ZOSMF server is creating thousands of SMF type 230 records per second.
SMFVR RESOURCE LOG/VIO 886 V,230-*
CA ACF2 for Z/OS Release 16
They appear to be log records. All the entries were for log access to FSACCESS rules.
RFSA-OMVS.ABCDEF1.PFA.ZFS LOG RFSA-OMVS
OMPFA STCINRDR sys1 ACF9CFAT RULE - DIRECTRY UPDT
SAF RESOURCE CLASS FSACCESS
RESOURCE NAME: OMVS.ABCDEF1.PFA.ZFS
Below rule for type(FSA) with a key of OMVS which allows everyone to everything with a LOG access.
$KEY(OMVS) TYPE(FSA)
- UID(*) SERVICE(READ,ADD,UPDATE) LOG
ACFRPTPP report shows 886 records of type VR
SMFVR RESOURCE LOG/VIO 886 V,230-*
The output from ACFRPTRV shows that they are mostly for resource class FSACCESS.
IZUSVR 868 PFA 18
In this case 868 for IZUSVR and only 18 for PFA logging.
$KEY(OMVS) TYPE(FSA)
- UID(uid of IZUSVR) SERVICE(READ,ADD,UPDATE) ALLOW
- UID(*) SERVICE(READ,ADD,UPDATE) LOG
That will still log everything else, but will allow IZUSVR without logging it.
SMF record numbers identify the input records for the various CA ACF2 report generators. One record number (default of 230) includes all CA ACF2 record types. A subtype indicator identifies the record type.