Running the SMF log stream dump program

Use the IEFU29L SMF dump exit to initiate the SMF log stream dump program. See z/OS MVS Installation Exits for more information about the IEFU29L dump exit.

Sample JCL to execute the SMF log stream dump program is shown in Figure 1. The output is a non-temporary data set on a standard-labeled tape. In this example, the DCB= keyword is not specified, so the SMF log stream dump program assigns the following DCB attributes.

BLKSIZE=0 (allows the system to determine the optimum block size)
LRECL=32767
RECFM=VBS

SMF records created by IBM components never exceed 32,756 bytes. If the data required in a record would cause the record to exceed that length, the component responsible for creating the record would, instead, create multiple (continuation) records, none of which would exceed 32,756 bytes. (See Record type 30 (X'1E') — Common address space work for an example.) SMF records are written as spanned (VBS) in order to conserve storage space by ensuring that each block of data is as full as possible. If you specify DCB parameters on any of the input or output DD statements for IFASMFDL, you must specify RECFM=VBS. You should not specify LRECL=X for reading or writing SMF dump data, because LRECL=X signifies that a single record may be larger than 32,756 bytes, which is not the case for SMF data.

You can specify LRECL=32760 instead of 32767. You can also specify any block size from 4096 to the maximum allowed for the chosen device.

Specify a region size of 0M to avoid abend X'878' reason code 10 or other related abends.

Figure 1. Sample JCL for dumping an SMF log stream to a data set

//DUMPX     JOB   MSGLEVEL=1
//STEP1     EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1 DD DSN=BASCAR.LSDEFLT.RECOR66,DISP=(NEW,CATLG,DELETE), 
//          UNIT=3390,
//     SPACE=(CYL,(1,1),RLSE),DCB=(LRECL=32760,RECFM=VBS,BLKSIZE=0)
//SYSPRINT DD  SYSOUT=A                                              
//SYSIN    DD  *                                                     
 LSNAME(IFASMF.MULTSYS.STREAM1,OPTIONS(DUMP))                         
 OUTDD(OUTDD1,TYPE(0:255),START(0000),END(2400))                     
 DATE(2007011,2007011)                                               
 SID(SY1)                                                            
/*

Dumping multiple SMF log streams

Figure 2 shows a sample job using the SMF log stream dump program to dump two SMF log streams to three output data sets.

Figure 2. Sample JCL for dumping multiple SMF log streams to multiple output data sets

//IFASMFDL  JOB   accounting information
//STEP      EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1    DD    DSN=SMFREC.FEWTYPES,DISP=(NEW,CATLG,DELETE)
//OUTDD2    DD    DSN=SMF.TYPE10.TYPE255,DISP=(NEW,CATLG,DELETE),DCB=BLKSIZE=32000
//OUTDD3    DD    DSN=SMF.TYPE10.TYPE255B,DISP=(NEW,CATLG,DELETE),DCB=LRECL=32760
//SYSPRINT  DD    SYSOUT=A
//SYSIN     DD    *
       LSNAME(IFASMF.ACCNT1)
       LSNAME(IFASMF.ACCNT2)       
       OUTDD(OUTDD1,TYPE(0,2,10,15:30,33(1)),START(0730),END(1850))
       OUTDD(OUTDD2,TYPE(10:255),DATE(2006274,2006334))
       OUTDD(OUTDD3,TYPE(10:255))
       DATE(2006001,2006366)
       SID(308A)
       SID(308B)
/*

Figure 2 illustrates the following:

The DCB= keyword has been coded for the output data set defined by OUTDD2. Any block size 4096 or greater may be specified. Choosing a block size suitable for the device type being used will improve storage resource use. For this job, the data set specified by OUTDD1 will have a system determined block size while the data set specified by OUTDD2 will have a block size of 32000.
The LRECL= keyword has been coded for an output data set defined as OUTDD3. For this job, the data set specified by OUTDD3 will have an LRECL of 32760. For OUTDD1 and OUTDD2, the LRECL will default to 32767.
The LSNAME parameters contain the names of two log streams to be dumped.
The OUTDD parameters contain filters selecting the SMF record types to be dumped:
- OUTDD1 specifies that you want to dump record types 0, 2, 10, 15-30, and subtype 1 of record type 33 starting with those issued at 7:30 am and ending at 6:50 pm.
- OUTDD2 specifies that you want to dump record types 10 through 255 from dates 1 October 2006 through 30 November 2006.
- OUTDD3 specifies that you want to dump record types 10 through 255.
The DATE parameter specifies that for those OUTDD statements that do not include the DATE subparameter, data from 1 January 2006 through 31 December 2006 is to be written.
The SID parameters specify that data will be dumped for systems 308A and 308B.

There can be any number of input (LSNAME) or output (OUTDD) parameters in the SMF log stream dump program. The log streams are dumped in reverse order. For example, in Figure 2, two log streams are specified. After the SMF log stream dump program is processed, the output files contain the records from log stream IFASMF.ACCNT2 first, followed by the records from IFASMF.ACCNT1.

After the SMF log stream dump program job shown in Figure 2 runs, information is listed in the SYSPRINT data set, as shown in Figure 3.

Figure 3. Sample information included in SYSPRINT data set

SMF DUMP PARAMETERS
END(2400) -- DEFAULT
START(0000) -- DEFAULT
SID(308B) -- SYSIN
SID(308A) -- SYSIN
DATE(2006001,2006366) -- SYSIN
OUTDD(OUTDD3,TYPE(10:255)) -- SYSIN
OUTDD(OUTDD2,DATE(2006274,2006334),TYPE(10:255)) -- SYSIN
OUTDD(OUTDD1,END(1850),START(0730),TYPE(0,2,10,15:30,33(1))) -- SYSIN
LSNAME(IFASMF.ACCNT2) -- SYSIN
LSNAME(IFASMF.ACCNT1) -- SYSIN

More IFASMFDL examples

Example 1: Figure 4 requests records to be selected from the log stream that were recorded starting from three days before the current date, and ending at the third day, counting from that starting day. To illustrate further, if the JCL in Figure 4 executes on Monday, 28 July 2008 (Julian date 2008.210), the data in the log stream from Friday, 25 July 2008 (Julian date 2008.207) to Sunday, 27 July (Julian date 2008.209) will be dumped.

Figure 4. Sample JCL for dumping a SMF log stream with the RELATIVEDATE option

//DUMPX     JOB   MSGLEVEL=1 
//STEP1     EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1    DD    DSN=BASCAR.LSDEFLT.RECOR66,DISP=(NEW,CATLG,DELETE),
//                UNIT=3390,
//     SPACE=(CYL,(1,1),RLSE),DCB=(LRECL=32760,RECFM=VBS,BLKSIZE=0)
//SYSPRINT  DD    SYSOUT=A
//SYSIN     DD    *
 LSNAME(IFASMF.MULTSYS.STREAM1,OPTIONS(DUMP)) 
 OUTDD(OUTDD1,TYPE(0:255))
 RELATIVEDATE(BYDAY,3,3)
 SID(SY1)
/*

The SMF log stream dump program requires APF-authorization. Running the SMF log stream dump program, as shown in the above JCL examples, preserves the APF-authorization assigned to the SMF log stream dump program. Invoking the SMF log stream dump program in any way other than as shown above (for example, if you invoke the SMF log stream dump program from another program or invoke it as a TSO/E command), might cause it to lose its authorization.

For more information on APF-authorization, see z/OS MVS Programming: Authorized Assembler Services Guide. For more information on running authorized programs under TSO/E, see z/OS TSO/E Customization.

Example 2: Figure 5 illustrates the following:

The RELATIVEDATE parameter requests records to be selected from the log stream in a date range beginning three weeks before the current week and ending at the second week counting from the starting week.
The WEEKSTART(MON) parameter specifies that weeks are defined as running from Monday through Sunday, as opposed to Sunday through Saturday (which would be specified as WEEKSTART(SUN)).

