ZOSMF server is creating multiple SMF type 230 records per second.

book

Article ID: 40250

calendar_today

Updated On:

Products

CA ACF2 CA ACF2 - DB2 Option CA ACF2 for zVM CA ACF2 - z/OS CA ACF2 - MISC CA PanApt CA PanAudit

Issue/Introduction

Issue: 

ZOSMF server is creating thousands of SMF type 230 records per second.

SMFVR RESOURCE LOG/VIO 886 V,230-*

Environment:  

CA ACF2 for Z/OS Release 15

Cause: 

They appear to be log records. All the entries were for log access to FSACCESS rules.

RFSA-OMVS.ABCDEF1.PFA.ZFS LOG RFSA-OMVS

OMPFA STCINRDR DVT2 ACF9CFAT RULE - DIRECTRY UPDT

SAF RESOURCE CLASS FSACCESS

RESOURCE NAME: OMVS.ABCDEF1.PFA.ZFS

Below rule for type(FSA) with a key of OMVS which allows everyone to everything with a LOG access.

$KEY(OMVS) TYPE(FSA)

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

Resolution:

1. Output of ACFRPTPP and ACFRPTRV report to determine the cause.

ACFRPTPP report shows 886 records of type VR

SMFVR     RESOURCE LOG/VIO       886  V,230-*

The output from ACFRPTRV shows that they are mostly for resource class FSACCESS. 

IZUSVR         868      PFA             18

In this case 868 for IZUSVR and only 18 for PFA logging.

 

2. We recommend to use the rule like this.

$KEY(OMVS) TYPE(FSA)

- UID(DOISOSTST  IZIZUSVR) SERVICE(READ,ADD,UPDATE) ALLOW

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

That will still log everything else, but will allow IZUSVR without logging it.

Additional Information:

SMF record numbers identify the input records for the various CA ACF2 report generators. One record number (default of 230) includes all CA ACF2 record types. A subtype indicator identifies the record type.

Environment

Release: ACF2..001AO-15-ACF2
Component: