Obtaining records from SMF log streams

You can use either of the following interfaces to extract data from the SMF log stream:

IFASMFDL, which is the SMF dump utility
IFASEXIT, which is the SMF Logstream Subsystem Exit

With IFASMFDL, you can dump the data from one or more specified log streams into one or more data sets. For detailed information, see Dumping SMF log streams - IFASMFDL.

Using IFASEXIT, you can obtain records from one SMF logstream at a time. IFASEXIT is executed as a logstream exit routine that is invoked in JCL using the SUBSYS DD statement parameter. Figure 1 shows the syntax of this statement.

Figure 1. Syntax of SUBSYS JCL for IFASEXIT

  //ddname   DD  DSNAME=log.stream.name,
  //  SUBSYS=(LOGR,IFASEXIT[,'SUBSYS-options1'] 
  //    [,'SUBSYS-options2'])

log.stream.name

Specifies the name of the log stream to read. The name can be 1 to 26 characters in a data-set-name format.

SUBSYS-options1

Specifies options that are meaningful to all exit routines. For detailed information, see "JCL for the LOGR Subsystem" in z/OS MVS Programming: Assembler Services Guide.

SUBSYS-options2

Specifies unique exit routine options. For IFASEXIT, the following parameters are accepted:

SID(xxxx)

This is an optional parameter used to indicate that only records written by the operating system with the specified system identifier are to be written to the output data set. The xxxx value indicates the system identifier and can be 1 to 4 alphameric characters. There is no default value. Only one SID parameter can be specified for each invocation of IFASEXIT. If SID is not specified, records pertaining to all SIDs found in the logstream are written.

SMEP(hhmm)

This is an optional parameter used to designate a "smart end point" value. The smart end point value, specified as hhmm, results in a calculated time that designates when to discontinue browsing the SMF logstream. By default, if this parameter is not specified, IFASEXIT reads records all the way to the end of the logstream before completing. However, by specifying a Smart End Point value, you can choose to stop reading logstream data at a designated point before the actual end of the logstream. This can shorten the IFASEXIT processing time.

The hhmm value describes the number of hours and minutes to use to calculate the smart end point. The total value cannot exceed 2 hours (designated as 0200).

hh: A number between 00–02
mm: When hh is less than 2, this is a number between 00–59; when hh is 2, the mm value must be 00.

The smart end point value is calculated by adding the value specified by hhmm to the time specified in the TO=ending-time value of the SUBSYS-options1 parameter. The smart end point is satisfied when it has been determined that records for all known SIDs, or records for only the SID specified with the SID(xxxx) parameter, contain a date and time that is past the calculated smart end point.

Note: It is possible that data is buffered on a z/OS® image, and writes to this logstream are delayed. In this case, IFASEXIT may not dynamically detect the image that was buffering data, and may assign a smart end point that is actually prior to when some of these records were actually written ("hardened") to the logstream. These records would remain un-selected for output, and would be candidates for selection on the subsequent run of the job that invokes the IFASEXIT exit.

If the following SUBSYS-options1 parameters are specified, the SMEP parameter is not allowed

TO=YOUNGEST
DURATION