ZOSMF server is creating multiple SMF type 230 records per second.
search cancel

ZOSMF server is creating multiple SMF type 230 records per second.

book

Article ID: 40250

calendar_today

Updated On:

Products

ACF2 ACF2 - DB2 Option ACF2 for zVM ACF2 - z/OS ACF2 - MISC PanApt PanAudit

Issue/Introduction

ZOSMF server is creating thousands of SMF type 230 records per second.

SMFVR RESOURCE LOG/VIO 886 V,230-*

 

 

 

Environment

CA ACF2 for Z/OS Release 16

Cause

They appear to be log records. All the entries were for log access to FSACCESS rules.

RFSA-OMVS.ABCDEF1.PFA.ZFS LOG RFSA-OMVS

OMPFA STCINRDR sys1 ACF9CFAT RULE - DIRECTRY UPDT

SAF RESOURCE CLASS FSACCESS

RESOURCE NAME: OMVS.ABCDEF1.PFA.ZFS

Below rule for type(FSA) with a key of OMVS which allows everyone to everything with a LOG access.

$KEY(OMVS) TYPE(FSA)

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

Resolution

  1. Output of ACFRPTPP and ACFRPTRV report to determine the cause.

ACFRPTPP report shows 886 records of type VR

SMFVR     RESOURCE LOG/VIO       886  V,230-*

The output from ACFRPTRV shows that they are mostly for resource class FSACCESS. 

IZUSVR         868      PFA             18

In this case 868 for IZUSVR and only 18 for PFA logging.

 

  1. We recommend to use the rule like this.

$KEY(OMVS) TYPE(FSA)

- UID(uid of IZUSVR) SERVICE(READ,ADD,UPDATE) ALLOW

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

That will still log everything else, but will allow IZUSVR without logging it.

 

 

Additional Information

SMF record numbers identify the input records for the various CA ACF2 report generators. One record number (default of 230) includes all CA ACF2 record types. A subtype indicator identifies the record type.