

Sr DBA, Database & Mainframe Support
Health Solutions Delivery Br.
Health Services Cluster
4th flr, 49 Place d'Armes
Kingston ON K7L 5J3

[login to unmask email]<mailto:[login to unmask email]>

Office 613-548-6622
Cell 613-539-3903

Venkat Srinivasan

RE: SMF 100-102 record extract by RACFID
(in response to Art McEwen)

RACFID does not apply to smf type 100 as it is a statistics record and there is no value to RACFID per se. There is a value if looking at specific accounting smf 101 and some 102s (eg audit) based on authorization ids. Generally activity done under the covers or activity that cannot be attributed to end user will be assigned sysopr.

The Correlation header mapping QWHCOPID / QWHCAID can be probed and you need a sort e15 type exit. e15 is pre sort and e35 is post sort.

An example of which I posted on the thread titled "DB2 for z/OS V11 NFM ifcid 376 vs 366" on july 21 2016. You should be able to use the search facility and locate the thread.

Venkat
 
In Reply to Art McEwen:

Hi listers,

I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don't suppose the RACFID is in a fixed location that I could filter out with a sort utility?

Thanks,

Art McEwen

Sr DBA, Database & Mainframe Support
Health Solutions Delivery Br.
Health Services Cluster
4th flr, 49 Place d'Armes
Kingston ON K7L 5J3

[login to unmask email]<mailto:[login to unmask email]>

Office 613-548-6622
Cell 613-539-3903

Art McEwen

RE: SMF 100-102 record extract by RACFID
(in response to Venkat Srinivasan)

Thanks!

Lizette Koehler

SMF 100-102 record extract by RACFID
(in response to Art McEwen)

What specifically are you trying to do?  If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email]"
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID?   Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA,  Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON  K7L 5J3 [login to unmask email] Office 613-548-6622Cell     613-539-3903
Site Links: View post online   View mailing list online   Start new thread via email   Unsubscribe from this mailing list   Manage your subscription  

This email has been sent to: [login to unmask email]
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 <---
http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2

Art McEwen

RE: SMF 100-102 record extract by RACFID
(in response to Lizette Koehler)

I'm trying to pull 1 users query out of the SMF logs, in this case I know the approximate time so it's not strictly required but next time I might not have that time range.     SAS/MICS do you mean the CA reporting tool or SAS?

 

Cheers,

Art.

In Reply to Lizette Koehler:


What specifically are you trying to do?  If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email]"
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID?   Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA,  Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON  K7L 5J3 [login to unmask email] Office 613-548-6622Cell     613-539-3903
Site Links: View post online   View mailing list online   Start new thread via email   Unsubscribe from this mailing list   Manage your subscription  

This email has been sent to: [login to unmask email]
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2

Lizette Koehler

SMF 100-102 record extract by RACFID
(in response to Art McEwen)
So CA MICS uses SAS, MXG (Dr. Merrill) uses SAS.



Both format the DB2 records for analysis. So if you have either product, (SAS+MICS or SAS+MXG) you may already have the ability to do some reporting.



Lizette





From: Art McEwen [mailto:[login to unmask email]
Sent: Tuesday, April 11, 2017 6:13 AM
To: [login to unmask email]
Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID



I'm trying to pull 1 users query out of the SMF logs, in this case I know the approximate time so it's not strictly required but next time I might not have that time range. SAS/MICS do you mean the CA reporting tool or SAS?



Cheers,

Art.

In Reply to Lizette Koehler:


What specifically are you trying to do? If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email] <mailto:[login to unmask email]> "
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA, Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON K7L 5J3 [login to unmask email] <mailto:[login to unmask email]> Office 613-548-6622Cell 613-539-3903
Site Links: View post online View mailing list online Start new thread via email Unsubscribe from this mailing list Manage your subscription

This email has been sent to: [login to unmask email] <mailto:[login to unmask email]>
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2



-----End Original Message-----

Art McEwen

RE: SMF 100-102 record extract by RACFID
(in response to Lizette Koehler)

Thanks, it's not the formatting that's the issue, it's the isolating.

In Reply to Lizette Koehler:

So CA MICS uses SAS, MXG (Dr. Merrill) uses SAS.



Both format the DB2 records for analysis. So if you have either product, (SAS+MICS or SAS+MXG) you may already have the ability to do some reporting.



Lizette





From: Art McEwen [mailto:[login to unmask email]
Sent: Tuesday, April 11, 2017 6:13 AM
To: [login to unmask email]
Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID



I'm trying to pull 1 users query out of the SMF logs, in this case I know the approximate time so it's not strictly required but next time I might not have that time range. SAS/MICS do you mean the CA reporting tool or SAS?



Cheers,

Art.

In Reply to Lizette Koehler:


What specifically are you trying to do? If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email] <mailto:[login to unmask email]> "
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA, Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON K7L 5J3 [login to unmask email] <mailto:[login to unmask email]> Office 613-548-6622Cell 613-539-3903
Site Links: View post online View mailing list online Start new thread via email Unsubscribe from this mailing list Manage your subscription

This email has been sent to: [login to unmask email] <mailto:[login to unmask email]>
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2



-----End Original Message-----

Charles Mills

SMF 100-102 record extract by RACFID
(in response to Art McEwen)
DB2 SMF records are significantly subdivided by IFCID, essentially a subtype. There is a little information on what each IFCID contains in the performance (?) manual, and a lot in the DSNWMSGS  (?) member in the samplib.
You are not recording all IFCIDs so the information you want may not even be recorded. See the command manual START TRACE for how to turn on the IFCID you want.

CharlesSent from a mobile; please excuse the brevity.
-------- Original message --------From: Art McEwen <[login to unmask email]> Date: 4/11/17 11:33 AM (GMT-04:00) To: [login to unmask email] Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID
Thanks, it's not the formatting that's the issue, it's the isolating.

In Reply to Lizette Koehler:
So CA MICS uses SAS, MXG (Dr. Merrill) uses SAS.



Both format the DB2 records for analysis. So if you have either product, (SAS+MICS or SAS+MXG) you may already have the ability to do some reporting.



Lizette





From: Art McEwen [mailto:[login to unmask email]
Sent: Tuesday, April 11, 2017 6:13 AM
To: [login to unmask email]
Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID



I'm trying to pull 1 users query out of the SMF logs, in this case I know the approximate time so it's not strictly required but next time I might not have that time range. SAS/MICS do you mean the CA reporting tool or SAS?



Cheers,

Art.

In Reply to Lizette Koehler:


What specifically are you trying to do? If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email] <mailto:[login to unmask email]> "
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA, Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON K7L 5J3 [login to unmask email] <mailto:[login to unmask email]> Office 613-548-6622Cell 613-539-3903
Site Links: View post online View mailing list online Start new thread via email Unsubscribe from this mailing list Manage your subscription

This email has been sent to: [login to unmask email] <mailto:[login to unmask email]>
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2



-----End Original Message-----


Site Links:
View post online  
View mailing list online  
Start new thread via email  
Unsubscribe from this mailing list  
Manage your subscription  


This email has been sent to: [login to unmask email]

** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **

---> Anaheim, California, May 1 - May 2, 2017 <---

http://www.idug.org/page/dts2017



Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2

Art McEwen

RE: SMF 100-102 record extract by RACFID
(in response to Charles Mills)

The information I want is recorded, I'm just trying to isolate it down to specific users/queries for easy after the fact reporting.

In Reply to Charles Mills:

DB2 SMF records are significantly subdivided by IFCID, essentially a subtype. There is a little information on what each IFCID contains in the performance (?) manual, and a lot in the DSNWMSGS  (?) member in the samplib.
You are not recording all IFCIDs so the information you want may not even be recorded. See the command manual START TRACE for how to turn on the IFCID you want.

CharlesSent from a mobile; please excuse the brevity.
-------- Original message --------From: Art McEwen <[login to unmask email]> Date: 4/11/17 11:33 AM (GMT-04:00) To: [login to unmask email] Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID
Thanks, it's not the formatting that's the issue, it's the isolating.

