ZOSMF server is creating multiple SMF type 230 records per second.
Article ID: 40250
Updated On:
Products
Issue/Introduction
ZOSMF server is creating thousands of SMF type 230 records per second.
SMFVR RESOURCE LOG/VIO 886 V,230-*
Environment
CA ACF2 for Z/OS Release 16
Cause
They appear to be log records. All the entries were for log access to FSACCESS rules.
RFSA-OMVS.ABCDEF1.PFA.ZFS LOG RFSA-OMVS
OMPFA STCINRDR sys1 ACF9CFAT RULE - DIRECTRY UPDT
SAF RESOURCE CLASS FSACCESS
RESOURCE NAME: OMVS.ABCDEF1.PFA.ZFS
Below rule for type(FSA) with a key of OMVS which allows everyone to everything with a LOG access.
$KEY(OMVS) TYPE(FSA)
- UID(*) SERVICE(READ,ADD,UPDATE) LOG
Resolution
- Output of ACFRPTPP and ACFRPTRV report to determine the cause.
ACFRPTPP report shows 886 records of type VR
SMFVR RESOURCE LOG/VIO 886 V,230-*
The output from ACFRPTRV shows that they are mostly for resource class FSACCESS.
IZUSVR 868 PFA 18
In this case 868 for IZUSVR and only 18 for PFA logging.
- We recommend to use the rule like this.
$KEY(OMVS) TYPE(FSA)
- UID(uid of IZUSVR) SERVICE(READ,ADD,UPDATE) ALLOW
- UID(*) SERVICE(READ,ADD,UPDATE) LOG
That will still log everything else, but will allow IZUSVR without logging it.
Additional Information
SMF record numbers identify the input records for the various CA ACF2 report generators. One record number (default of 230) includes all CA ACF2 record types. A subtype indicator identifies the record type.
Feedback
