Checking if SMF recording is enabled

Products

• Endevor

Issue/Introduction

SMF (System Management Facility) is a component of MVS that creates/maintains an audit trail and can alert the administrator to inappropriate activity. SMF recording by default is disabled.
In order to check whether it is currently enabled or not in the system, follow the steps described below. 

Resolution

There are multiple ways to check if SMF is enabled/disabled, following you will find three:

1) Go to C1DEFLTS table, under TYPE=MAIN, check for macro parameter SMFREC#. or
2) In Endevor, option 4  ENVIRONMENT, then option 1  SITE, check the value under “SMF Record Number” field. or
3) Via EN$TROPT report.

If the value is set to 0, then it means that SMF recoding is disabled.
In case you have a value different to 0, then you need to make sure that the SMFREC# is set to a value that is valid for SMF itself (ie. a number that SMF is actually recording).

Talk to a system programmer at your site to ensure that you are indeed collecting the SMF records related to the record number specified in the SMFREC# parameter. Recording records is controlled in SYS1.PARMLIB(SMFPRMxx).

Following you will find some information about SMFREC# parameter.

SMFREC#
Specifies the SMF record number assigned to SMF records written by Endevor. Set this value to 0 (zero) until you implement the SMF option. The parameters controlling which records are actually written are SMFACT, SMFSEC, and SMFENV in the TYPE=ENVRNMT macro.

• Valid values for SMFREC# are 128 through 255.
• 0 disables SMF recording. Invalid values are 1 through 127, which are IBM reserved SMF Record Type values. Specifying an invalid value also disables SMF recording.

Additional Information

Also, check Defaults Table C1DEFLTS for other parameters information.

In addition, check System Management Facility (SMF) Recording for IT Audit that goes into details on how to set it up.