Customizing required events with SELECT
A SWITCH setting controls every SMF record and EVENT processed by the BMC AMI Datastream for z/OS agent. Comment or uncomment the switch by adding or removing a semicolon from column 1 of the $$$CONFG member.
To specify the selection categories you want to enable, you modify the $$$CONFG member, but to disable specific SMF record types or events within a category, you modify the $$$SELCT member.
For example, you can enable the DEVICE category that includes SMF record types 8, 9, 11 and 22. If you want notification only when new devices are varied online and offline (that is, only for SMF 9 and 11), you can comment out the SMF 8 and 22 record selection in the $$$SELCT member.
The following code is an example of the $$$SELCT member:
;**********************************************************************;
;**********************************************************************;
; $$$SELCT: User agent parameter member for BMC AMI Datastream ;
; This is a copy of CZASELCT and made available for ;
; user modification. It will be included in CZAPARMS ;
; SIEMTYPE-independent ;
; Copyright (c) 2014-2025 BMC Software, Inc. ;
;**********************************************************************;
;**********************************************************************;
SAY "v7.1.02 Updated 19 Nov 2024"
; ---------------------------------------------------------------------
; SELECT: Comment out the SELECT statements for the event types you
; do not wish to process. To comment out a statement, type a semi-
; colon (;) in column 1. See the AMI Datastream referene manual for
; information concerning the SELECT statement.
; ---------------------------------------------------------------------
SELECT IF(BACKLOG) EVENT(BACKLOG) ; BACKLOG messages
SELECT IF(CONSOLE) EVENT(CONSOLE) ; Selected CONSOLE messages
SELECT IF(GENERIC) EVENT(GENERIC) ; For LOADFILE
SELECT IF(IND$FILE) EVENT(IND$FILE) ; API1 IND$FILE
SELECT IF(JOBLOG) EVENT(JOBLOG) ; BMC AMI JOBLOG - SYSOUT
SELECT IF(LSPACE) EVENT(LSPACE) ; DASD Freespace Monitoring
SELECT IF(MODIFY) EVENT(MODIFY) ; MODIFY from API1--see manual
SELECT IF(ChangeMan) EVENT(ChangeMan) ; Micro Focus (Serena) ChangeMan
SELECT IF(LOG4J) EVENT(LOG4J) ; Log4j data from LOADFILE
SELECT IF(SPM) EVENT(SPM) ; Policy Manager
SELECT IF(SIV) EVENT(SIV) ; System Integrity Violations
SELECT IF(SRCC) EVENT(SIVSRC) ; Proclib/Parmlib changes
SELECT IF(SRCC) EVENT(SRCCOMP) ; Proclib/Parmlib changes
SELECT IF(LOADFILE) EVENT(LOADFILE) ; User Message Events
; VM Events
SELECT IF(VMCON) EVENT(VMCONSOLE) ; VM Console Messages
SELECT IF(VMSEC) EVENT(VMSECURE) ; VM Console Messages
SELECT IF(VMRACF) EVENT(VMRACF) ; VM SMF 80 RACF fields
; BMC AMI Datastream for IMS
SELECT IF(IMSLOG) EVENT(IMS_1_3) ; IMS Input/Output Msg 01/03
SELECT IF(IMSLOG) EVENT(IMS_10) ; Security violation IMS 10
SELECT IF(IMSLOG) EVENT(IMS_16) ; Signin/Signout IMS 16
SELECT IF(IMSLOG) EVENT(IMS_22) ; IMS Type2 log command
SELECT IF(IMSLOG) EVENT(IMS_24) ; DB I/O Error
SELECT IF(IMSLOG) EVENT(IMS_50) ; Database Updates
SELECT IF(IMSLOG) EVENT(IMS_C0) ; BMC COPE IMS records
SELECT IF(IMSLOG) EVENT(IMS_F8) ; BMC AMI Datastream for IMS
SELECT IF(IMSLOG) EVENT(IMS_F9) ; BMC AMI Ops
SELECT IF(IMSLOG) EVENT(IMS_FA) ; BMC AMI Ops
; BMC AMI Datastream for IMS Connect
SELECT IF(IMSConn) EVENT(ICON_01) ; Region initialization mapping
SELECT IF(IMSConn) EVENT(ICON_02) ; Region termination mapping
SELECT IF(IMSConn) EVENT(ICON_16) ; DataStore becomes available mapping
SELECT IF(IMSConn) EVENT(ICON_17) ; DataStore becomes unavailable mapping
SELECT IF(IMSConn) EVENT(ICON_18) ; IMS Tmember joins XCF group mapping
SELECT IF(IMSConn) EVENT(ICON_19) ; IMS Tmember leaves XCF group mapping
SELECT IF(IMSConn) EVENT(ICON_28) ; Begin SSL Open mapping
SELECT IF(IMSConn) EVENT(ICON_29) ; End SSL Open mapping
SELECT IF(IMSConn) EVENT(ICON_32) ; Begin SSL close mapping
SELECT IF(IMSConn) EVENT(ICON_33) ; End SSL close mapping
SELECT IF(IMSConn) EVENT(ICON_41) ; Begin ODB registration mapping
SELECT IF(IMSConn) EVENT(ICON_42) ; End ODB registration mapping
SELECT IF(IMSConn) EVENT(ICON_43) ; Begin ODB de-registration mapping
SELECT IF(IMSConn) EVENT(ICON_44) ; End ODB de-registration mapping
SELECT IF(IMSConn) EVENT(ICON_63) ; Begin SAF SEC REQ
SELECT IF(IMSConn) EVENT(ICON_64) ; End SAF SEC REQ
SELECT IF(IMSConn) EVENT(ICON_69) ; OTMA Timeout
SELECT IF(IMSConn) EVENT(ICON_71) ; Session Error
SELECT IF(IMSConn) EVENT(ICON_91) ; DRDA command(SEC Info)
SELECT IF(IMSConn) EVENT(ICON_92) ; DRDA reply
SELECT IF(IMSConn) EVENT(ICON_99) ; Enter Security Exit
SELECT IF(IMSConn) EVENT(ICON_100) ; Return from SEC Exit
SELECT IF(IMSConn) EVENT(ICON_255) ; ICON Refresh RACF UID
; AMI Ops
SELECT IF(AMIOPS) EVENT(AO0100) ; AMI Ops 0100 z/OS data
SELECT IF(AMIOPS) EVENT(AO0200) ; AMI Ops 0200 Auto Operator data
SELECT IF(AMIOPS) EVENT(AO0009) ; AMI Ops for IP
SELECT IF(AMIOPS) EVENT(AO000A) ; AMI Ops for Java Environments
; Compuware
SELECT IF(Abend-AID) SMF(Abend-AID) ; Compuware Abend-AID
SELECT IF(SessMon) SMF(SessMon) ; BMC Security Session Monitor
SELECT IF(Action) SMF(eventAction) ; Action Software eventACTION
SELECT IF(BMCAMI) SMF(CorreLog) ; BMC AMI IND$FILE SMF 202 records
SELECT IF(DIAG) SMF(DIAG) ; Diagnostic message display
SELECT IF(SS) SMF(SS) ; SuperSession SMF records
; BMC AMI Storage IAM
SELECT IF(IAM) SMF(IAM) ; BMC AMI Storage IAM
; BMC AMI OpsM for IMS SMF record
SELECT IF(AOPSMIMS) SMF(AOPSIMS) ; BMC AMI OpsM for IMS SMF rec
; Operations events
SELECT IF(OPS) SMF(0) ; status IPL
SELECT IF(OPS) SMF(30) ; Common address space
SELECT IF(OPS) SMF(90) ; status SYSTEM
SELECT IF(OPS) SMF(7) ; SMF Lost Data
; Operations events - VSAM
SELECT IF(VSAM) SMF(60) ; VSAM volume data set updated
SELECT IF(VSAM) SMF(62) ; VSAM Compo or Cluster Opened
SELECT IF(VSAM) SMF(64) ; VSAM Compo or Cluster Sts
; Operations events - ICF
SELECT IF(ICF) SMF(61) ; ICF Define activity
SELECT IF(ICF) SMF(65) ; ICF Delete activity
SELECT IF(ICF) SMF(66) ; ICF Alter activity
; Device management
SELECT IF(DEVICE) SMF(8) ; I/O Configuration
SELECT IF(DEVICE) SMF(9) ; VARY Device ONLINE
SELECT IF(DEVICE) SMF(11) ; VARY Device OFFLINE
SELECT IF(DEVICE) SMF(22) ; Configuration
; DIV objects and VLF stats
SELECT IF(DIVVLF) SMF(41) ; DIV objects and VLF stats
SELECT IF(DFSORT) SMF(16) ; DFSORT SMF 16 records
SELECT IF(TSO) SMF(32) ; TSO/E User Work Accounting
SELECT IF(CRYPTO) SMF(82) ; Int. Crypto. Services Facility
SELECT IF(SYSLOGGER) SMF(88) ; System Logger SMF type 88
SELECT IF(DB2) SMF(DB2) ; DB2 events (SMF 100, 101, 102)
