Determine which server/LPAR User logged into Web Viewer 12.1 SMF

Products

• Output Management Web Viewer

Issue/Introduction

How can we tell if anyone has logged onto Web Viewer for a specific LPAR/View repository? 

Environment

Release : 12.1

Cause

The first remedy would be to set up Web Viewer Auditing for the report Actions you want monitored. The Repository being accessed (including what LPAR it's on), is recorded in the log. But, as Web Viewer auditing was not working for this customer, an alternate method was needed. 

Resolution

If users want to see any history, they can start generating records using metrics. Please see below the process to generate the metrics,

1.) Metrics support is invoked by the SMFTYPE initialization parameter. To indicate a user SMF record to the system management facility, set the SMFTYPE initialization parameter to a value from 128-255 in SARINIT.
2.) To run the Metrics process, use JCL similar to the following:
//XXXXXXXX JOB ...
//SORT     EXEC PGM=SARMET01
//STEPLIB  DD  DISP=SHR,DSN=VIEW.CVDELOAD     <=== MODIFY, IF USED
//SYSPRINT DD  SYSOUT=*                                          
//SYSIN     DD *                                                  
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,RPT=FILE
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,RPT=ACCS
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,RPT=CHNG                                
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,RPT=DELE            
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,RPT=USER            
SMFTYPE=nnn,DATE=1yyddd-1yyddd,TIME=0000-2359,ELAP=01,RPT=LOAD    
/*                                                                
//SMFIN     DD DISP=SHR,DSN=XXXXXX.XXXXXX.SMFDUMP1
//USERSMF   DD DUMMY
//ACCS      DD SYSOUT=*
//DELE      DD SYSOUT=*                                      
//USER      DD SYSOUT=*                                          
//LOAD      DD SYSOUT=*                                          
//SYSOUT    DD SYSOUT=*                                          
//PRINTER   DD SYSOUT=*                                          
//SORTWK01  DD UNIT=SYSDA,SPACE=(CYL,(1,1),RLSE)
//SORTWK02  DD UNIT=SYSDA,SPACE=(CYL,(1,1),RLSE)
//SORTWK03  DD UNIT=SYSDA,SPACE=(CYL,(1,1),RLSE)        
//SYSUDUMP  DD SYSOUT=*
//  

In the above sample JCL...
* nnn is the SMFTYPE (128 to 255) as defined in the SARINIT parameters. yyddd is a Julian date, used in a range
* The control card with RPT=FILE, used in conjunction with the JCL statement "//USERSMF DD ...", specifies the File that contains the View Metrics SMF records output.
* The control cards with RPT=ACCS, RPT=CHNG, RPT=DELE, and RPT=USER, will generate Access, Change, Delete, and User reports, respectively.
* The control card with ELAP=nn (00-99) is used for the Load report, where nn indicates the elapsed time (in days) from the time of a disk delete of a report to the reload of the report to the disk layer.

For more detailed information, including the contents of the SMF records, and for samples of the different reports that are created, please see the" Create Metrics Reports" chapter, in the CA View Reference Guide. More details about View metrics can be found in the below documentation:
https://ca-broadcomcsm.wolkenservicedesk.com/wolken/esd/knowledgebase_search?articleId=48063  
Create Metrics Reports  

Looking at the second document (above), if the Record Subtype is 30, 31 or 36, then the request/action came from Web Viewer. Instead of checking to see what View/LPAR Web Viewer is accessing, we should be checking the various View/LPARs to see which was accessed from the Web Viewer.