Counters
All counters contain the count of events or bytes (as indicated in the Explanation column in the Tags and labels in message CZA0215I table) since BMC AMI Defender started or since the last time MODIFY STATS(RESET) was specified.
Note
If OPTIONS FORMAT(ERGO) is in effect, counters with a value of zero are not displayed, except for counters for which a zero value is a warning condition.
Counters are formatted such that the number 1234567, for example, is displayed as 1.23M. The number 1235555 is rounded up to 1.24M. The letters K, M, G, T, and P represent kilobytes, megabytes, gigabytes, terabytes, and petabytes.
The prefixes follow the International System of Units, that is, kilo means 1000, not 1024; mega means 1000000, not 1024000 or 1048576, and so forth.
Zero or non-zero values for certain counters indicate possible problems or areas of concern. These counters, if they have a problematic value, are listed in message CZA0217W. The Explanation columns in the following tables list resolution actions.
Tags and labels in the message CZA025I are presented in mixed case, as described in the TAGCase section of the "OPTIONS statement" topic.
Tags and labels in message CZA0215I
| Tag and label | Explanation |
|---|---|
| ABENDs in exit | Diagnostic counter that tallies the number of abnormal terminations in the exit If this counter is non-zero, contact BMC Support immediately. |
| API1 Driven | Number of times an application program called API1 |
| API1 Selected | Number of times that an event from API1 is queued for BMC AMI Defender |
| API7 Driven (version 5.9.02) | Number of SMF log stream records passed to the BMC AMI Defender log stream interface |
| API7 Selected (version 5.9.02) | Number of SMF log stream records selected for message processing by the BMC AMI Defender agent |
| Bytes sent | Total number of bytes of all syslog messages sent The count includes messages that were formatted and sent to TCP/IP, but that TCP/IP cannot deliver due to a network error. |
| Cell save fails | Number of times that an SMF record that would otherwise be selected has to be suppressed because no save area CPOOL cell is available This error should not occur. Contact BMC Support. |
| CPU seconds used | Number of CPU seconds consumed by BMC AMI Defender since startup or since the last STATS(RESET), as reported by the MVS macro TIMEUSED The CPU time is in seconds, to three decimal places. |
| Event anomalies | Number of event anomalies See the documentation for message CZA0253E in
Messages CZA0200 through CZA0299
|
| Event wait seconds | Number of seconds that BMC AMI Defender waits for events to process The time is in seconds, to three decimal places. The time includes a small amount of non-wait time inevitably consumed by coming out of wait state and determining what work to process. |
| Field max displace | Maximum displacement into the event record of any field that is formatted |
| Fields > length | Number of times that an event record field cannot be formatted because its location is beyond the record length |
| IEFU83 driven | Number of times that SMF is called exit IEFU83 If this counter is still zero after more than a few minutes of operation, it indicates that IEFU83 is not properly enabled in SMFPRMxx in the SYS1.PARMLIB concatenation. For more information, see EXITS parameters in the "Configuring SMF and other IBM z/OS subsystems" topic. |
| IEFU83 selected | Number of records from exit IEFU83 that is selected for formatting and forwarding as syslog messages |
| IEFU84 driven | Number of times that SMF is called exit IEFU84 If this counter is still zero after more than a few minutes of operation, it probably indicates that IEFU84 is not properly enabled in SMFPRMxx in the SYS1.PARMLIB concatenation. For more information, see EXITS parameters in the "Configuring SMF and other IBM z/OS subsystems" topic. |
| IEFU84 selected | Number of records from exit IEFU84 that is selected for formatting and forwarding as syslog messages |
| IEFU85 driven | Number of times that SMF has called exit IEFU85 If this counter is still zero after more than a few minutes of operation, it probably indicates that IEFU85 is not properly enabled in SMFPRMxx in the SYS1.PARMLIB concatenation. For more information, see EXITS parameters in the "Configuring SMF and other IBM z/OS subsystems" topic. |
| IEFU85 selected | Number of records from exit IEFU85 that is selected for formatting and forwarding as syslog messages |
| Max Syslog length | Maximum length of any syslog message formatted This number might be somewhat greater than SERVER MAXMSGLEN() because the maximum is calculated before and post-translation truncation to MAXMSGLEN. |
| Messages sent | Total number of syslog messages forwarded The count includes messages that were formatted and sent to TCP/IP, but that TCP/IP is unable to deliver due to a network error. |
| Misc sent | Number of internal messages sent (messages not derived from an SMF record) such as the initialization message and the counters message The count includes messages that were formatted and sent to TCP/IP but that TCP/IP is unable to deliver due to a network error. |
| Msgs per second | Number of syslog messages formatted by BMC AMI Defender per second This number is computed as the number of syslog messages successfully transmitted since BMC AMI Defender startup or the last STATS(RESET) divided by the number of elapsed seconds since BMC AMI Defender startup or the last STATS(RESET) formatted to three decimal places. |
| Msgs truncated | Number of syslog messages that were truncated because otherwise their length would have exceeded SERVER MAXMSGLEN Resolution: Increase SERVER MAXMSGLEN, or decrease the number of fields formatted per SMF record. Message CZA0301W that is both printed on CZAPRINT and sent to the syslog receiver, indicates the SMF record type that exceeded MAXMSGLEN. |
| Msgs with sub | Number of syslog messages for which z/OS Unicode Services reported that a character could not be translated from EBCDIC to the specified code page Resolution: See the discussion of OPTIONS XLATE in Parameter file statements. |
| Queue capacity | Configured size of the queue in bytes Note The queue capacity is specified in mebibytes but displayed in this counter in bytes, so a specified queue size of 12 mebibytes is displayed here as 12.58M (12 * 1,048,576 = 12,582,912). |
| Queue events purged | Number of events purged from the queue because queue space is not available for more recent incoming events If this counter is non-zero other than following a TCP connection outage refer to Determining the QUEUE64 size. This counter is formatted and included in the statistics even if its value is zero. |
