Skip to Content

SMF 30 statement

You can use the SMF 30 statement to collect and forward type 30 records to your syslog console. SMF type 30 records indicate the start and end of units of work. Units of work include jobs, started tasks, TSO sessions, and other types of work, such as APPC transactions.

You can monitor type 30 records to keep track of TSO logons, or see production work that ends abnormally. You can use the SMF 30 statement to specify which types of work and which events to monitor.

If you enter more than one SMF 30 statement, the subsequent statement replaces the previous ones.

Related topics

Command-and-syntax-reference

Parameter-file-statements

General-SMF-record-type-statement

If TRACE(PARM) is specified on the OPTIONS statement, BMC AMI Datastream displays a summary of your type 30 event and severity specifications in message CZA0243I. For more information about TRACE, see OPTIONS-statement.

Warning

Important

If a job step ends with a completion code greater than zero, and subsequent steps are then flushed because of COND processing, SMF assigns a completion code of zero to the job.

If you use the SMF 30 statement defaults, all Start, End, and Stepend type 30 records are forwarded with the following settings:

  • Facility: SYSTEM
  • Severity: INFOrmational
  • All type 30 statistics records are suppressed

Syntax diagrams

The following diagrams describe the valid syntax for the SMF type 30 statement.

Syntax diagram for the SMF 30 statement provides a visual representation of the command syntax and parameters.

Syntax diagram for Severity provides a visual representation of the available severities.

endEvents: For descriptions of the overriding severity options, see Overriding severity codes.

severity: For descriptions of the severity specifications, see Syslog severities in Syslog-facilities-and-severities.

The following table describes the parameters in the SMF type 30 statement.

Parameter

Description

FACILITY(SYSTEM|facilityName)

Specifies the originating RFC 3164 facility of the syslog records that correspond to SMF type records

To use a different facility, enter one of the RFC 3164 facility names listed in Syslog facilities and severities.

If you omit this parameter, the default SYSTEM is used. 

FIELDs(fieldName …)

Specifies the names of the SMF type record fields that BMC AMI Datastream should forward to the BMC Defender Server or other syslog console

Fields appear in the message in the order in which you listed them.

For more information about acceptable field names, see Supported-record-field-names.

filterSpecification

Filters the fields

For information about filtering fields, see FILTER and MATCH parameters.

INHibit

Inhibits writing the SMF type record to the SMF data sets or logstream

BMC AMI Datastream processes the record, but SMF then inhibits further processing.

JOBs

Specifies the type of events and severity to be forwarded

Warning

Important

All of the following events can also use the SUPpress severity. SUPpress specifies that BMC AMI Datastream should not forward the specified event records to the syslog console.

For more information about severities, see Syslog-facilities-and-severities.

Event

Description

END(endEvents …)

Severity to apply to all end-of-work events for the specified type of work

You can specify an overriding severity to apply to work that ends with a return code of 0, 4, 8, 12, or 16. For information about the overriding severity codes, see Overriding severity codes.

Information
Example

If you use JOB(END(SUPPRESS ABEND(CRIT))), then job end events are not forwarded to the syslog console. Only job abends that do not have a severity of critical are forwarded to the syslog console.

INTerval(severity)

Severity of interval statistics events for the specified type of work

LAST(severity)

Severity of last statistics events for the specified type of work

Information
Example

If you use JOBs(LAST(INFO)), a message with a severity of INFOrmational for JOB last statistics is forwarded to the syslog console.

START(severity)

Severity of start-of-work events for the specified type of work

STEPend(endEvents …)

Severity to apply to end-of-jobstep events

The STEPend parameter applies only to the JOBS work type. You can specify an overriding severity to apply to jobsteps that end with a return code of zero, jobsteps that ends with a return code of 0, 4, 8, 12, or 16. For information about the overriding severity codes, see Overriding severity codes.

LOG | LOG(HEX)

Logs SMF records on CZAPRINT and dumps them in hexadecimal or character format

This parameter is intended primarily for diagnostic purposes.

Warning

Important

Specifying LOG(HEX) might generate a large volume of print records, especially if BMC AMI Datastream is left running for several hours.

OTHER

Specifies the type of events and severity that BMC AMI Datastream should forward to the syslog console

Warning

Important

All of the following events can also use the SUPpress severity. SUPpress specifies that BMC AMI Datastream should not forward the specified event records to the syslog console.

For more information about severities, see Syslog-facilities-and-severities.

Event

Description

END(endEvents …)

Severity to apply to all end-of-work events for the specified type of work

You can specify an overriding severity to apply to work that ends with a return code of zero, work that ends with a return code of 0, 4, 8, 12, or 16. For information about the overriding severity codes, see Overriding severity codes.

INTerval(severity)

Severity of interval statistics events for the specified type of work

LAST(severity)

Severity of last statistics events for the specified type of work

START(severity)

Severity of start-of-work events for the specified type of work

PROCess('SMF:'|‘processTag’)

Specifies the tag that appears at the start of SMF syslog messages

The tag follows the priority, time stamp, and host name, and precedes the formatted fields.

