Re: What happens if an SMF exit modifies the SMF record?
Maybe it’s not being corrupted in the SMF record but at the source. Many SMF fields are copied from various control blocks. Check if that location is being walked on. Dan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
> For example, without having done an exhaustive analysis, I'd guess > that all the PI fields in the CVT other than CVTUSER are intended to > be read-only. It's also not safe to assume that you're the only one modifying, e.g., CVTUSER, TCBUSER. BTDT,GTS (no tee shirt, just the scars.) -- Shmuel (Seymour J.) Metz http://mason.gmu.edu/~smetz3 From: IBM Mainframe Discussion List on behalf of Peter Relson Sent: Thursday, June 13, 2019 8:26 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: What happens if an SMF exit modifies the SMF record? > due to security and integrity of the SMF records themselves, IBM is not talking much about it. Security by obscurity? No. These are updates by authorized programs. Neither security nor integrity is a factor. One ought to be asking for what reason an exit routine would update an SMF record. Can it? Sure. Should it? Usually not. Most programming interfaces (far from all, of course) are intended to be for read-only but only rarely is that explicitly stated. For example, without having done an exhaustive analysis, I'd guess that all the PI fields in the CVT other than CVTUSER are intended to be read-only. Probably one ought to go with "if it's not obvious that a field is intended to be written into, then don't write into it (or ask for the documentation to make it clear one way or another)" Long ago I had hoped to gain traction for indicating that a PI field was read-only vs read/write (such as placing that information within the external classification section of the macro prolog which in turn is used within the data areas books). Obviously that hope did not come to fruition. Peter Relson z/OS Core Technology Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
The intent of the question was NOT "I have this neat idea that I could 'improve' SMF records in the exit ..." Not at all. Here is the problem. Associates have an issue with a corrupted SMF record whose source was an IEFU8x exit. We see three possibilities: - They stepped on it themselves somehow. This would seem to be the most likely possibility, but an inspection of the code comes up with nothing. - The IBM product cut a bad SMF record. Certainly a possibility, but seems very unlikely. - The thought emerged "what if an exit earlier in the IEFU8x chain stepped on it? Is that even possible?" FWIW my associates were guessing that each exit received a private copy of the record. (Not an outlandish idea IMHO. Many products do work that way.) My divining of the manual was that there was only one copy. I volunteered to ask here. I did give some thought to "would it ever make sense for an exit to modify an SMF record?" and the best I could come up with was "shops have done some amazing things over the years, and after a while they become set in concrete." The MVS doc indicates that a valid use for an IEFU83 exit would be to suppress certain SMF records, and suppressing a record is in a sense the ultimate modification. It does not seem to me to be big leap from, for example, "I will suppress this record" to "I will keep this record, but get rid of one triplet section." I submitted an RCF asking for a clarification. As always @Peter, thanks for your help. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Peter Relson Sent: Thursday, June 13, 2019 5:26 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: What happens if an SMF exit modifies the SMF record? > due to security and integrity of the SMF records themselves, IBM is not talking much about it. Security by obscurity? No. These are updates by authorized programs. Neither security nor integrity is a factor. One ought to be asking for what reason an exit routine would update an SMF record. Can it? Sure. Should it? Usually not. Most programming interfaces (far from all, of course) are intended to be for read-only but only rarely is that explicitly stated. For example, without having done an exhaustive analysis, I'd guess that all the PI fields in the CVT other than CVTUSER are intended to be read-only. Probably one ought to go with "if it's not obvious that a field is intended to be written into, then don't write into it (or ask for the documentation to make it clear one way or another)" Long ago I had hoped to gain traction for indicating that a PI field was read-only vs read/write (such as placing that information within the external classification section of the macro prolog which in turn is used within the data areas books). Obviously that hope did not come to fruition. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
> due to security and integrity of the SMF records themselves, IBM is not talking much about it. Security by obscurity? No. These are updates by authorized programs. Neither security nor integrity is a factor. One ought to be asking for what reason an exit routine would update an SMF record. Can it? Sure. Should it? Usually not. Most programming interfaces (far from all, of course) are intended to be for read-only but only rarely is that explicitly stated. For example, without having done an exhaustive analysis, I'd guess that all the PI fields in the CVT other than CVTUSER are intended to be read-only. Probably one ought to go with "if it's not obvious that a field is intended to be written into, then don't write into it (or ask for the documentation to make it clear one way or another)" Long ago I had hoped to gain traction for indicating that a PI field was read-only vs read/write (such as placing that information within the external classification section of the macro prolog which in turn is used within the data areas books). Obviously that hope did not come to fruition. Peter Relson z/OS Core Technology Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
Charles Mills wrote: >Thanks @Scott and @Elardus. You're most welcome! >I have submitted an RCF and copied @Scott. Cool! Keep them busy. ;-) >@Elardus -- don't forget IEFU86. Yes, you're right. I just copied (in a hurry!) the list of the IEFU8x involved from a bookie in KC. >> due to security and integrity of the SMF records themselves, IBM is not >> talking much about it. >Security by obscurity? Perhaps, There is even a way to create and validate SMF records with digital signatures. But, still, you can modify it as per earlier discussion, then at the last stage, those records are then signed. "Security by obscurity" - is only working in theory ... ;-) Look at https://en.wikipedia.org/wiki/Security_through_obscurity for some discussion... Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