In Reply to Lizette Koehler:
So CA MICS uses SAS, MXG (Dr. Merrill) uses SAS.



Both format the DB2 records for analysis. So if you have either product, (SAS+MICS or SAS+MXG) you may already have the ability to do some reporting.



Lizette





From: Art McEwen [mailto:[login to unmask email]
Sent: Tuesday, April 11, 2017 6:13 AM
To: [login to unmask email]
Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID



I'm trying to pull 1 users query out of the SMF logs, in this case I know the approximate time so it's not strictly required but next time I might not have that time range. SAS/MICS do you mean the CA reporting tool or SAS?



Cheers,

Art.

In Reply to Lizette Koehler:


What specifically are you trying to do? If there is more detail on what type of reporting you are trying to do, we might be able to provide a more targeted answer.

If you have SAS/MICS or SAS/MXG - there could be the facility in there already.

Lizette

-----Original Message-----
From: "McEwen, Art (MOHLTC)"
Sent: Apr 7, 2017 11:51 AM
To: "[login to unmask email] <mailto:[login to unmask email]> "
Subject: [DB2-L] - SMF 100-102 record extract by RACFID

Hi listers, I can pull out individual record types from SMF with IFASMFDP, do you know if IBM provides anything that will allow me to narrow that down to a specific RACF ID? Failing that I don’t suppose the RACFID is in a fixed location that I could filter out with a sort utility? Thanks, Art McEwen Sr DBA, Database & Mainframe SupportHealth Solutions Delivery Br.Health Services Cluster4th flr, 49 Place d'ArmesKingston ON K7L 5J3 [login to unmask email] <mailto:[login to unmask email]> Office 613-548-6622Cell 613-539-3903
Site Links: View post online View mailing list online Start new thread via email Unsubscribe from this mailing list Manage your subscription

This email has been sent to: [login to unmask email] <mailto:[login to unmask email]>
** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **
---> Anaheim, California, May 1 - May 2, 2017 http://www.idug.org/page/dts2017


Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2



-----End Original Message-----


Site Links:
View post online  
View mailing list online  
Start new thread via email  
Unsubscribe from this mailing list  
Manage your subscription  


This email has been sent to: [login to unmask email]

** ** ** Attend the 2017 IDUG Data Tech Summit ** ** **

---> Anaheim, California, May 1 - May 2, 2017 <---

http://www.idug.org/page/dts2017



Use of this email content is governed by the terms of service at:
http://www.idug.org/p/cm/ld/fid=2

Lizette Koehler

SMF 100-102 record extract by RACFID
(in response to Art McEwen)
You may need a product to read the IFCID data that is in the SMF record.


Do you have a tool?



Just dumping the SMF RAW record will not naturally indicate it is what you want to review.



Are you sure you were running the right IFCID for what you are trying to review? If so, let us know what IFCID you were capturing the data. It will make it easier to know if that will answer your question.



And what question are you trying to answer?



Lizette





From: Art McEwen [mailto:[login to unmask email]
Sent: Tuesday, April 11, 2017 11:53 AM
To: [login to unmask email]
Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID



The information I want is recorded, I'm just trying to isolate it down to specific users/queries for easy after the fact reporting.

In Reply to Charles Mills:

DB2 SMF records are significantly subdivided by IFCID, essentially a subtype. There is a little information on what each IFCID contains in the performance (?) manual, and a lot in the DSNWMSGS (?) member in the samplib.
You are not recording all IFCIDs so the information you want may not even be recorded. See the command manual START TRACE for how to turn on the IFCID you want.

CharlesSent from a mobile; please excuse the brevity.
-------- Original message --------From: Art McEwen Date: 4/11/17 11:33 AM (GMT-04:00) To: [login to unmask email] <mailto:[login to unmask email]> Subject: [DB2-L] - RE: SMF 100-102 record extract by RACFID
Thanks, it's not the formatting that's the issue, it's the isolating.