Determining types of real-time data to collect

The IBM® Z OMEGAMON® AI for Networks monitoring agent allows you to customize which network resources are monitored.

The monitoring agent includes two data collector components:

  • The TCPC component that includes these data types:
    • TCP/IP Connection and Application Performance statistics collection
    • Routing Table statistics collection
    • TN3270 server statistics collection
    • IPSec security collection (if configured)
    • FTP data collection
    • Enterprise Extender and High Performance Routing statistics collection
    • Communications Storage Manager (CSM) buffer pools
    • OSA statistics
    • Interface statistics
    • Data Link Control (DLC) statistics
    • TCP/IP Stack layer statistics
  • The SNAC component (if configured), including Buffer Pool and VTAM® Environment data collection

By default, both of these components start automatically at startup and run for the life of the monitoring agent. Data collection for these components or any of the individual data types they include can be stopped and started between recycles using the KN3FCCMD commands. See topic KN3FCCMD command reference in the Parameter Reference Guide for more information about stopping and starting collections of various types of data.

By default, the IBM® Z OMEGAMON® AI for Networks monitoring agent is configured to monitor all resources. The monitoring agent always collects a required minimum amount of real-time data. You may choose to disable one or more of these data types. The following tables show the storage costs for monitoring the required and optional types of resources. These tables are provided to inform you of the relative size of attribute tables and the frequency in which data is collected. You might use this information to determine what to monitor: which types of resources, which systems and at what collection interval.

The monitoring agent monitors itself. Configuration and status information for the agent is displayed in the Agent Status workspace. This workspace is part of a special group of workspaces known as the Agent and TCP/IP Subnode workspaces. These workspaces include high-level views accessed from the Agent node in the Navigation tree that display configuration, status, and command execution information about the instance of the IBM® Z OMEGAMON® AI for Networks monitoring agent represented by the specified node. Data for these workspaces is stored in internal control blocks maintained by the agent. The data is gathered from the control blocks whenever a user navigates to one of these workspaces or refreshes the view for that workspace. There is no collection interval for this data. There is also no memory in a data space for this data. Status data for these workspaces is always available and cannot be disabled through configuration of any kind. Table 1 shows the data gathered every time you display or refresh Agent and TCP/IP Subnode workspaces.
Table 1. Data collected every time the Agent or TCP/IP subnode workspaces are displayed or refreshed
LPAR name  
Type of data Real-time data attributes group Row size in bytes Frequency per display/refresh
Agent Subnode KN3 Agent Status 224 1 row
KN3 SNA Collector Status 104 1 row
KN3 TCP Collector Status 756 1 row per monitored TCP/IP stack
KN3 Take Action Command 596 A maximum of 33130 rows of data
KN3 Take Action Command Response 312

Multiple rows of command responses can be associated with a given Take Action command..

