SMF utility with IRRADU00 and IRRADU86 exits

RACF SMF Data Unload Utility (IRRADU00)

The IRRADU00 Utility

Reads the SMF data as exits within the SMF dump procedure and produces a sequential data set where the output can be used to extract information.

Viewed directly. Used as Input to reporting programs. Loaded to a database manager such as DB2

Userexits to SMF utility

The RACF SMF Data Unload Utility is implemented in the form of exits USER2 and USER3 for the SMF Dump Utility (IFASMFDP). The corresponding module names are IRRADU00 and IRRADU86 respectively.

Input to utility

Type 30 Job records: Subtype 1 (Job initiation) and Subtype 5 (Job termination). Type 80 Resource access - No subtypes in record. Type 81 RACF initialization - No subtypes in record. Type 83 Data sets affected by a SECLABEL change: Subtype 1.

Record Format
Fields are decoded into a readable format (all text). Commands and events are translated into text format. ACCESS- Resource access ADDUSER- ADDUSER command DELRES- Delete Resource
Event Codes are decoded into 8-character strings. INVPSWD- Invalid password REVKUSER - User has been revoked UNDFUSER - Undefined user

Security access to SMF data

Requires READ Authority to SMF data (either live or unloaded copy).

Sample JCL
//SMFDUMP EXEC PGM=IFASMFDP //SYSPRINT DD SYSOUT=* //ADUPRINT DD SYSOUT=* //SMFDATA DD DISP=SHR,DSN=SYS3.NMC1.SMF.SMFDAY(0) //SMFOUT DD DUMMY //OUTDD DD DSN=SDO035U.SMF.UNLOADED.DATA,UNIT=SYSDA, // DISP=(NEW,CATLG,DELETE), // SPACE=(CYL,(1,1),RLSE), // DCB=(RECFM=VB,LRECL=8192) //SYSIN DD * INDD(SMFDATA,OPTIONS(DUMP)) OUTDD(SMFOUT,TYPE(000:255)) ABEND(NORETRY) USER2(IRRADU00) USER3(IRRADU86)

Sample Output
JOBINIT SUCCESS 04:08:13 2006-10-31 NMC1 SDO035U GNDCIBM NNA00040 SDO035U 04:08:13 2006-10-31 JOBINIT TERM 04:14:56 2006-10-31 NMC1 SDO035U GNDCIBM SDO025UE 04:14:44 2006-10-31 05:57:13 2006-10-31 NMC1 SDO035U GNDCIBM NNA00040 SDO035U 04:08:13 2006-10-31

JOBINIT TERM

URL to Redbook
http://www.redbooks.ibm.com/redbooks/pd fs/gg244453.pdf