IBM Security Z Security

The standard page header shows the interval of selected SMF records in the whole run.  In your report, you obviously used a SELECT command, so the first matching and the last matching SMF record timestamp are shown.

To get the interval of the whole input data set, you simply add a NEWLIST in the same job that selects ALL SMF records.  Now you do not want this output messing up your report, so you want output that is suppressed.  There are two ways to get this done.

alloc type=output dd=dummy dsn=nullfile
newlist type=smf
  summary system count

Add this in front of your report, and a new output file will be allocated, the output will not appear in CKREPORT.

But it can be more efficient using the threshold system in a perverse application:

newlist type=smf
  summary system count(<1)

This only shows the summary result when there are no SMF records, which would produce an empty report, which would not show up.  QED.

Hello - we were able to get this working but noticed something strange that is not zsecure related. My daily SMF file, july 14th, has 1 - Type2 and 1 Type3 record at 1:30AM for the 15th.... not sure how that is even possible. Also, type2/3 are not included in my selection for the copy.

to get around this, i added X TYPE=(2,3)  to your code which gave me the proper end time. 

thanks.

Type 2 and 3 are written by the program that dumps SMF, see here.  That suggests the daily SMF file you used was written at 1:30 am (the next day).  Your solution (x type=(2,3)) is spot on.