IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Too many SMF data sets, not enough (virtual or real) tape units

  • 1.  Too many SMF data sets, not enough (virtual or real) tape units

    Posted 3 hours ago
    Edited by Rob van Hoboken 3 hours ago

    Auditor need a logon activity report for a user ID, for the whole year, the whole sysplex.  The installation uses monthly (virtual) tapes, one for each system.  Lucky for us, the tape data sets are in a GDG:

    SMF.sysid.MONTHLY(n)

    So we write our CARLa with

    alloc type=smf dsn=SMF.SYSA.MONTHLY(0)
    alloc type=smf dsn=SMF.SYSA.MONTHLY(-1)
    alloc type=smf dsn=SMF.SYSA.MONTHLY(-2)
    ...
    alloc type=smf dsn=SMF.SYSB.MONTHLY(0)
    alloc type=smf dsn=SMF.SYSB.MONTHLY(-1)
    alloc type=smf dsn=SMF.SYSB.MONTHLY(-2)
    ...

    6 systems, 11 months, batch job, submit.  ARGH.

    The job tries to allocate 66 virtual tape devices.  Seriously, can't it just read 1 tape at a time? 

    The CARLa syntax manual tells us about the ALLOC POSTPONE option, so we add POSTPONE to each ALLOC command.  Again, 66 tape devices are allocated, because zSecure opens all SMF data sets at the same time.  Something the description of the POSTPONE keyword could have warned us about.

    So now we revert to writing our dsnames in JCL:

    //CKR8Z12 EXEC PGM=CKR8Z12,PARM=' '
    //STEPLIB   DD DISP=SHR,DSN=SYS1.SCKRLOAD
    //CKRCARLA  DD DISP=SHR,DSN=SYS1.SCKRCARL
    //SYSPRINT  DD SYSOUT=*
    //CKREPORT  DD SYSOUT=*
    //SMFDEV    DD DISP=SHR,UNIT=(,,DEFER),DSN=SMF.SYSA.MONTHLY(0)
    //SMF       DD DISP=SHR,UNIT=AFF=SMFDEV,DSN=SMF.SYSA.MONTHLY(-11)
    //          DD DISP=SHR,UNIT=AFF=SMFDEV,DSN=SMF.SYSA.MONTHLY(-10)
    ....
    //SYSIN     DD DATA,DLM='\/'
      alloc type=CKFREEZE DSN=CKR.CKFREEZE(0)
      alloc type=RACF backup active
      alloc type=smf dd=smf

    One tape unit used, the job may run slightly slower (not really), but no more contention on the limited number of devices.  Nice.

    And runs through 1 billion SMF records in about 10 minutes CPU.  Nice!

    If only the ALLOC command (really) supported DEFER.


    ------------------------------
    Rob van Hoboken
    ------------------------------



Related Content