SMF 110 statement
If properly configured, CICS writes performance records as SMF Type 110 records.
For information about filterSpecification, see FILTER-and-MATCH-parameters.
You might need to monitor CICS SMF records to maintain an audit trail of sensitive transactions. If you code an SMF 110 statement, all SMF Type 110 records with a subtype of 1 and a class of 3 are forwarded to your BMC Defender Server or syslog console with a facility of LOCAL0 (3) and a severity of informational. BMC AMI Defender supports compressed CICS SMF records: the support is automatic; there is no specific option that must be enabled in BMC AMI Defender.
If you code more than one SMF 110 statement, then a subsequent SMF 110 statement replaces any SMF 110 statement(s) that came before.
BMC AMI Defender supports the following types of CICS SMF record fields:
Subtype | Class | Data record type | Field names |
|---|---|---|---|
Common | – | – | SMFMNxxx |
1 – Monitoring | 3 – Performance | – | DFHxxxx_xxxxx (deprecated) |
5 – Resource | Common (ID) | MNR_ID_xxxxx | |
File | MNR_FILE_xxxxx | ||
TS Queue | MNR_TSQ_xxxxx | ||
DPL (distributed link) | MNR_DPL_xxxxx |
Support for CICS TS Version 5.5 has been added to BMC AMI Defender. CICS TS Version 5.5 is still in beta and certain fields might be changing. If you experience incorrectly formatted performance fields, contact BMC Support.
For performance reasons, BMC AMI Defender caches any DFHMCT customization on a per-CICS-applid basis. If you re-customize and stop and start a CICS subsystem, see SET(CICS) under MODIFY-command.
If you are using CICS user performance class data fields (DFHMCT TYPE=EMP), contact BMC Support.
Unlike other SMF record types, one SMF Type 110 record might be (and usually is) formatted into more than one syslog message. An SMF Type 110 subtype 1 SMF record might (and usually does) contain more than one CICS data record; if so, each is formatted into a separate syslog message.
SMF 110 | Must be specified as shown. |
FACILITY(facilityName) | Specifies the RFC 3164 facility that is to be indicated as the origin of the syslog records corresponding to SMF 110 records If you omit this parameter, it defaults to LOCAL0. If you would like a different facility indicated, code one of the RFC 3164 facility names as listed in Syslog-facilities-and-severities. |
FIELDs(fieldName…) | Specifies the names of the CICS SMF record fields that are to be transmitted to the BMC Defender Server or other syslog console, and the order where they are to appear in the message Specify one or more of the fields as described in FIELDS-parameter. |
filterSpecification | For information about filterSpecification, see FILTER-and-MATCH-parameters. |
INHibit | Specifies that the writing of the SMF record type 110 to the SMF datasets, logstream, or both are to be inhibited by BMC AMI Defender SMF record type 110 is processed by BMC AMI Defender, but then inhibited from further processing by SMF. |
LOG | LOG(HEX) | Specifies that the selected SMF records are to be logged on CZAPRINT and optionally dumped in hexadecimal and character format Compressed records are dumped both before and after decompression. This parameter is intended primarily for diagnostic purposes. Use care in specifying LOG(HEX) as it might have generated a large volume of print records, especially if BMC AMI Defender is left running for several hours or more. |
MONitor() | Specifies one or more CICS monitoring classes and the syslog severity to be assigned to them Specify one or more of the following monitoring classes (refer to the table): PERFormance, RESource. SEVerity(severity) specifies the syslog severity for the specified monitoring classes. See Syslog-facilities-and-severities. You might have also code DEFAULT or SUPPRESS. DEFAULT indicates that the severity is to default to the defined severity; SUPPRESS indicates that the specified event records are not to be forwarded to the syslog server at all. |
PROCess(‘processTag’) | Specifies the tag that appears at the start of SMF 110 syslog messages, following the priority, timestamp and hostname, and preceding the formatted fields Specify the exact process tag that you need to include in syslog messages including any spaces and punctuation. Process-tag might be any length from the null string (‘’) to 32 characters. If SMF 110 PROCess is omitted, it defaults to CICS followed by the leading delimiter from OPTIONS DELIM. |
SEVerity(severity) | Specifies the default syslog severity You might also code SUPPRESS. SUPPRESS indicates that the default is that records are not to be formatted and forwarded to the syslog server at all. If you omit SEVerity, it defaults to INFOrmational. For more information, see Syslog-facilities-and-severities. |