| Queue purge empty | Internal diagnostic counter that tallies the number of times that the exit’s queue purge logic encountered an empty queue |
| Queue purge incmplt | Internal diagnostic counter that tallies the number of times that the exit’s queue purge logic encountered a record that is not completely moved in by the exit |
| Queue rent by Exit | Internal diagnostic counter that counts the number of times that queue allocation logic in the exit was reentered by another task or processor |
| Queue utilization | Percentage of queue utilization The number of queued bytes divided by the size of the queue, expressed as a percentage. |
| Queued bytes | Approximate1 number of bytes currently in the event queue The number includes compressed DB2 SMF records for suppressed IFCIDs. |
| Queued events | Approximate1 number of SMF and API1 records currently in the event queue The number includes compressed DB2 SMF records for suppressed IFCIDs. |
| Queued max bytes | Approximate1 maximum number of bytes in the event queue during the interval since the last statistics reset The number includes compressed DB2 SMF records for suppressed IFCIDs. |
| Queued max events | Approximate1 maximum number of SMF and API1 records in the event queue during the interval since the last statistics reset The number includes compressed DB2 SMF records for suppressed IFCIDs. |
| Queued suppressed | Number of DB2 compressed SMF records that were decompressed to determine their IFCID number and then suppressed due to IFCID number suppression To determine the IFCID number of a compressed DB2 SMF record, you must decompress the record. Compressed DB2 SMF records are decompressed directly into the queue, on the assumption that they are requested, to save overhead. The counter represents the number of compressed DB2 SMF records that, after decompression, are for a suppressed IFCID number. |
| Save area Cells | Number of cells allocated in the save area CPOOL |
| Swapped no work | Number of times that the exit code queued a message and found that BMC AMI Defender was idle and had been swapped out by z/OS z/OS swapping is discussed in the IBM manual z/OS MVS Initialization and Tuning Guide. |
| Swapped with work | Number of times that the exit code queued a message and found that BMC AMI Defender is swapped out by z/OS and already have at least one SMF record queued for formatting as a syslog message An excessive value for this counter, in conjunction with problem counters such as Cell recd fails or Cell save fails with non-zero values, or Record Cells with an excessive value, might indicate that z/OS swapping is causing BMC AMI Defender processing to be delayed, resulting in excessive QUEUE buffer usage. See Determining Optimal QUEUE Values. |
TCP sessions | Number of separate TCP/IP sessions bound |
TCP stack seconds | Time in seconds that BMC AMI Defender is in the TCP stack The time is reported in seconds to three decimal places. The time primarily represents TCP block time: time during that BMC AMI Defender is unable to transmit a message due to network congestion, plus a small amount of TCP processing time. Any TCP stack time in excess of about 50 milliseconds per thousand records probably represents the effect of network congestion. |
TCP xmit errors | Number of transmission errors reported by TCP/IP Resolution: Attempt to resolve the network error. See the explanation of SERVER TIMEOUT(IDLE()) under Parameter file statements |
Total selected len | Total of the lengths of all SMF and API records selected (such as, if RACF .0 events is configured with a severity of SUPpress they are not included) and before the effects of any FILTER It is the sum of the lengths of all of the records represented by the IEFU8x and API selected counters. The sum does not include any suppressed DB2 IFCIDs. |
Type xxx2 bytes | Sum of the lengths of all messages sent that are derived from a Type xxx SMF or API1 record |
Type xxx2 filt | Number of records of type xxx that were filtered out, or is filtered out except for TRACE(FILTER) For more information, see Filtering in and filtering out events. |
Type xxx2 max | Length of the longest type xxx record selected |
Type xxx2 msgs | Number of messages sent that are derived from a type xxx record |
X-mem POST fails | Number of times that z/OS reported a failure of the cross-memory POST from the exit to the communication code Resolution: This is a should not occur error – please contact BMC support. |
1 The queued and queued max bytes and events counters are typically one event record low. When the counters are interrogated, an event typically has just been removed from the queue for processing. These counters might be zero even though an event is processed. On the other hand, queued and queued max bytes might be greater than the sum of the lengths of all event records in the queue. Greater values can result from padding bytes and because of space left over at the end of the queue when the queue wraps around to the beginning.
2 For the type xxx counter tags, xxx represents an event type name such as 80 for SMF 80 or IND$FILE for EVENT IND$FILE. Event type names longer than 8 bytes are truncated to 8 bytes.
Counters for BMC AMI Defender for Db2
DAM messages are referred to the counters as Type DAM. The following counters are specific to the DAM package:
Tag and label in message CZA0215I | Explanation |
|---|---|
DAM Sess Connect | Number of session-connect messages that are sent to the DAM console |
DAM Sess Disconnect | Number of session-disconnect messages (including any session-disconnect messages that resulted from a session timeout) that were sent to the DAM console |
DAM Sess Timeout | Number of DAM sessions terminated due to timeout |
DAM Statements | Number of statement-exec messages that are sent to the DAM console |
DAM Xactn Begin | Number of trans-start messages that are sent to the DAM console |
DAM Xactn Complete | Number of trans-end messages (including any trans-end messages that resulted from a session timeout) that are sent to the DAM console |
Type DAM bytes | The sum of the lengths of all messages sent that are derived from a type DAM SMF record |
Type DAM filtered | Number of Type DAM SMF records that are filtered out (or is filtered out except for TRACE(FILTER)) See Filtering events with FILTER and MATCH. |
Type DAM max | Length of the longest Type DAM SMF record selected |
Type DAM msgs | Number of DAM messages sent |
Comments
Log in or register to comment.