SELECT IF(USS) SMF(109) ; USS Syslog
SELECT IF(CICS) SMF(110) ; CICS events
SELECT IF(CICS) SMF(111) ; CICS TG Statistics events
SELECT IF(TSO) SMF(119) ; TSO signon events
SELECT IF(HFTS) SMF(98) ; HFTS data SMF 98
SELECT IF(SRMC) SMF(99) ; SRM data SMF 99
; File access monitoring
SELECT IF(FAM) SMF(14) ; INP/RDBACK DS activity
SELECT IF(FAM) SMF(15) ; OUTPUT/UPD/INOUT/OUT DS Acti
SELECT IF(FAM) SMF(17) ; Scratch Data Set Sts
SELECT IF(FAM) SMF(18) ; Rename Non-VSAM DS Sts
SELECT IF(FAM) SMF(42) ; DFSMS stats and config
SELECT IF(FAM) SMF(92) ; zFS - File system activity
SELECT IF(JES) SMF(26) ; JES2/3 - Purge
SELECT IF(JES) SMF(43) ; JES2/3 - Startup
SELECT IF(JES) SMF(55) ; JES2/3 - Network Signon
SELECT IF(JES) SMF(56) ; JES2/3 - Network Integrity
SELECT IF(JES) SMF(57) ; JES2/3 - Network Transmission
SELECT IF(JES) SMF(58) ; JES2/3 - Network Signoff
SELECT IF(JES) SMF(84) ; JES2/3 - Monitor
SELECT IF(RMF) SMF(70) ; RMF Processor Activity
SELECT IF(RMF) SMF(71) ; RMF Paging Activity
SELECT IF(RMF) SMF(72) ; RMF Wrkload,Stg,Serialization
SELECT IF(RMF) SMF(73) ; RMF Channel Path Activity
SELECT IF(RMF) SMF(74) ; RMF Activity of Resources
SELECT IF(RMF) SMF(75) ; RMF Page Data Set Activity
SELECT IF(RMF) SMF(76) ; RMF Trace Activity
SELECT IF(RMF) SMF(77) ; RMF Enqueue Activity
SELECT IF(RMF) SMF(78) ; RMF Monitor I Activity
SELECT IF(RMF) SMF(79) ; RMF Monitor II Activity
SELECT IF(RACF) SMF(80) ; RACF Security events
SELECT IF(RACF) SMF(81) ; RACF Initialization
SELECT IF(RACF) SMF(83) ; RACF Audit Record
SELECT IF(RACF) SMF(1154) ; RACF Compliance Record
SELECT IF(TOPSECRET) SMF(TSS80) ; TSS Security events
SELECT IF(TOPSECRET) SMF(TSS231) ; TSS Security events
SELECT IF(ACF2) SMF(ACF2) ; ACF2 Security data
SELECT IF(SMF89) SMF(89) ; Product Usage data
SELECT IF(IBMHttp) SMF(103) ; IBM HTTP Server
SELECT IF(HMC) SMF(106) ; HMC BCPii
SELECT IF(MQ) SMF(115) ; MQ Events - MQSeries Statistics
SELECT IF(MQ) SMF(116) ; MQ Events - MQ Accounting
SELECT IF(SMF113) SMF(113) ; Hardware Capacity
SELECT IF(WebSphere) SMF(120) ; WebSphere
SELECT IF(CD) SMF(132) ; Connect Direct
SELECT IF(PAM) SMF(175) ; Privileged Access Manager
SELECT IF(FAM) SMF(36) ; Enable SMF36 ICF Catlog export
SELECT IF(SMF123) SMF(123) ; API Request data
; Enable Sub System Command Intercept Event
SELECT IF(SSCmd) EVENT(SSCmd) ; Enable Sub System Command Intercept
; Enable RACF Command Intercept Event
SELECT IF(RACFCmd) EVENT(RACFCmd) ; Enable RACF Command Intercept
;**********************************************************************;
; $$$SELCT: User agent parameter member for BMC AMI Datastream ;
; This is a copy of CZASELCT and made available for ;
; user modification. It will be included in CZAPARMS ;
; SIEMTYPE-independent ;
; Copyright (c) 2014-2025 BMC Software, Inc. ;
;**********************************************************************;
;**********************************************************************;
SAY "v7.1.02 Updated 19 Nov 2024"
; ---------------------------------------------------------------------
; SELECT: Comment out the SELECT statements for the event types you
; do not wish to process. To comment out a statement, type a semi-
; colon (;) in column 1. See the AMI Datastream referene manual for
; information concerning the SELECT statement.
