Hello,

we've received C2P0337W messages: HISTORY data lost, increase bufnum and/or bufsize
The recommendation by the explanation is to increase the number of buffers or the bufsize to prevent data loss.

I don't actually have an idea which buffers or parameters I must adjust or increase . Is there a any suitable config parm to be adjusted or
can this be managed in JCL of the started task (region size or whatever) ?

Perhaps I've overlooked a topic in the zAlert manuals . 

Best Regards
Rüdiger Lukas
   



------------------------------
Ruediger Lukas
------------------------------

Hi Rüdiger,

There is a discussion of the buffers in the Alert book, Chapter 2 "zSecure Alert configuration", section "Configuration guidelines and performance implications", subsection "Buffers".

In section "Configuring zSecure Alert", you can see under "Alert configuration: specify general settings" in Figure 5 "Setup Alert panel: Copying the default zSecure Alert configuration" that there are parameters "Buffer size" and "Number of buffers". In the following description of those parameters, you can read that these correspond to OPTION BUFSIZE or BUFSIZEMB and OPTION NUMBUFS, and there is a pointer to the Installation book for a further description of the OPTION command.

In the Installation and Deployment Guide you can find the pertinent information in Chapter 12 "Setup of zSecure Alert" in the subsections "Configuration guidelines and performance implications" and "Other commands" - "OPTION command".

I hope this helps,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
Delft
------------------------------

Hi Jeroen,

many thanks for your hints and explanation . Yes, it helps .
I looked at our configuration and I found the parameters I've recently overlooked  .
Our zAlert is set up with 
Buffer size . . . . . . 16384 KB
Number of buffers . . . 32
I guess we've implemented the "maximum" values regarding the manuals and I assume that we can't increase them or am I wrong anyhow ?

Best regards
Rüdiger

------------------------------
Ruediger Lukas
------------------------------

Original Message:
Sent: Mon December 06, 2021 02:54 AM
From: Jeroen Tiggelman
Subject: How to handle message C2P0337W

Hi Rüdiger,

There is a discussion of the buffers in the Alert book, Chapter 2 "zSecure Alert configuration", section "Configuration guidelines and performance implications", subsection "Buffers".

In section "Configuring zSecure Alert", you can see under "Alert configuration: specify general settings" in Figure 5 "Setup Alert panel: Copying the default zSecure Alert configuration" that there are parameters "Buffer size" and "Number of buffers". In the following description of those parameters, you can read that these correspond to OPTION BUFSIZE or BUFSIZEMB and OPTION NUMBUFS, and there is a pointer to the Installation book for a further description of the OPTION command.

In the Installation and Deployment Guide you can find the pertinent information in Chapter 12 "Setup of zSecure Alert" in the subsections "Configuration guidelines and performance implications" and "Other commands" - "OPTION command".

I hope this helps,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
Delft
------------------------------

Hi rudiger,

you specified the value in KB but you can also specify it in MB which would increase the buffersize considerably :) But if you change it to MB make sure you pick a sensible value otherwise you will most likely run out of storage.

cheers

rene

------------------------------
RENE van TIL
------------------------------

Original Message:
Sent: Mon December 06, 2021 05:31 AM
From: Ruediger Lukas
Subject: How to handle message C2P0337W

Hi Jeroen,

many thanks for your hints and explanation . Yes, it helps .
I looked at our configuration and I found the parameters I've recently overlooked  .
Our zAlert is set up with 
Buffer size . . . . . . 16384 KB
Number of buffers . . . 32
I guess we've implemented the "maximum" values regarding the manuals and I assume that we can't increase them or am I wrong anyhow ?

Best regards
Rüdiger

------------------------------
Ruediger Lukas
------------------------------


Original Message:
Sent: Mon December 06, 2021 02:54 AM
From: Jeroen Tiggelman
Subject: How to handle message C2P0337W

Hi Rüdiger,

There is a discussion of the buffers in the Alert book, Chapter 2 "zSecure Alert configuration", section "Configuration guidelines and performance implications", subsection "Buffers".