Thanks @Scott and @Elardus. I have submitted an RCF and copied @Scott. @Elardus -- don't forget IEFU86. > due to security and integrity of the SMF records themselves, IBM is not > talking much about it. Security by obscurity? Charles -Original Message- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Elardus Engelbrecht Sent: Wednesday, June 12, 2019 5:39 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: What happens if an SMF exit modifies the SMF record? Charles Mills wrote: >What happens if an SMF exit modifies the SMF record? Do the next exit in the >chain, SYS1.MANx and/or the stream see the modified record, or is the exit >only modifying a "private copy" of the SMF record? It should be able to do that provided the SMF exit is getting the address (fullword) of the SMF record in register 1. Each SMF record is passed to an installation exit (either IEFU83, IEFU84, or IEFU85) before it is written to the SMF data set. But there is one catch, Inside the SMF exit, you cannot use the SMFWTM or SMFEWTM macro to write to the SMF data set, because the exits are called by SMFWTM/SMFEWTM. Of course, SMF records needed to be collected and then written out instead of being suppressed by the exits themselves. Cheryl Watson and Frank Kyne once wrote in November 2014 this: "An application would pass a record to SMF using the SMFWTM macro, and SMF would call IEFU83 with the record. The exit could choose to delete the record, modify it or perform some action based on the record’s contents. " (From: http://enterprisesystemsmedia.com/article/smf-exits-and-the-life-of-a-job ) >It would seem to me to be an important point, and the documentation is pretty >much silent (or I am visually challenged). However, I tend to interpret "Word >1: The address of the record that SMF is to write" as implying that there is >only a single copy that will get passed on down the line. Your interpretation is correct, but strangely just like you and Scott Ballentine, I also don't see it documented specifically that your SMF exits can modify a record all the way from one exit to other until it is finally written out to the SMF VSAM datasets. I believe the reason is that due to security and integrity of the SMF records themselves, IBM is not talking much about it. For IEFACTRT, I see this note: "When the data for an SMF record exceeds 32,756 bytes in length, the system constructs one or more "continuation" or "additional" records to ensure that no individual record exceeds that length. The system invokes IEFACTRT once for the original record and once for each continuation record." So, I believe SMF records can be changed many times until it is written out finally. >I will submit an RCF once I get a definitive answer here. Please do so. Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
Charles Mills wrote: >What happens if an SMF exit modifies the SMF record? Do the next exit in the >chain, SYS1.MANx and/or the stream see the modified record, or is the exit >only modifying a "private copy" of the SMF record? It should be able to do that provided the SMF exit is getting the address (fullword) of the SMF record in register 1. Each SMF record is passed to an installation exit (either IEFU83, IEFU84, or IEFU85) before it is written to the SMF data set. But there is one catch, Inside the SMF exit, you cannot use the SMFWTM or SMFEWTM macro to write to the SMF data set, because the exits are called by SMFWTM/SMFEWTM. Of course, SMF records needed to be collected and then written out instead of being suppressed by the exits themselves. Cheryl Watson and Frank Kyne once wrote in November 2014 this: "An application would pass a record to SMF using the SMFWTM macro, and SMF would call IEFU83 with the record. The exit could choose to delete the record, modify it or perform some action based on the record’s contents. " (From: http://enterprisesystemsmedia.com/article/smf-exits-and-the-life-of-a-job ) >It would seem to me to be an important point, and the documentation is pretty >much silent (or I am visually challenged). However, I tend to interpret "Word >1: The address of the record that SMF is to write" as implying that there is >only a single copy that will get passed on down the line. Your interpretation is correct, but strangely just like you and Scott Ballentine, I also don't see it documented specifically that your SMF exits can modify a record all the way from one exit to other until it is finally written out to the SMF VSAM datasets. I believe the reason is that due to security and integrity of the SMF records themselves, IBM is not talking much about it. For IEFACTRT, I see this note: "When the data for an SMF record exceeds 32,756 bytes in length, the system constructs one or more "continuation" or "additional" records to ensure that no individual record exceeds that length. The system invokes IEFACTRT once for the original record and once for each continuation record." So, I believe SMF records can be changed many times until it is written out finally. >I will submit an RCF once I get a definitive answer here. Please do so. Groete / Greetings Elardus Engelbrecht -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: What happens if an SMF exit modifies the SMF record?
The IEFU8x exits get the "live" record, so yes, any updates that the exit makes would get passed on down the line. I thought this was documented, but I did a quick search and didn't find it either. (There are some places that hint at it but I didn't find anything that spells it out.) -Scott Ballentine, z/OS Development sbal...@us.ibm.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
What happens if an SMF exit modifies the SMF record?
What happens if an SMF exit modifies the SMF record? Do the next exit in the chain, SYS1.MANx and/or the stream see the modified record, or is the exit only modifying a "private copy" of the SMF record? It would seem to me to be an important point, and the documentation is pretty much silent (or I am visually challenged). However, I tend to interpret "Word 1: The address of the record that SMF is to write" as implying that there is only a single copy that will get passed on down the line. I will submit an RCF once I get a definitive answer here. Charles -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