; ---------------------------------------------------------------------
SELECT IF(BACKLOG) EVENT(BACKLOG) ; BACKLOG messages
SELECT IF(CONSOLE) EVENT(CONSOLE) ; Selected CONSOLE messages
SELECT IF(GENERIC) EVENT(GENERIC) ; For LOADFILE
SELECT IF(IND$FILE) EVENT(IND$FILE) ; API1 IND$FILE
SELECT IF(JOBLOG) EVENT(JOBLOG) ; BMC AMI JOBLOG - SYSOUT
SELECT IF(LSPACE) EVENT(LSPACE) ; DASD Freespace Monitoring
SELECT IF(MODIFY) EVENT(MODIFY) ; MODIFY from API1--see manual
SELECT IF(ChangeMan) EVENT(ChangeMan) ; Micro Focus (Serena) ChangeMan
SELECT IF(LOG4J) EVENT(LOG4J) ; Log4j data from LOADFILE
SELECT IF(SPM) EVENT(SPM) ; Policy Manager
SELECT IF(SIV) EVENT(SIV) ; System Integrity Violations
SELECT IF(SRCC) EVENT(SIVSRC) ; Proclib/Parmlib changes
SELECT IF(SRCC) EVENT(SRCCOMP) ; Proclib/Parmlib changes
SELECT IF(LOADFILE) EVENT(LOADFILE) ; User Message Events
; VM Events
SELECT IF(VMCON) EVENT(VMCONSOLE) ; VM Console Messages
SELECT IF(VMSEC) EVENT(VMSECURE) ; VM Console Messages
SELECT IF(VMRACF) EVENT(VMRACF) ; VM SMF 80 RACF fields
; BMC AMI Datastream for IMS
SELECT IF(IMSLOG) EVENT(IMS_1_3) ; IMS Input/Output Msg 01/03
SELECT IF(IMSLOG) EVENT(IMS_10) ; Security violation IMS 10
SELECT IF(IMSLOG) EVENT(IMS_16) ; Signin/Signout IMS 16
SELECT IF(IMSLOG) EVENT(IMS_22) ; IMS Type2 log command
SELECT IF(IMSLOG) EVENT(IMS_24) ; DB I/O Error
SELECT IF(IMSLOG) EVENT(IMS_50) ; Database Updates
SELECT IF(IMSLOG) EVENT(IMS_C0) ; BMC COPE IMS records
SELECT IF(IMSLOG) EVENT(IMS_F8) ; BMC AMI Datastream for IMS
SELECT IF(IMSLOG) EVENT(IMS_F9) ; BMC AMI Ops
SELECT IF(IMSLOG) EVENT(IMS_FA) ; BMC AMI Ops
; BMC AMI Datastream for IMS Connect
SELECT IF(IMSConn) EVENT(ICON_01) ; Region initialization mapping
SELECT IF(IMSConn) EVENT(ICON_02) ; Region termination mapping
SELECT IF(IMSConn) EVENT(ICON_16) ; DataStore becomes available mapping
SELECT IF(IMSConn) EVENT(ICON_17) ; DataStore becomes unavailable mapping
SELECT IF(IMSConn) EVENT(ICON_18) ; IMS Tmember joins XCF group mapping
SELECT IF(IMSConn) EVENT(ICON_19) ; IMS Tmember leaves XCF group mapping
SELECT IF(IMSConn) EVENT(ICON_28) ; Begin SSL Open mapping
SELECT IF(IMSConn) EVENT(ICON_29) ; End SSL Open mapping
SELECT IF(IMSConn) EVENT(ICON_32) ; Begin SSL close mapping
SELECT IF(IMSConn) EVENT(ICON_33) ; End SSL close mapping
SELECT IF(IMSConn) EVENT(ICON_41) ; Begin ODB registration mapping
SELECT IF(IMSConn) EVENT(ICON_42) ; End ODB registration mapping
SELECT IF(IMSConn) EVENT(ICON_43) ; Begin ODB de-registration mapping
SELECT IF(IMSConn) EVENT(ICON_44) ; End ODB de-registration mapping
SELECT IF(IMSConn) EVENT(ICON_63) ; Begin SAF SEC REQ
SELECT IF(IMSConn) EVENT(ICON_64) ; End SAF SEC REQ
SELECT IF(IMSConn) EVENT(ICON_69) ; OTMA Timeout
SELECT IF(IMSConn) EVENT(ICON_71) ; Session Error
SELECT IF(IMSConn) EVENT(ICON_91) ; DRDA command(SEC Info)
SELECT IF(IMSConn) EVENT(ICON_92) ; DRDA reply
SELECT IF(IMSConn) EVENT(ICON_99) ; Enter Security Exit
SELECT IF(IMSConn) EVENT(ICON_100) ; Return from SEC Exit
SELECT IF(IMSConn) EVENT(ICON_255) ; ICON Refresh RACF UID
; AMI Ops
SELECT IF(AMIOPS) EVENT(AO0100) ; AMI Ops 0100 z/OS data
SELECT IF(AMIOPS) EVENT(AO0200) ; AMI Ops 0200 Auto Operator data
SELECT IF(AMIOPS) EVENT(AO0009) ; AMI Ops for IP
SELECT IF(AMIOPS) EVENT(AO000A) ; AMI Ops for Java Environments
; Compuware
SELECT IF(Abend-AID) SMF(Abend-AID) ; Compuware Abend-AID
SELECT IF(SessMon) SMF(SessMon) ; BMC Security Session Monitor
SELECT IF(Action) SMF(eventAction) ; Action Software eventACTION
SELECT IF(BMCAMI) SMF(CorreLog) ; BMC AMI IND$FILE SMF 202 records
SELECT IF(DIAG) SMF(DIAG) ; Diagnostic message display
SELECT IF(SS) SMF(SS) ; SuperSession SMF records
; BMC AMI Storage IAM
SELECT IF(IAM) SMF(IAM) ; BMC AMI Storage IAM
; BMC AMI OpsM for IMS SMF record
SELECT IF(AOPSMIMS) SMF(AOPSIMS) ; BMC AMI OpsM for IMS SMF rec
; Operations events
SELECT IF(OPS) SMF(0) ; status IPL
SELECT IF(OPS) SMF(30) ; Common address space
SELECT IF(OPS) SMF(90) ; status SYSTEM
SELECT IF(OPS) SMF(7) ; SMF Lost Data
; Operations events - VSAM
SELECT IF(VSAM) SMF(60) ; VSAM volume data set updated
SELECT IF(VSAM) SMF(62) ; VSAM Compo or Cluster Opened
SELECT IF(VSAM) SMF(64) ; VSAM Compo or Cluster Sts
; Operations events - ICF
SELECT IF(ICF) SMF(61) ; ICF Define activity
SELECT IF(ICF) SMF(65) ; ICF Delete activity
SELECT IF(ICF) SMF(66) ; ICF Alter activity
; Device management
SELECT IF(DEVICE) SMF(8) ; I/O Configuration
SELECT IF(DEVICE) SMF(9) ; VARY Device ONLINE
SELECT IF(DEVICE) SMF(11) ; VARY Device OFFLINE
SELECT IF(DEVICE) SMF(22) ; Configuration
; DIV objects and VLF stats
SELECT IF(DIVVLF) SMF(41) ; DIV objects and VLF stats
SELECT IF(DFSORT) SMF(16) ; DFSORT SMF 16 records
SELECT IF(TSO) SMF(32) ; TSO/E User Work Accounting
SELECT IF(CRYPTO) SMF(82) ; Int. Crypto. Services Facility
SELECT IF(SYSLOGGER) SMF(88) ; System Logger SMF type 88
SELECT IF(DB2) SMF(DB2) ; DB2 events (SMF 100, 101, 102)
SELECT IF(USS) SMF(109) ; USS Syslog
