General SMF record type statement

SMF 00—IPL 
(version 5.9.02)

SMF type 00 records are written at SMF initialization, usually after IPL. The record contains the virtual and central storage settings and some SMF options at IPL time.

SMF 07 statement

SMF type 07 records are written each time all SMF buffers become full, either as a result of no available output data sets for SMF to write to, or the system generating records faster than SMF can physically write them. Monitoring SMF 07 records helps to monitor system integrity.

SMF 08—I/O Configuration
(version 5.9.02)

SMF type 08 records are written after the IPL is complete. The record contains all the online devices at IPL time.

SMF 09—VARY Device ONLINE
(version 5.9.02)

SMF type 09 records are written when a VARY ONLINE command is processed. The record identifies the device being added to the system configuration.

SMF 11—VARY Device OFFLINE
(version 5.9.02)

SMF type 11 records are written when a VARY OFFLINE command is processed. The record identifies the device being removed from the system configuration.

SMF 14 statement

SMF 15 statement

SMF type 15 records are written each time that a non-VSAM direct access, VIO, or tape data set that is defined by a DD statement or dynamic allocation and opened for OUTPUT, UPDAT, INOUT, or OUTIN is closed or processed by end-of-volume (EOV). Monitoring SMF type 15 records can be an important part of file integrity monitoring, as it records the modification (or potential modification) of non-VSAM data sets.

SMF 17 statement

SMF type 17 records are written when a DASD data set (temporary or not) is scratched. Monitoring type 17 records can play a part in file integrity monitoring.

SMF 18 statement

SMF type 18 records are written each time that a non-VSAM data set defined by a DD statement (either explicitly or implicitly) is renamed.

SMF 42 statement

SMF type 42 records are written each time that the DFSMS (the Data Facility Storage Management Subsystem of z/OS) macro STOW or DESERV is used to add, delete, rename, or replace a member of a PDS or PDSE, or that the STOW macro is used to initialize (delete all members of) a PDS or PDSE directory. Monitoring SMF type 42 records can be an important part of file integrity monitoring, as most z/OS system parameter files are PDS or PDSE members.

Default subtype severity:

• Subtypes 20, 21, 24, and 25 have the default value INFORMATIONAL.
• All other subtypes have the default value SUPPRESS.

SMF 43—JES2 and JES3 Start
(version 5.9.02)

SMF type 43 records are written when the S JESn command is issued. The record contains the warm start indicator and start options.

SMF 60 statement

SMF 61 statement

SMF type 61 records are written for any DEFINE requests to catalog management services. Monitoring type 61 records can play a part in file integrity monitoring.

SMF 62 Statement

SMF type 62 records are written for every successful or unsuccessful opening of a VSAM component or cluster. The information in the SMF type 62 records complements the file integrity monitoring information in SMF type 64 records.

SMF 64 statement

SMF type 64 records are written each time that a VSAM component or cluster (including catalogs) is closed, or VSAM attempts to switch to another volume for processing. Monitoring SMF type 64 records can be an important part of file integrity monitoring, as it records the modification (or potential modification) of VSAM components and clusters.

SMF 65 statement

SMF type 65 records are written for all DELETE requests to Catalog Management Services. Monitoring type 65 records can play a part in file integrity monitoring.

SMF 66 statement

SMF type 66 records are written for all ALTER request to Catalog Management Services. Monitoring type 66 records can play a part in file integrity monitoring.

SMF 70—RMF Processor Activity

Reports measurement data for general purpose, cryptographic, logical partitions and internal coupling facility processors and accelerators

SMF 71—RMF Paging Activity

Reports paging demands and utilization of central, expanded and external storage

SMF 72—RMF Workload, Storage and Serialization Activity

Reports workload service class statistics along with storage utilization and serialization delays

SMF 73—RMF Channel Path Activity

Reports individual channel path activity

SMF 74—RMF Activity of Resources

Reports individual hardware device activity

SMF limits record sizes to 32 K. A large number of devices in an environment can cause the record to exceed this size. Consequently, RMF writes multiple records for any given subtype. The multiple records can exceed the MAXMSGLEN (message) buffer size specification and result in CZA0301W messages. You can expand the message buffer size, and you can limit the number of fields passed to the SIEM by commenting unnecessary fields in the amihlq.CZAGENT.CNTL(CZPRMF) member.

SMF 75—RMF Page Data Set Activity

Reports auxiliary storage page slot usage

SMF 76—RMF Trace Activity

Reports field name trace minimum and maximum values

SMF 77—RMF Enqueue Activity

Reports enqueue and dequeue contention information

SMF 78—RMF Monitor I Activity

Reports virtual and common storage usage and I/O queuing activity

SMF 79—RMF Monitor II Activity

Reports detailed address space monitoring information such as enqueue contention, storage and processor activity, paging activity, device and path activity, and I/O queuing activity

SMF 82—ICSF Record
(version 5.9.02)

SMF type 82 records are written at the completion of an Integrated Cryptographic Service Facility (ICSF) function. The record contains specific information about the ICSF function performed and its status.

SMF 90 statement

SMF type 90 records are written in response to certain operator commands. All of the subtypes of SMF 90 have a default severity value INFORMATIONAL.

SMF 92 statement

SMF type 92 records are written to record activity (open and close) for mounted file systems and files (zFS and HFS). Type 92 records extend zDefender’s file integrity monitoring to UNIX file system files.

Default subtype severity:

• Subtypes 10, 11, 14, 15, and 16 have the default value INFORMATIONAL.
• All other subtypes have the default value SUPPRESS.

SMF 109 Statement

SMF type 109 records are written to log USS Syslogd messages.

SMF 113—Hardware Capacity
 (version 5.9.02)

Provides hardware capacity, reporting, and statistics information about the central processor complex (CPC)

SMF 115—MQ Performance Statistics

Reports usage and performance data for the message, buffer, lock, storage, coupling facility, log manager, and Db2 manager

SMF 116—MQ Websphere Accounting Statistics

Reports message manager, message queue, and message channel accounting information

SMF 119 Statement

If properly configured, TCP or IP writes activity records as SMF type 119 records. You can also monitor type 119 records to maintain an audit trail where individuals and processes accessed resources through TCP or IP.

Default subtype severity:

• Subtypes 2, 21, and 23 have the default value INFOrmational.
• Subtypes 1, 3, 8, 11, 12, 20, 22, 70, 81, 102, and 103 have the default value NOTICE.
• Subtype 72 has the default value ERROR.
• All other subtypes have the default value SUPPRESS.

SMF ABEND-AID statement

Compuware Abend-AID SMF records, by default SMF record type 205, can be written by the Compuware Abend-AID product. See the appropriate Compuware Abend-AID documentation.

SMF APP_AUDIT statement

Compuware Application Audit SMF records, by default SMF record type 220, can be written by the Compuware Application Audit product. See the appropriate Compuware Application Audit documentation.

SMF CORRELOG statement

SMF DIAG statement

The SMF DIAG statement is intended for diagnostic purposes. The default severity value is DEBUG. 

SMF ABEND-AID(recordtype)

Must code as shown

Code a single numeric value between 128 and 255. If the record type is omitted, the default value is 205.

SMF APP_AUDIT(recordtype)

Must code as shown

Code a single numeric value between 128 and 255. If the record type is omitted, the default value is 220.

SMF CORRELOG(recordtype)

Must code as shown

Code a single numeric value between 128 and 255. If the record type is omitted, the default value is 202.

SMF DIAG(recordtype)

Must specify as shown

There is no default for the SMF record type. For record type code a single numeric value between 0 and 255 indicating the SMF record type you want to monitor. If you code more than one SMF statement for the same record type, then a subsequent SMF statement for the same record type replaces any SMF statement(s) for that record type that came before.

FACILITY(facility-name)

Specifies the RFC 3164 facility that is to be indicated as the origin of the syslog messages corresponding to the indicated SMF records

If you omit this parameter, the default value is LOGALERT or as shown in the table. If you want a different facility indicated, code one of the RFC 3164 facility names as listed in Syslog-facilities-and-severities.

FIELDs(fieldname…)

Filter-specification

See FILTER-and-MATCH-parameters.

INHibit

LOG
 or

LOG(HEX)

PROCess(‘process-tag’)

Specifies the tag that appears at the start of the syslog messages for the indicated SMF record type, following the priority, timestamp, and hostname, and preceding the formatted fields

Specify the exact process tag that you want to include in syslog messages including any spaces and punctuation. A process tag can be any length from the null string (‘’) to 32 characters. If PROCess is omitted, the default value is as indicated and followed by the leading delimiter from OPTIONS DELIM.

SEVerity(severity)

Specifies the syslog severity (for record types without subtypes) or the default severity (for record types with subtypes)

See Syslog-facilities-and-severities. You can also code SUPPRESS. SUPPRESS indicates that the default is that records are not to be formatted and forwarded to the syslog server at all. If you omit SEVerity, the default value is as described under each record-type description.

SUBTypes

subtype

subtype:subtype

SEVerity(severity)