IBM Security Z Security

Hi all,

I have a coiple of questions around the daily collection process that I hope you can help with.

1) Am I correct in believing that OPTION COLLECTIONDATASET(MultiInterval) is the default if not specified?

2)  Am I correct in thinking that when SingleInterval is in effect, at the end of each SMF interval, the C2PACMON.X000000.X0000 dataset is renamed to C2PACMON.Dxxxxxx.Txxxx dataset. A new C2PACMON.X000000.X0000 is then created? Whereas with MultiInterval, the C2PACMON.X000000.X0000 is used continuously and only renamed to C2PACMON.Dxxxxxx.Txxxx when a Consolidation is performed either ad-hoc or at the specfied time?

Thanks in advance

Dave 

Hi David,

For your first question I took a look at the code, and I think SingleInterval is the default. I also think the documentation suggests something else by its railroad diagram, so I will raise an internal issue to update it: https://www.ibm.com/docs/en/szs/3.1.0?topic=commands-option-command .

For the second question, I think the documentation answers the question here: https://www.ibm.com/docs/en/szs/3.1.0?topic=parameters-definition-daily-collection-daily-consolidation-files 

"The daily collection data sets must be large enough to contain all collected records. Depending on the CollectionDataSet specification in the Access Monitor parmlib member, the data set must accommodate records for a single SMF interval, or records for the entire day:

• If you specified SingleInterval for the CollectionDataSet parameter, the daily collection data set is closed and a new one is created at the end of every SMF interval.
• If you specified MultiInterval, available data is saved, and the data set is prepared for additional data to be added at the end of the next SMF interval.

Using SingleInterval has the advantage that data collected during the day is available for analysis. Using MultiInterval has less processing overhead.

Actual data collection is done in a temporary data set that is renamed at the end of the SMF interval, or at ConsolidateTime."

Regards,

Hi all,

I have a coiple of questions around the daily collection process that I hope you can help with.

1) Am I correct in believing that OPTION COLLECTIONDATASET(MultiInterval) is the default if not specified?

2)  Am I correct in thinking that when SingleInterval is in effect, at the end of each SMF interval, the C2PACMON.X000000.X0000 dataset is renamed to C2PACMON.Dxxxxxx.Txxxx dataset. A new C2PACMON.X000000.X0000 is then created? Whereas with MultiInterval, the C2PACMON.X000000.X0000 is used continuously and only renamed to C2PACMON.Dxxxxxx.Txxxx when a Consolidation is performed either ad-hoc or at the specfied time?

Thanks in advance

Dave 

Hi David,

On closer inspection, you will get MultiInterval if you do not specify OPTION COLLECTIONDATASETS at all, but if you do specify that option, it will default to SingleInterval.

We will be changing that to a default of MultiInterval on both counts.

Regards,

Hi David,

For your first question I took a look at the code, and I think SingleInterval is the default. I also think the documentation suggests something else by its railroad diagram, so I will raise an internal issue to update it: https://www.ibm.com/docs/en/szs/3.1.0?topic=commands-option-command .

For the second question, I think the documentation answers the question here: https://www.ibm.com/docs/en/szs/3.1.0?topic=parameters-definition-daily-collection-daily-consolidation-files 

"The daily collection data sets must be large enough to contain all collected records. Depending on the CollectionDataSet specification in the Access Monitor parmlib member, the data set must accommodate records for a single SMF interval, or records for the entire day:

• If you specified SingleInterval for the CollectionDataSet parameter, the daily collection data set is closed and a new one is created at the end of every SMF interval.
• If you specified MultiInterval, available data is saved, and the data set is prepared for additional data to be added at the end of the next SMF interval.

Using SingleInterval has the advantage that data collected during the day is available for analysis. Using MultiInterval has less processing overhead.

Actual data collection is done in a temporary data set that is renamed at the end of the SMF interval, or at ConsolidateTime."

Regards,

Hi all,

I have a coiple of questions around the daily collection process that I hope you can help with.

1) Am I correct in believing that OPTION COLLECTIONDATASET(MultiInterval) is the default if not specified?

2)  Am I correct in thinking that when SingleInterval is in effect, at the end of each SMF interval, the C2PACMON.X000000.X0000 dataset is renamed to C2PACMON.Dxxxxxx.Txxxx dataset. A new C2PACMON.X000000.X0000 is then created? Whereas with MultiInterval, the C2PACMON.X000000.X0000 is used continuously and only renamed to C2PACMON.Dxxxxxx.Txxxx when a Consolidation is performed either ad-hoc or at the specfied time?

Thanks in advance

Dave