SELECT IF(CICS) SMF(110) ; CICS events
SELECT IF(CICS) SMF(111) ; CICS TG Statistics events
SELECT IF(TSO) SMF(119) ; TSO signon events
SELECT IF(HFTS) SMF(98) ; HFTS data SMF 98
SELECT IF(SRMC) SMF(99) ; SRM data SMF 99
; File access monitoring
SELECT IF(FAM) SMF(14) ; INP/RDBACK DS activity
SELECT IF(FAM) SMF(15) ; OUTPUT/UPD/INOUT/OUT DS Acti
SELECT IF(FAM) SMF(17) ; Scratch Data Set Sts
SELECT IF(FAM) SMF(18) ; Rename Non-VSAM DS Sts
SELECT IF(FAM) SMF(42) ; DFSMS stats and config
SELECT IF(FAM) SMF(92) ; zFS - File system activity
SELECT IF(JES) SMF(26) ; JES2/3 - Purge
SELECT IF(JES) SMF(43) ; JES2/3 - Startup
SELECT IF(JES) SMF(55) ; JES2/3 - Network Signon
SELECT IF(JES) SMF(56) ; JES2/3 - Network Integrity
SELECT IF(JES) SMF(57) ; JES2/3 - Network Transmission
SELECT IF(JES) SMF(58) ; JES2/3 - Network Signoff
SELECT IF(JES) SMF(84) ; JES2/3 - Monitor
SELECT IF(RMF) SMF(70) ; RMF Processor Activity
SELECT IF(RMF) SMF(71) ; RMF Paging Activity
SELECT IF(RMF) SMF(72) ; RMF Wrkload,Stg,Serialization
SELECT IF(RMF) SMF(73) ; RMF Channel Path Activity
SELECT IF(RMF) SMF(74) ; RMF Activity of Resources
SELECT IF(RMF) SMF(75) ; RMF Page Data Set Activity
SELECT IF(RMF) SMF(76) ; RMF Trace Activity
SELECT IF(RMF) SMF(77) ; RMF Enqueue Activity
SELECT IF(RMF) SMF(78) ; RMF Monitor I Activity
SELECT IF(RMF) SMF(79) ; RMF Monitor II Activity
SELECT IF(RACF) SMF(80) ; RACF Security events
SELECT IF(RACF) SMF(81) ; RACF Initialization
SELECT IF(RACF) SMF(83) ; RACF Audit Record
SELECT IF(RACF) SMF(1154) ; RACF Compliance Record
SELECT IF(TOPSECRET) SMF(TSS80) ; TSS Security events
SELECT IF(TOPSECRET) SMF(TSS231) ; TSS Security events
SELECT IF(ACF2) SMF(ACF2) ; ACF2 Security data
SELECT IF(SMF89) SMF(89) ; Product Usage data
SELECT IF(IBMHttp) SMF(103) ; IBM HTTP Server
SELECT IF(HMC) SMF(106) ; HMC BCPii
SELECT IF(MQ) SMF(115) ; MQ Events - MQSeries Statistics
SELECT IF(MQ) SMF(116) ; MQ Events - MQ Accounting
SELECT IF(SMF113) SMF(113) ; Hardware Capacity
SELECT IF(WebSphere) SMF(120) ; WebSphere
SELECT IF(CD) SMF(132) ; Connect Direct
SELECT IF(PAM) SMF(175) ; Privileged Access Manager
SELECT IF(FAM) SMF(36) ; Enable SMF36 ICF Catlog export
SELECT IF(SMF123) SMF(123) ; API Request data
; Enable Sub System Command Intercept Event
SELECT IF(SSCmd) EVENT(SSCmd) ; Enable Sub System Command Intercept
; Enable RACF Command Intercept Event
SELECT IF(RACFCmd) EVENT(RACFCmd) ; Enable RACF Command Intercept
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*