ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

ZOSMF server is creating multiple SMF type 230 records per second.

book

Article ID: 40250

calendar_today

Updated On:

Products

ACF2 ACF2 - DB2 Option ACF2 for zVM ACF2 - z/OS ACF2 - MISC PanApt PanAudit

Issue/Introduction

Issue: 

ZOSMF server is creating thousands of SMF type 230 records per second.

SMFVR RESOURCE LOG/VIO 886 V,230-*

Environment:  

CA ACF2 for Z/OS Release 15

Cause: 

They appear to be log records. All the entries were for log access to FSACCESS rules.

RFSA-OMVS.ABCDEF1.PFA.ZFS LOG RFSA-OMVS

OMPFA STCINRDR DVT2 ACF9CFAT RULE - DIRECTRY UPDT

SAF RESOURCE CLASS FSACCESS

RESOURCE NAME: OMVS.ABCDEF1.PFA.ZFS

Below rule for type(FSA) with a key of OMVS which allows everyone to everything with a LOG access.

$KEY(OMVS) TYPE(FSA)

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

Resolution:

1. Output of ACFRPTPP and ACFRPTRV report to determine the cause.

ACFRPTPP report shows 886 records of type VR

SMFVR     RESOURCE LOG/VIO       886  V,230-*

The output from ACFRPTRV shows that they are mostly for resource class FSACCESS. 

IZUSVR         868      PFA             18

In this case 868 for IZUSVR and only 18 for PFA logging.

 

2. We recommend to use the rule like this.

$KEY(OMVS) TYPE(FSA)

- UID(DOISOSTST  IZIZUSVR) SERVICE(READ,ADD,UPDATE) ALLOW

- UID(*) SERVICE(READ,ADD,UPDATE) LOG

That will still log everything else, but will allow IZUSVR without logging it.

Additional Information:

SMF record numbers identify the input records for the various CA ACF2 report generators. One record number (default of 230) includes all CA ACF2 record types. A subtype indicator identifies the record type.

Environment

Release: ACF2..001AO-15-ACF2
Component: