Preparing the Configuration Tool to support SMF record types for Z Operations Analytics

If you plan to send System Management Facilities (SMF) data to IBM® Z Operations Analytics, you must prepare the IBM Z Common Data Provider Configuration Tool to support the SMF record types that are destined for IBM Z Operations Analytics. You must complete this task before you create any policies that define SMF data streams with IBM Z Operations Analytics as the target destination.

1. Depending on your platform, copy the specified file from the IBM Z Operations Analytics installation directory to the working directory for the IBM Z Common Data Provider Configuration Tool.

   If you are sending SMF data to IBM Z Operations Analytics on both the IBM Operations Analytics - Log Analysis platform AND the Elastic Stack or Splunk platform

   If you want to send SMF data from a single IBM Z Common Data Provider instance to IBM Z Operations Analytics on both the IBM Operations Analytics - Log Analysis platform and the Elastic Stack or Splunk platform, copy the glaELKSplunk.streams.json file.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the glaELKSplunk.streams.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/streams/glaELKSplunk.streams.json 
      config_tool_workdir

   Important: If you are using the file glaELKSplunk.streams.json, the file glasmf.streams.json must not be in the working directory for the IBM Z Common Data Provider Configuration Tool.

   The following SMF record types are not supported on the IBM Operations Analytics - Log Analysis platform:

   • SMF100_1
   • SMF101_SUMMARY
   • SMF110_1_SUMMARY

   Table 1 indicates the differences between the data source types that are defined in the glasmf.streams.json file and the glaELKSplunk.streams.json file. These differences are relevant only if you were previously using the glasmf.streams.json file and must therefore migrate data to the glaELKSplunk.streams.json file. These differences do not affect your existing data, but you might need to update any custom dashboards or searches to reflect the new data source types.

   Table 1. Differences between the data source types that are defined in the glasmf.streams.json file and the glaELKSplunk.streams.json file

   Data source name	Data source type in glasmf.streams.json	Data source type in glaELKSplunk.streams.json
   SMF80_COMMAND	zOS-SMF80	zOS-SMF80_COMMAND
   SMF80_LOGON	zOS-SMF80	zOS-SMF80_LOGON
   SMF80_OPERATION	zOS-SMF80	zOS-SMF80_OPERATION
   SMF80_OMVS_RES_1	zOS-SMF80	zOS-SMF80_OMVS_RES_1
   SMF80_OMVS_RES_2	zOS-SMF80	zOS-SMF80_OMVS_RES_2
   SMF80_OMVS_SEC_1	zOS-SMF80	zOS-SMF80_OMVS_SEC_1
   SMF80_OMVS_SEC_2	zOS-SMF80	zOS-SMF80_OMVS_SEC_2
   SMF80_RESOURCE	zOS-SMF80	zOS-SMF80_RESOURCE
   SMF120_REQAPPL	zOS-SMF120	zOS-SMF120_REQAPPL
   SMF120_REQCONT	zOS-SMF120	zOS-SMF120_REQCONT

   If you are sending SMF data to IBM Z Operations Analytics on only the IBM Operations Analytics - Log Analysis platform

   Copy the glasmf.streams.json file.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the glasmf.streams.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/streams/glasmf.streams.json 
      config_tool_workdir

   Important: If you are using the file glasmf.streams.json, the file glaELKSplunk.streams.json must not be in the working directory for the IBM Z Common Data Provider Configuration Tool.

   If you are sending SMF data to IBM Z Operations Analytics on either the Elastic Stack or Splunk platform

   Copy the glaELKSplunk.streams.json file.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the glaELKSplunk.streams.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/streams/glaELKSplunk.streams.json 
      config_tool_workdir

   Important: If you are using the file glaELKSplunk.streams.json, the file glasmf.streams.json must not be in the working directory for the IBM Z Common Data Provider Configuration Tool.

   If you are sending SMF data to the IBM Z Operations Analytics machine learning system

   The following files must be in the working directory for the IBM Z Common Data Provider Configuration Tool:

   glaDb2_ML.streams.json

   This file includes required data for configuring IBM Z Operations Analytics machine learning system streams that contain IBM Db2® for z/OS® data.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the glaDb2_ML.streams.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/streams/glaDb2_ML.streams.json 
      config_tool_workdir

   glaCICS_ML.streams.json

   This file includes required data for configuring IBM Z Operations Analytics machine learning system streams that contain IBM CICS® Transaction Server for z/OS data.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the glaCICS_ML.streams.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/streams/glaCICS_ML.streams.json 
      config_tool_workdir

   izoa.protocols.json

   This file includes required data for configuring the IBM Z Operations Analytics enterprise data warehouse subscribers to receive data from the IBM Z Operations Analytics machine learning system.

   Tip: From UNIX System Services, use the following sample command, with the appropriate values for your environment, to copy the izoa.protocols.json file:

   cp /usr/lpp/IBM/zoa/V4R1M0/zcdp/protocols/izoa.protocols.json   
      config_tool_workdir

2. Verify that the concats.json file is in the working directory for the IBM Z Common Data Provider Configuration Tool. Also, verify that the file contains the appropriate values for your installation, as described in the following example:

   Line in concats.json file	Explanation
   "CDP" : "CDP.SHBODEFS"	A reference to the SHBODEFS data set that is installed with IBM Z Common Data Provider. The value in quotation marks (in this example, CDP.SHBODEFS) must be the data set name for your installation.
   "IZOA" : "ZOA.V4R1M0.SGLADEFS"	A reference to the SGLADEFS data set that is installed with IBM Z Operations Analytics. The value in quotation marks (in this example, ZOA.V4R1M0.SGLADEFS) must be the data set name for your installation.