This section describes some internals of SMF processing.
At the end of each run, zSecure provides
an overview of the range of records processed. For each system, the
date and time of the earliest record processed and the date and time
of the last record processed are shown. The sample output that follows
shows the layout of the record overview: Figure 1. Overview of records processed
CKR0452 00 SMF records were processed for the following systems:
System ML1E from 23 Aug 1994 02:54 to 23 Aug 1994 05:10 (no CKFREEZE file)
System ML1S from 30 Aug 1993 04:11 to 30 Aug 1993 04:14 (no CKFREEZE file)
The record overview displayed in the preceding figure does not
include the date and time of SMF record types 2 and 3. These records
do not describe system events, but are created by the IFASMFDP program
and indicate the start time and end time of the IFASMFDP run, which
is always later than the last SMF record dumped.
The date and time of the earliest and last records processed, across
all systems, is also displayed in the report header.
Special processing is also performed for SMF record
type 7, which indicates that SMF data was lost on the system that
generated the SMF records, presumably because the SMF buffers were
full. The events that occurred during the period that the SMF buffers
were full are lost, and cannot be audited using SMF. zSecure brings
this to your attention using message CKR0461. (The zSecure messages
are documented in IBM® Security
zSecure: Messages Guide.). The following sample shows message CKR0461:Figure 2. Sample message CKR0461
CKR0461 00 48059 SMF records were lost on system from 5 Feb 1994 00:10