Enter the exact process tag that you want to include in syslog messages, including any spaces and punctuation. Process tags can be of any length from null string (‘’) to 32 characters.

If you omit this parameter, the default SMF is used, followed by the leading delimiter from OPTIONS DELIM. For more information, see OPTIONS-statement.

STC

Specifies the type of events and severity that BMC AMI Datastream should forward to the syslog console

Warning

Important

All of the following events can also use the SUPpress severity. SUPpress specifies that BMC AMI Datastream should not forward the specified event records to the syslog console.

For more information about severities, see Syslog-facilities-and-severities.

Event

Description

END(endEvents …)

Severity to apply to all end-of-work events for the specified type of work

You can specify an overriding severity to apply to work that ends with a return code of zero, work that ends with a return code of 0, 4, 8, 12, or 16. For information about the overriding severity codes, see Overriding severity codes.

INTerval(severity)

Severity of interval statistics events for the specified type of work

LAST(severity)

Severity of last statistics events for the specified type of work

START(severity)

Severity of start-of-work events for the specified type of work

TSO

Specifies the type of events and severity that BMC AMI Datastream should forward to the syslog console

Warning

Important

All of the following events can also use the SUPpress severity. SUPpress specifies that BMC AMI Datastream should not forward the specified event records to the syslog console.

For more information about severities, see Syslog-facilities-and-severities.

Event

Description

END(endEvents …)

Severity to apply to all end-of-work events for the specified type of work

You can specify an overriding severity to apply to work that ends with a return code of zero, work that ends with a return code of 0, 4, 8, 12, or 16. For information about the overriding severity codes, see Overriding severity codes.

INTerval(severity)

Severity of interval statistics events for the specified type of work

Information
Example

If you use TSO(INT(INFO)), a message with a severity of INFOrmational for TSO session interval statistics is forwarded to the syslog console.

LAST(severity)

Severity of last statistics events for the specified type of work

START(severity)

Severity of start-of-work events for the specified type of work

Information
Example

If you use TSO(START(NOTICE)), a message with a severity of NOTICE every time a TSO session starts is forwarded to the syslog console.

Overriding severity codes

The following table describes return codes that can override the severity of an end event.

Warning

Important

  • All of the following return codes can also use the SUPpress severity. SUPpress specifies that BMC AMI Datastream should not forward the specified event records to the syslog console.
  • A severity specified for any return code value overrides any lower (less severe) severities for any higher return codes.

For more information about severities, see Syslog-facilities-and-severities.

Return code

Description

RC0(severity) 

Overriding severity for units of work that end with the return code 0

RC4(severity) 

Overriding severity for units of work that end with the return code 1, 2, 3, or 4

RC8(severity)

Overriding severity for units of work that end with the return code 5, 6, 7, or 8

RC12(severity)

Overriding severity for units of work that end with the return code 9, 10, 11, or 12

Information
Example

If you use JOB(END(INFO RC12(ALERT))), then a syslog message with a severity of Alert is forwarded for all jobs that end with a return code of 12 or greater including abends, and a message with a severity of INFOrmational is forwarded for all other jobs.

RC16(severity)

Overriding severity for units of work that end with the return code 13

Information
Example

If you use JOB(END(INFO RC12(ALERT))), then a syslog message with a severity of Alert is forwarded for all jobs that end with a return code of 12 or greater including abends, and a message with a severity of INFOrmational is forwarded for all other jobs.

ABEND(severity)

Overriding severity for units of work that end with the return code ABEND

Information
Example

If you use JOB(END(INFO RC12(ALERT))), then a syslog message with a severity of Alert is forwarded for all jobs that end with a return code of 12 or greater including abends, and a message with a severity of INFOrmational is forwarded for all other jobs.

SMF 30 severity example

Suppose you enter the following syntax:

SMF 30 JOB(  START(SUPPRESS)                                       +
              STEPEND(SUPPRESS)                                     +
              END( SUPPRESS   RC4(WARN) RC8(ERROR) ABEND(CRIT) ) )  +
       OTHER( START(NOTICE)                                     +
              END( SUPPRESS ABEND(NOTICE) ) )                       +  +
       STC(   START(SUPPRESS)                                       +
              END( NOTICE     RC4(WARN) RC8(ERROR) ABEND(CRIT) ) )  +
       TSO(   START(NOTICE)   END(SUPPRESS) ) 

The output work unit severities (as displayed in message CZA0243I when TRACE(PARM) is in effect) are as follows:

           START       RC0         RC4         RC8         RC12        RC16        ABEND      
JOB        SUPpress    SUPpress    WARNing     ERRor       ERRor       ERRor       CRITical   
JOBSTEP    ---         SUPpress    SUPpress    SUPpress    SUPpress    SUPpress    SUPpress   
OTHER      NOTICE      SUPpress    SUPpress    SUPpress    SUPpress    SUPpress    NOTICE    
STC        SUPpress    NOTICE      WARNing     ERRor       ERRor       ERRor       CRITical   
TSO        NOTICE      SUPpress    SUPpress    SUPpress    SUPpress    SUPpress    SUPpress

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC AMI Datastream for z/OS 7.1