A maximum of 390427 rows of data.
The data shown in Table 2 is collected once every collection interval and stored in memory (in a data space). The memory is reused each collection interval. When a user navigates to a workspace, a query will result in the monitoring agent retrieving the appropriate data from a data space. Use this table to calculate the memory usage by multiplying the row size by the number of resources. Add the numbers in the memory usage column to obtain the total memory used to hold data collected in an interval for a TCP/IP address space. Perform these calculations for each TCP/IP address space you are monitoring.
Table 2. Data collected once every collection interval
LPAR name  
TCP/IP address space name  
Type of data Real-time data attributes table Row size in bytes Frequency per interval
TCP/IP Stack Layer statistics TCPIP Address Space 624 1 row per TCPIP address space
KN3 ICMP Global Counters 100 Up to 2 rows per TCPIP address space
KN3 ICMP Type Counters 80 Up to 2 rows per TCPIP address space
KN3 IP Counter Statistics 232 Up to 2 rows per TCP/IP address space
KN3 IP General Statistics 84 1 row per TCP/IP address space
KN3 TCP Counter Statistics 280 1 row per TCP/IP address space
KN3 UDP Counter Statistics 128 1 row per TCPIP Address Space
TCPIP Stack Layer 608 1 row per TCP/IP address space
Interface statistics collection TCPIP Devices 432 1 row per device
Interfaces 472 1 row per TCP/IP interface
KN3 Interface Address 132 1 row per TCP/IP interface address
KN3 Interface Statistics 304 1 row per active strategic TCP/IP interface (max 256)
KN3 Interface Status 344 1 row per TCP/IP interface
Data Link Control statistics collection KN3 Interface Read Queue 312 1 row per read queue per active OSA Queued Direction I/O (QDIO) or HiperSockets interface
KN3 Interface Write Queue 200 1 row per configured queue priority per OSA-Express Queued Direct I/O (QDIO) or HiperSockets interface
OSA statistics collection OSA Channels 416 1 row per OSA Channel
OSA-Express LPARS 106 16 rows per OSA Channel per LPAR per local channel subsystem
OSA-Express Ports 768 1 row per OSA channel of channel subtype: gigabitEthernet,fastEthernet or oneThousandBaseTEthernet per port
OSA 10 Gigabit Ports Control 390 1 row per OSA channel of channel subtype: tenGigabitEthernet per port
OSA 10 Gigabit Ports Errors 424 1 row per OSA channel of channel subtype: tenGigabitEthernet per port
OSA 10 Gigabit Ports Summary 480 1 row per OSA channel of channel subtype: tenGigabitEthernet per port
OSA 10 Gigabit Ports Throughput 420 1 row per OSA channel of channel subtype: tenGigabitEthernet per port
OSA-Express3 Ports Control 390 1 row per OSA channel of channel subtype: osaexp3gigabitEthernet, osaexp3oneThousandBaseTEthernet or osaexp3tenGigabitEthernet per port
OSA-Express3 Ports Errors 480 1 row per OSA channel of channel subtype: osaexp3gigabitEthernet, osaexp3oneThousandBaseTEthernet or osaexp3tenGigabitEthernet per port
OSA-Express3 Ports Summary 696 1 row per OSA channel of channel subtype: osaexp3gigabitEthernet, osaexp3oneThousandBaseTEthernet or osaexp3tenGigabitEthernet per port
OSA-Express3 Ports Throughput 484 1 row per OSA channel of channel subtype: osaexp3gigabitEthernet, osaexp3oneThousandBaseTEthernet or osaexp3tenGigabitEthernet per port
KN3 OSA-Express5S Ports Control 132 1 row per OSA channel of channel subtype: osaexp5StenGigabitEthernet per port
KN3 OSA-Express5S Ports Errors 252 1 row per OSA channel of channel subtype: osaexp5StenGigabitEthernet per port
KN3 OSA-Express5S Ports Summary 332 1 row per OSA channel of channel subtype: osaexp5StenGigabitEthernet per port
KN3 OSA-Express5S Ports Throughput 330 1 row per OSA channel of channel subtype: osaexp5StenGigabitEthernet per port
TCP/IP and VTAM (required collection)” TCPIP Memory Statistics 472 1 row per TCP/IP address space
TCP/IP Connection and Application Performance statistics collection TCPIP Applications 656 1 row per TCP/IP application
TCPIP Connections 632 1 row per TCPIP connection
TCPIP Details 616 1 row per TCP connection
TCP Listener 268 1 row per TCP listener
UDP Connections 360 1 row per UDP endpoint
Routing Table statistics collection TCPIP Gateways 600 1 row per TCP/IP gateway collected on Routing Table Collection Frequency
IPSec Security Collection IPSec Status 360 1 row per TCP/IP address space
Current IP Filters 812 1 row per IP filter
Dynamic IP Tunnels 1024 1 row per dynamic IP tunnel
IKE Tunnels 664 1 row per IKE tunnel
Manual IP Tunnels 364 1 row per manual IP tunnel
The data shown in Table 3 is collected once every collection interval and stored in memory. This data is collected for each LPAR you monitor. The memory is reused each collection interval. Use this table to calculate the memory usage by multiplying the row size by the number of resources. Total the memory usage column to obtain the total memory used to hold data collected in an interval for these resources.
Table 3. Data collected for each monitored LPAR
LPAR name  
Type of data Real-time data attribute group Row size in bytes Frequency per interval
TCP/IP and VTAM (required collection) VTAM Summary Statistics 72 1 row
Enterprise Extender (EE) and High Performance Routing (HPR) statistics collection EE Connections 248 1 row per EE connection
EE Connections Details 240 5 rows per EE connection
HPR RTP Connections 568 1 row per HPR RTP connection
Communications Storage Manager (CSM) buffer reporting CSM Storage 176 1 row
KN3CSM Storage by Owner 168 1 row per address space that owns CSM storage
Buffer Pool and VTAM Environment data collection VTAM Address Space 244 1 row
VTAM I/O 72 1 row for each of 6 resources
VTAM Buffer Pools 154 1 row for each of 14 resources
VTAM Buffer Pool Extents 96 1 row per buffer pool extent
VTAM Buffer Usage by Address Space 72 1 row per address space using IO00 or CRPL buffers
VTAM Buffer Usage by Application 80 1 row per application per address space using IO00 buffers
VTAM Buffer Usage by Category 68 1 row for each of 12 resources
The FTP data shown in Table 4 is collected when a new session or transfer is opened or when an existing session or transfer is closed. This data is collected when z/OS® Communications Server notifies the monitoring agent that data is available and therefore does not adhere to a collection interval. As explained previously, new records are appended to the previously collected data until the table in the data space is full, at which time the table wraps. Therefore, over time 256 MB per TCP/IP address space will be used to hold FTP data.

This data is collected for each TCP/IP stack where FTP is running.

Table 4. FTP data collected
LPAR name  
TCP/IP address space name  
Type of data Real-time data attribute group Row size in bytes Frequency Maximum rows stored
FTP Data Collection FTP Sessions 384 2 rows per FTP session 25,000
TCPIP FTP 2464 2 rows per FTP transfer 100,000

The TN3270 session workspaces display information about open, closed and active TN3270 sessions for a TCP/IP address space. Data for open and closed sessions is provided when z/OS Communications Server notifies the monitoring agent that data is available and therefore is not driven by a collection interval. Data for active sessions is collected once per collection interval.

Memory used to store data for one session is reused for the same session each collection interval and for the data collected when the session is closed. Approximately 24 hours after a session is closed, the memory used to hold that session’s data will be made available for a new session.

Use Table 5 to calculate the memory usage by multiplying the row size by the number of resources. Total the memory usage column to obtain the total memory used to hold TN3270 data collected for a TCP/IP address space. Perform these calculations for each TCP/IP address space you are monitoring.
Note: The TN3270 Response Time Buckets table is not collected or stored as a separate table. Instead, it is a different view into the TN3270 Server Sess Avail table. When a query is issued to retrieve TN3270 Response Time Buckets data, the appropriate TN3270 Response Time Buckets rows (one row for each of the five response time buckets) are created from the corresponding row in the TN3270 Server Sess Avail table.
Table 5. TN3270 data collected
LPAR name  
TCP/IP address space name  
Type of data Real-time data attribute table Row size in bytes Frequency
TN3270 Server Statistics Collection TN3270 Server Sess Avail 432 1 row per TN3270 server session that is active or was closed in the last 24 hours
TN3270 Response Time Buckets 204 0 rows