RACF command logging time difference

Products

• Compliance Manager for z/OS

Issue/Introduction

I record all RACF commands in the ADMACCOUNT table in Compliance Manager.

We have noticed an almost 8/10 of a second difference between the time  Compliance Manager records the RACF command and the time of the command in SMF.

Interestingly the  Compliance Manager date/time stamp is earlier than the SMF date/stamp by almost 8/10 of a second.

 

Environment

Release: CIEMGR00200-2-Compliance Manager-for z/OS Option for RACF
Component:

Resolution

The SMFWTM (SMF) fills in the time value SMFxTME. However this is the time since midnight.

The value in the Compliance Event Manager/Compliance Manager event records are STCK format.

ECA_R001_TOD_UTC DS XL8 UTC timestamp
ECA_R001_TOD_SYS DS XL8 Local timestamp

http://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.ieag200/smfhdr.htm

So they appear to be slightly different given the different format.