Thanks @Scott and @Elardus. I have submitted an RCF and copied @Scott.
@Elardus -- don't forget IEFU86. > due to security and integrity of the SMF records themselves, IBM is not > talking much about it. Security by obscurity? Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Elardus Engelbrecht Sent: Wednesday, June 12, 2019 5:39 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: What happens if an SMF exit modifies the SMF record? Charles Mills wrote: >What happens if an SMF exit modifies the SMF record? Do the next exit in the >chain, SYS1.MANx and/or the stream see the modified record, or is the exit >only modifying a "private copy" of the SMF record? It should be able to do that provided the SMF exit is getting the address (fullword) of the SMF record in register 1. Each SMF record is passed to an installation exit (either IEFU83, IEFU84, or IEFU85) before it is written to the SMF data set. But there is one catch, Inside the SMF exit, you cannot use the SMFWTM or SMFEWTM macro to write to the SMF data set, because the exits are called by SMFWTM/SMFEWTM. Of course, SMF records needed to be collected and then written out instead of being suppressed by the exits themselves. Cheryl Watson and Frank Kyne once wrote in November 2014 this: "An application would pass a record to SMF using the SMFWTM macro, and SMF would call IEFU83 with the record. The exit could choose to delete the record, modify it or perform some action based on the record’s contents. " (From: http://enterprisesystemsmedia.com/article/smf-exits-and-the-life-of-a-job ) >It would seem to me to be an important point, and the documentation is pretty >much silent (or I am visually challenged). However, I tend to interpret "Word >1: The address of the record that SMF is to write" as implying that there is >only a single copy that will get passed on down the line. Your interpretation is correct, but strangely just like you and Scott Ballentine, I also don't see it documented specifically that your SMF exits can modify a record all the way from one exit to other until it is finally written out to the SMF VSAM datasets. I believe the reason is that due to security and integrity of the SMF records themselves, IBM is not talking much about it. For IEFACTRT, I see this note: "When the data for an SMF record exceeds 32,756 bytes in length, the system constructs one or more "continuation" or "additional" records to ensure that no individual record exceeds that length. The system invokes IEFACTRT once for the original record and once for each continuation record." So, I believe SMF records can be changed many times until it is written out finally. >I will submit an RCF once I get a definitive answer here. Please do so. Groete / Greetings Elardus Engelbrecht ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
