Configuring the UKO Agent for CAT data collection

ICSF configuration for SMF record generation

The following subtypes of the ICSF type 82 SMF records are collected:

Be aware that ICSF options determines if the subtypes are written. Check the ICSF System Programmer's guide for details. The ICSF CSFPARM DDname points to the options. The options of interest are:

However, depending on the actual use of ICSF on the system, you might want to limit records written for performance/DASD space usage. Typically the TOKEN(YES), SESSIONOBJ(YES) and NOKEY(YES) could generate a lot of records you may not be interested to gather as a start.

You can use the MVS console command "DISPLAY ICSF, OPT" to display the current ICSF settings, and the SETICSF console command to dynamically set the options.

Note: This configuration step is not part of the workflows.

Collection configuration

Two files are required for the configuration:

• catagent.properties for general properties
• catsmf.conf to configure the SMF dump

Copy them from the ${CAT_INSTALL_DIR} (typically /usr/lpp/IBM/uko/v3r1/cccat/config) to a ${CAT_USER_DIR} (for example /var/cccat/config) and adjust them. If you are using the z/OSMF Workflow, you will be prompted for the most common parameters.

Note that you need to dump your datasets to be able to process them. When SMFGDGBASE/SMFGDGDONE is used then the Agent will update the SMFGDGDONE with the latest dumped SMF generation.

For example in case of the following GDG with 10 entries:

SYS2.SMFDUMP.LPAR1.G4319V00
SYS2.SMFDUMP.LPAR1.G4320V00
SYS2.SMFDUMP.LPAR1.G4321V00
SYS2.SMFDUMP.LPAR1.G4322V00
SYS2.SMFDUMP.LPAR1.G4323V00
SYS2.SMFDUMP.LPAR1.G4324V00
SYS2.SMFDUMP.LPAR1.G4325V00
SYS2.SMFDUMP.LPAR1.G4326V00
SYS2.SMFDUMP.LPAR1.G4327V00
SYS2.SMFDUMP.LPAR1.G4328V00

The above sample parameters will result in a collection of data from the following SMF dumps:

SYS2.SMFDUMP.LPAR1.G4327V00
SYS2.SMFDUMP.LPAR1.G4328V00 

and catsmf.conf will be updated with SMFGDGDONE(G4328V00).

Configure security for the agent

The CC CAT required the following security setup:

• The KMG.SKMGMOD0 load library must be defined as APF authorized.
• To execute the CC CAT Agent the following must be true for the ${CAT_AGENT_USER} executing the CC CAT Agent:
  • User id must have on OMVS segment
  • ALTER access to the ${CAT_TEMP_HLQ} data set qualifier specified in the cat_dsnqual property
  • READ access to the ${AGENT_RUNLIB} load library (default KMG.SKMGMOD0)
  • READ access to the SMF datasets dumped

In addition, the ${CAT_AGENT_USER} needs toe following access * READ access to FACILITY resource KMG.CAT.TRUSTED.ICSF (KMG.CAT.TRUSTED.ICSF enables the user to collect data of the ICSF keys without having access to the ICSF keys outside the use of the CAT Agent ) * READ access to the CSFSERV resources CSFPCI, CSFIQF and CSFIQA

The z/OSMF workflow helps you to define access to KMG.CAT.TRUSTED.ICSF and the CSFSERV profiles for the ${CAT_AGENT_USER} id or group. However, the remaining access needs to be granted manually and you will be asked to confirm.

Agent execution

Copy the SKMGSAMP(KMGACAT) sample JCL from the ${AGENT_SAMPLIB} to a library and adjust it to match your environment. It can be run either ad-hoc or by a scheduler of choice. The following parameters need to be adjusted:

If you are using the z/OSMF workflow, the JCL will be created for you and you can specify the required parameters. You can either submit the JCL from the workflow or save it in another location from where you want to run it.

Work datasets reference

When the CAT Agent runs, a number of cataloged temporary datasets are allocated prefixed by the value of the cat_dsnqual property. If any of the data sets exits when the CAT Agent is started, then they are deleted by the Agent before data collect begins. When the CAT Agent ends successfully, then all of the data sets are removed, unless the cat_debug=yes property is used.

When the default cat_dsnqual=KMG.CAT is used, then the following data sets are allocated:

Note: None of the data sets are in an external documented format and are only interesting in debug situations.

Kafka security setup

Refer to the Kafka Security chapter to setup security for Kafka.