On Tuesday, 09/29/2009 at 01:22 EDT, "Martin, Terry R. (CMS/CTR) (CTR)"
<terry.mar...@cms.hhs.gov> wrote:
> I am trying to capture SMF type 80 records on my VM system. Are these
collected
> automatically or is there something I need to do to turn these on. The
type 80
> reports are security records.
When you enabled RACF, Task 4 in the Program Directory ("Customize the
Processing of SMF Records") must be performed if you want to process SMF
records. Once that is done, see Chaper 2 in the RACF Auditor's Guide.
RACF will write to one log until it is full. It will then autolog
RACFSMF. RACFSMF is responsible to
- perform an SMF SWITCH to get RACF writing on the other log disk (if it's
empty)
- copy the SMF data from the now-inactive log onto its 192 as SMFjjjjj
DATA (jjjjj = Julian date)
- erase the inactive log disk
- logoff
Keep an eye on the operator's console logs. They tell you what is
happening.
>From there you can process the SMF files:
- Format for processing by z/OS
- XML
- Database upload
- RACF Report Writer (ignore warning about it not being
IBM-recommended...that's only true for z/OS)
Alan Altmark
z/VM Development
IBM Endicott
