IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Search for corrupt SMF records using CARLa

    Posted Fri August 11, 2023 10:33 AM
    Edited by Michael Nielsen Fri August 11, 2023 10:35 AM

    We occasionally see messages like this when using CARLa to search through SMF records. 

    CKR2466 04 CSRCESRV EXPAND failed for SMF record 1,328,043 in C1SMF0

    PRD.#SMF.TEMP, RC=8

    Is there a way with CARLa to search for SMF records that are incomplete/corrupt/can't be decompressed? I would think it possible since the CSRCESR service recognizes and returns that it cannot process the record but I failed to locate a CARLa field which could be used for this type of search.

    Here's what is in the CARLa message guide-

    CKR2466

    CSRCESRV EXPAND failed for SMF
    record recno in ddname volser dsn,
    RC=rc


    Explanation
    The data decompression service (CSRCESRV) could
    not decompress the Db2 compressed SMF record
    recno in ddname volser dsn. The error code is rc.


    User response
    Verify that the SMF record is not corrupted. If the
    record looks good, see the Electronic Support Web site
    for possible maintenance associated with this
    message.
    If you cannot find applicable maintenance, follow the
    procedures described in "Contacting IBM Support" on
    page 776 to report the problem.



    ------------------------------
    Michael Nielsen
    ------------------------------



  • 2.  RE: Search for corrupt SMF records using CARLa

    Posted Fri August 11, 2023 05:44 PM

    Hi Michael,

    I would expect that RECORDDESC should trigger invoking the service.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------



  • 3.  RE: Search for corrupt SMF records using CARLa

    Posted Mon August 14, 2023 04:05 AM

    Jeroen suggests that you run a CARLa report on the SMF data set that you suspect, and check SYSPRINT for any messages CKR2466.

    // EXEC C2RC
    //SMF DD DISP=SHR,DSN=your SMF 
    //CKFREEZE DD DISP=SHR,DSN=your corresponding CKFREEZE
    //SYSIN DD *
    NEWLIST TYPE=SMF
      SELECT TYPE=102
      LIST RECNO RECORDDESC



    ------------------------------
    Rob van Hoboken
    ------------------------------



  • 4.  RE: Search for corrupt SMF records using CARLa

    Posted Mon August 14, 2023 04:09 AM

    Hi Rob,

    Besides type 102 this can also apply to 100, 101, and 110.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    IBM - Software Development and Level 3 Support Manager IBM Security zSecure Suite
    Delft
    ------------------------------