System Management Facilities (SMF) recording

ICSF uses SMF record type 82 to record certain ICSF events. Record type 82 contains:

A fixed header / self-defining section: This section contains the common SMF record headers fields and the triplet fields (offset/length/number), if applicable, that locate the other sections on the record.
A ICSF event specific (subtype) section: Each subtype contains information about the event that caused ICSF to write to the SMF record. For subtypes that log state changes, the SMF record will contain additional auditing sections.
An auditing header section: This section is present in the record for subtypes that log state changes. It describes the number and overall length of the auditing sections that follow.
A server user section and, optionally, an end user section: If both sections are present, they can appear in either order.

You can map record type 82 by using the CSFSMF82 macro.

ICSF records information in the SMF data set when these events occur:

ICSF starts.
You use the ICSF panels to process an operational key loaded using the TKE workstation.
The in-storage CKDS is refreshed.
A dynamic change is made to a record in the CKDS.
A dynamic change is made to a record in the PKDS.
You use the ICSF panels to load master keys on a coprocessor.
An RSA retained key is created or deleted.
The TKE workstation issues a coprocessor command request or receives a reply response from a coprocessor.
A cryptographic processor is configured online or offline.
ICSF records processing times for coprocessors and accelerators.
ICSF joins or leaves the ICSF sysplex group.
A trusted block is created or activated.
A dynamic change is made to a record in the TKDS.
Duplicate tokens were detected in a key data set.
The in-storage PKDS is refreshed.
Key store policy checking detects the unauthorized use of a key token.
Key store policy PKA key extensions checking detects the unauthorized use of a key.
A secure symmetric key token is used for CPACF encryption.
The TKE workstation sends an audit record to ICSF.
Key store policy checking detects an attempt to use an archived or inactive KDS record.

Each of these events causes ICSF to record information in a separate subtype in the SMF record.

Recording and Formatting type 82 SMF Records in a Report: Sample jobs are available (in SYS1.SAMPLIB) to assist in the recording and formatting of type 82 SMF data:

CSFSMFJ - JCL that executes the code to dump and format SMF type 82 records for ICSF. Before executing the JCL, you need to make modifications to the JCL (see the prologue in the sample for specific instructions). After the JCL has been modified, terminate SMF recording of the currently active dump dataset (by issuing I SMF) to allow for the unloading of SMF records. After SMF recording has been terminated, execute the JCL. The output goes into the held queue. This is an example of CSFSMFJ.

⁄⁄CSFSMFJ  JOB <JOB CARD PARAMETERS>                                            
⁄⁄********************************************************************          
⁄⁄*  LICENSED MATERIALS - PROPERTY OF IBM                            *          
⁄⁄*  (C) COPYRIGHT IBM CORP. 2002                                    *          
⁄⁄*                                                                  *          
⁄⁄*  This JCL reads Type 82 SMF records and formats them in a report.*          
⁄⁄*                                                                  *          
⁄⁄*  CAUTION: This is neither a JCL procedure nor a complete JOB.    *          
⁄⁄*  Before using this JOB step, you will have to make the following *          
⁄⁄*  modifications:                                                  *          
⁄⁄*                                                                  *          
⁄⁄*   1) Add the job parameters to meet your system requirements.    *          
⁄⁄*   2) Change the DUMPIN DSN=hlq.smfdata.input to be the name of   *          
⁄⁄*      the dataset where you currently have SMF data being         *          
⁄⁄*      recorded.                                                   *          
⁄⁄*   3) Change the STEPLIB VOL=SER=ttttt1 and VOL=SER=ttttt2 to     *          
⁄⁄*      be the volumes where these sort datasets reside.            *          
⁄⁄*   4) Change the SYSPROC DSN=hlq.rexx.dataset to be the name of   *          
⁄⁄*      the dataset where you have placed the CSFSMFR REXX sample.  *          
⁄⁄*                                                                  *          
⁄⁄*   Prior to executing this job, you need to terminate SMF         *          
⁄⁄*   recording of the currently active dump dataset for allow the   *          
⁄⁄*   unload of SMF records.                                         *          
⁄⁄*                                                                  *          
⁄⁄********************************************************************          
⁄⁄*                                                                             
⁄⁄*------------------------------------------------------------------*          
⁄⁄*   UNLOAD SMF 82 RECORDS FROM VSAM TO VBS                         *          
⁄⁄*------------------------------------------------------------------*          
⁄⁄SMFDMP   EXEC  PGM=IFASMFDP                                                   
⁄⁄DUMPIN   DD    DISP=SHR,DSN=hlq.smfdata.input                                 
⁄⁄DUMPOUT  DD    DISP=(NEW,PASS),DSN=&&VBS,UNIT=3390,                           
⁄⁄         SPACE=(CYL,(1,1)),DCB=(LRECL=32760,RECFM=VBS,BLKSIZE=4096)           
⁄⁄SYSPRINT DD    SYSOUT=*                                                       
⁄⁄SYSIN    DD    *                                                              
    INDD(DUMPIN,OPTIONS(DUMP))                                                  
    OUTDD(DUMPOUT,TYPE(82))                                                     
⁄⁄*                                                                             
⁄⁄*------------------------------------------------------------------*          
⁄⁄*   COPY VBS TO SHORTER VB AND SORT ON DATE⁄TIME                   *          
⁄⁄*------------------------------------------------------------------*          
⁄⁄COPYSORT EXEC PGM=SORT,REGION=6000K                                           
⁄⁄STEPLIB  DD DISP=SHR,DSN=SYS1.SORTLPA,VOL=SER=ttttt1,UNIT=3390                
⁄⁄         DD DISP=SHR,DSN=SYS1.SICELINK,VOL=SER=ttttt2,UNIT=3390               
⁄⁄SYSOUT   DD SYSOUT=*                                                          
⁄⁄SORTWK01 DD UNIT=3390,SPACE=(CYL,10)                                          
⁄⁄SORTIN   DD DISP=(OLD,DELETE),DSN=&&VBS                                       
⁄⁄SORTOUT  DD    DISP=(NEW,PASS),DSN=&&VB,UNIT=3390,                            
⁄⁄         SPACE=(CYL,(1,1)),DCB=(LRECL=3000,RECFM=VB)                          
⁄⁄SYSIN    DD *                                                                 
 SORT FIELDS=(11,4,A,7,4,A),FORMAT=BI,SIZE=E4000                                
⁄⁄*                                                                             
⁄⁄*------------------------------------------------------------------*          
⁄⁄*   FORMAT TYPE 82 RECORDS                                         *          
⁄⁄*------------------------------------------------------------------*          
⁄⁄FMT     EXEC PGM=IKJEFT01,REGION=5128K,DYNAMNBR=100                           
⁄⁄SYSPROC  DD DISP=SHR,DSN=hlq.rexx.dataset                                     
⁄⁄SYSTSPRT DD SYSOUT=*                                                          
⁄⁄INDD     DD DISP=(OLD,DELETE),DSN=&&VB                                        
⁄⁄OUTDD    DD SYSOUT=*                                                          
⁄⁄SYSTSIN DD *                                                                  
  %CSFSMFR

CSFSMFR - An EXEC that formats the SMF type 82 records into a readable report.