Using system management facilities (SMF)

To perform accounting for UNIX workloads, use system management facilities (SMF). Basic accounting models that use address-space level data from SMF type 30 records should work correctly for UNIX processes. Be aware that:

The TCB time in SMF type 30 record includes the time in the kernel address space.
The address-space level EXCP (I/O) count includes the I/O for UNIX files.
If the program in a user address space issues fork(), the child inherits the TSO/E user ID and the UID.

To weigh central processor time or I/O or both, use the fields in SMF type 30 records to isolate the resources used. Record type 30 also includes the user identification fields:

UID
GID
Process ID (PID)
Parent process ID (PPID)
Process group ID (PGID)
Session ID (SID)

For detailed file system and file open and close activity data, look in SMF record type 92.

When you perform the accounting, one other major factor to be aware of is that the exec() family of functions typically causes step termination and a new substep is started. The new substep still has the same step number, but the substep number is incremented. Therefore, accounting applications must look for substep_number in addition to job name, job_start_time, and step_number.

The kernel creates other address spaces, such as BPXOINIT, and forks other programs—for example, /etc/init. The kernel and all its child processes use the same account number. BPXOINIT is the source of the account number propagated to the /etc/rc and daemons.

Because the kernel is a started procedure, you can assign accounting data only by coding a JCL installation exit. Alternatively, you can allow the resources used by the kernel and its forked address spaces to be accounted for as system overhead.