Figure 5. Sample JCL for dumping a SMF log stream with the RELATIVEDATE and WEEKSTART options

//DUMPX     JOB   MSGLEVEL=1 
//STEP1     EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1    DD    DSN=BASCAR.LSDEFLT.RECOR66,DISP=(NEW,CATLG,DELETE),
//                UNIT=3390,
//     SPACE=(CYL,(1,1),RLSE),DCB=(LRECL=32760,RECFM=VBS,BLKSIZE=0)
//SYSPRINT  DD    SYSOUT=A
//SYSIN     DD    *
 LSNAME(IFASMF.MULTSYS.STREAM1,OPTIONS(DUMP)) 
 OUTDD(OUTDD1,TYPE(0:255))
 RELATIVEDATE(BYWEEK,3,2)
 WEEKSTART(MON)
 SID(SY1)
/*

If we run the job in Figure 5 on the following days,

On Sunday, 27 July 2008 (Julian date 2008.209), the calculated range for the output is Monday, 30 June 2008 (2008.182) to Sunday, 13 July (Julian date 2008.195).
On Monday, 28 July 2008 (Julian date 2008.210), the calculated range for the output is Monday, 7 July 2008 (2008.189) to Sunday, 20 July (Julian date 2008.202).

Example 3: Figure 6 illustrates the following:

The RELATIVEDATE option requests that yesterday's records be selected.
The OPTIONS(ARCHIVE) overrides the start date produced by the RELATIVEDATE option, and starts at the beginning of the logstream. All records will then be dumped and deleted until the end of yesterday.
If such a job is run nightly, the start of the logstream continues to "move" with each subsequent run, because the data that is dumped is also being deleted.

Figure 6. Sample JCL for dumping a SMF log stream with the RELATIVEDATE option

//DUMPX     JOB   MSGLEVEL=1 
//STEP1     EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1    DD    DSN=BASCAR.LSDEFLT.RECOR66,DISP=(NEW,CATLG,DELETE),
//                UNIT=3390,
//     SPACE=(CYL,(1,1),RLSE),DCB=(LRECL=32760,RECFM=VBS,BLKSIZE=0)
//SYSPRINT  DD    SYSOUT=A
//SYSIN     DD    *
 LSNAME(IFASMF.MULTSYS.STREAM1,OPTIONS(ARCHIVE)) 
 OUTDD(OUTDD1,TYPE(0:255))
 RELATIVEDATE(BYDAY,1,1)
 /*

Example 4: Figure 7 shows an example to get statistics information for type 90 and 101 records with the FLDSTATS parameter. This job will gather statistics individually for type 90 and 101 and also for them combined. Each interval will consist of 1000 records.

Figure 7. Sample JCL for dumping a SMF log stream with the FLDSTATS option

//RUNSMFDL JOB  MSGLEVEL=(1,1),NOTIFY=&SYSUID                    
//SMFDMP   EXEC PGM=IFASMFDL,REGION=0M
//DUMP04   DD DUMMY                                              
//SYSPRINT DD SYSOUT=*                                           
//SYSIN    DD *                                                      
    LSNAME(IFASMF.SOME.LOGSTREAM,OPTIONS(DUMP))     
    OUTDD(DUMP04,TYPE(90,101))        
    FLDSTATS(1000)

Example 5: Figure 8 shows an example of retaining signature records with the NOSIGSTRIP parameter.

Figure 8. Sample JCL for dumping a SMF log stream with the NOSIGSTRIP option

//IFASMFDL JOB  MSGLEVEL=(1,1),NOTIFY=&SYSUID 
//STEP1     EXEC  PGM=IFASMFDL,REGION=0M
//OUTDD1    DD    DSN=SMFREC.FEWTYPES,DISP=(NEW,CATLG,DELETE),
//SYSPRINT  DD    SYSOUT=A
//SYSIN     DD    *
       LSNAME(IFASMF.ACCNT1) 
       OUTDD(OUTDD1,TYPE(10:255))
       DATE(2014001,2014365)
       SID(308A)
       NOSIGSTRIP
/*