Using record display scripts for interactive reporting

The SMF record display scripts which start with the name pattern C%ADF are used by the interactive component of IBM Security zSecure to generate SMF data reports for the ISPF display. Many of these scripts cannot be run directly as a library member.

These CARLa scripts typically define a display for a specific group of SMF records such as ICF catalog records. If you follow the conventions used by IBM Security zSecure, you can include these display layouts in your own queries.

To follow the convention for creating an SMF report, use the following process:
  • Create a SMF NEWLIST with the name SMFSEL and output limit 0.
  • Use SELECT and EXCLUDE statements to select the records you are interested in.
  • Include a fake LIST, SORTLIST, or DISPLAY command.
  • Then include any SMF sample member. The CARLa scripts select the records fitting their layout from the selection of the NEWLIST named SMFSEL, and using the appropriate DISPLAY commands to show all relevant data from those records types.
The following sample query shows the IBM Security zSecure convention for coding report data. The query selects records from users JOHN, DAVE, and PETER, and then includes the CARLa scripts defining data set and ICF catalog activity. 
newlist type=smf name=smfsel outlim=0      /* Required newlist */
select user=(john dave peter)              /* Selection */
list type                                  /* Fake list command */
i m=ckadfdda                               /* Data set activity */
i m=ckadfdic                               /* ICF Catalog */
Table 1 describes the SMF record display scripts. You can access these record display from the menu structure.
Table 1. zSecure SMF record display scripts
Member SMF record types
CKADFCSF Integrated Cryptographic Services Facility (ISCF) activities
CKADFDAR RACINIT record layout from SMF type 30
CKADFDDA Data set activity
CKADFDFS z/OS® UNIX file activity
CKADFDIC ICF catalog activity
CKADFDJA Job activity
CKADFDOT Miscellaneous 'other' records
CKADFDRA RACF® processing records (defines various display layouts, depending on event type)
CKADFDRS RACF processing records (one display layout, can be used with a SUMMARY)
CKADFDVS VSAM catalog activity
CKADFDZZ Common SMF header display
CKADFD02 DB/2 record types 100, 101, and 102
CKADFD81 RACF status record display in format like CKRDSR80
CKADFD90 MVS™ event information: defines displays for IPL reason and down time, SRM data, LOGREC, SMF stop and switch events
CKADFJOB Summary of activity by user and job
CKADFJ33 APPC transaction summaries
CKADFSUM Summary of record types selected
CKADFTCP TCPIP activity
CKADF109 Firewall activity
CKADF123 z/OS Connect activity

The sample SMF CARLa scripts that can be run directly are described in the following table. The scripts are accessible through the menu structure as well.

Table 2. SMF CARLa script samples
Member Description
CKADFJVI Jobs with failures
CKADFRST RACF daily statistics of logon and access events, and the number of violations
CKADFRVR Revoke and resume summaries by user and by administrator
CKADFR80 RACF daily report of violations, special/operations activity, audited users, RACF command use, command violations, and all non-success records
CKADFR99 RACF daily report of violations, special/operations activity, audited users, RACF command use, and all non-success records