In section "Configuring zSecure Alert", you can see under "Alert configuration: specify general settings" in Figure 5 "Setup Alert panel: Copying the default zSecure Alert configuration" that there are parameters "Buffer size" and "Number of buffers". In the following description of those parameters, you can read that these correspond to OPTION BUFSIZE or BUFSIZEMB and OPTION NUMBUFS, and there is a pointer to the Installation book for a further description of the OPTION command.

In the Installation and Deployment Guide you can find the pertinent information in Chapter 12 "Setup of zSecure Alert" in the subsections "Configuration guidelines and performance implications" and "Other commands" - "OPTION command".

I hope this helps,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
Delft

Hello Rene,

Perfect. This gives me an opportunity for an increasement .
I will check out how I can implement a suitable "MB" value for the buffersize parameter 
without running out of storage .

Many Thx and best regards
Rüdiger

------------------------------
Ruediger Lukas
------------------------------

Original Message:
Sent: Mon December 06, 2021 08:30 AM
From: RENE van TIL
Subject: How to handle message C2P0337W

Hi rudiger,

you specified the value in KB but you can also specify it in MB which would increase the buffersize considerably :) But if you change it to MB make sure you pick a sensible value otherwise you will most likely run out of storage.

cheers

rene

------------------------------
RENE van TIL
------------------------------


Original Message:
Sent: Mon December 06, 2021 05:31 AM
From: Ruediger Lukas
Subject: How to handle message C2P0337W

Hi Jeroen,

many thanks for your hints and explanation . Yes, it helps .
I looked at our configuration and I found the parameters I've recently overlooked  .
Our zAlert is set up with 
Buffer size . . . . . . 16384 KB
Number of buffers . . . 32
I guess we've implemented the "maximum" values regarding the manuals and I assume that we can't increase them or am I wrong anyhow ?

Best regards
Rüdiger

------------------------------
Ruediger Lukas


Original Message:
Sent: Mon December 06, 2021 02:54 AM
From: Jeroen Tiggelman
Subject: How to handle message C2P0337W

Hi Rüdiger,

There is a discussion of the buffers in the Alert book, Chapter 2 "zSecure Alert configuration", section "Configuration guidelines and performance implications", subsection "Buffers".

In section "Configuring zSecure Alert", you can see under "Alert configuration: specify general settings" in Figure 5 "Setup Alert panel: Copying the default zSecure Alert configuration" that there are parameters "Buffer size" and "Number of buffers". In the following description of those parameters, you can read that these correspond to OPTION BUFSIZE or BUFSIZEMB and OPTION NUMBUFS, and there is a pointer to the Installation book for a further description of the OPTION command.

In the Installation and Deployment Guide you can find the pertinent information in Chapter 12 "Setup of zSecure Alert" in the subsections "Configuration guidelines and performance implications" and "Other commands" - "OPTION command".

I hope this helps,

------------------------------
Jeroen Tiggelman
Software Development and Level 3 Support Manager IBM Security zSecure Suite
IBM
Delft

Hi rudiger,

the definition of the number of buffers and the size of them is defined as part of the Set that the Alert started task is using. If you start the Alert UI (SE.A.A) that set is the one with "Y" in column Act. If you edit that set with a line command E it will show you the parameters for Alert including the number and size of the buffers.

The defaults are 1024Kb for the size and 10 of these buffers are created. I guess these values havent been changed. I would start with increasing the bufsize as 1Mb is rather small.

If they are allready much larger then you might want to have a look at the actual number of number of SMF records produced during an interval and then do some of the math described in Chapter 12 of the installation & deployment guide. Or simply increase the size/number and keep an eye on the "C2P0108I BufUsed" message that the Alert started task shows but bear in mind that there might be much higher peak values.

Which SMF records alert collects can be easily determined by looking at the Alert started task. A display is issued regularly and it shows one or more C2P0115I messages saying what SMF records are being collected.

cheers

rene



------------------------------
RENE van TIL
------------------------------