SMF record types and contexts

Edit online

SMF records are correlated to IBM® Security Guardium® S-TAP® for Data Sets contexts, as shown in the following table.

Table 1. SMF record types, subtypes, and contexts

This table shows how SMF record numbers correlate to record subtypes, usages, and contexts.
Record number Record subtype Purpose SMF context
14 Collecting non-VSAM file activity CLOSE (non-VSAM input)
15 Collecting non-VSAM file activity CLOSE (non-VSAM output)
17 Collecting Delete activity DELETE (non-VSAM)
18 Collecting Rename activity RENAME (non-VSAM)
30 4, 5 Collecting Job/Step activity Accounting
42 6 Collecting VSAM type information Accounting (VSAM)
42 20 Collecting PDS/PDSE member activity STOW initialization (PDSE directory clearing)
42 21 Collecting PDS/PDSE member activity DELETE (PDS/PDSE member)
42 24 Collecting PDS/PDSE member activity ADD/REPLACE (PDS/PDSE member)
42 25 Collecting PDS/PDSE member activity RENAME (PDS/PDSE member)
60* Collecting VVDS update activity Data Set ALTER, Data Set CREATE
61* Collecting DEFINE/CATLG activity Data Set CREATE
62 Collecting VSAM file activity OPEN (VSAM)
64 Collecting VSAM I/O statistics CLOSE (VSAM)
65 Collecting Delete activity DELETE (VSAM)
66* Collecting Rename activity RENAME, ALTER (VSAM)
80 Collecting CICS sign-on security violations Security Violation

*For more information, see the SMF records section of the IBM z/OS MVS System Management Facilities (SMF) documentation, available at IBM Documentation.

Note:
  • There is not a one-to-one correlation between SMF records and context events reported. If more than one SMF record is encountered within a step for a single event, then subsequent records are considered duplicates.
  • Audit records for data set events are produced as they occur.
  • Data Set CREATE context can appear for RENAME requests of non-SMS, non-VSAM data sets, because the RENAME process generates an SMF type 61 record.