I am seeing a very large increase of SMF type 230 records. What is ACF2 doing?

Products

• ACF2
• ACF2 - DB2 Option
• ACF2 for zVM
• ACF2 - z/OS
• ACF2 - MISC
• PanApt
• PanAudit

Issue/Introduction

I am seeing a very large increase of SMF type 230 records.  What is ACF2 doing?

Environment

Release:
Component: ACF2MS

Cause

ACF2 default SMF type is #230.  But other products can and do use 230 also.

Resolution

First we need to see what type of records are being produced.  If you run the ACFRPTPP pre-processor report, you can see what ACF2 types are being used.  Here is some sample JCL to run:

//STEP EXEC PGM=ACFRPTPP 
//SYSPRINT DD SYSOUT=* 
//SMFAR DD DUMMY 
//SMFCR DD DUMMY 
//SMFDA DD DUMMY 
//SMFDR1 DD DUMMY 
//SMFDR2 DD DUMMY 
//SMFDR3 DD DUMMY 
//SMFDR4 DD DUMMY 
//SMFER DD DUMMY 
//SMFFLT DD DUMMY 
//SMFJR DD DUMMY 
//SMFNR DD DUMMY 
//SMFOR DD DUMMY 
//SMFPR DD DUMMY 
//SMFSG DD DUMMY 
//SMFSR DD DUMMY 
//SMFTR DD DUMMY 
//SMFVR DD DUMMY 
//SMFZR DD DUMMY 
//RECMAN1 DD DISP=SHR,DSN=SYS1.MAN1   <=== this should be the SMF input dataset 
//SYSIN DD * 

Start time and end time can be specified on the report to run it for a shorter period of time as shown below:

[STIME(0000|hhmm)]
Specifies the beginning-of-time interval from which SMF records are selected based on a 24-hour clock. SMF records generated before this specified time of day are ignored. The selection of records begins at the STIME specified for each date in the SDATE/EDATE range and ends on each date at the ETIME given.

[ETIME(2359|hhmm)]
Specifies the end-of-time interval from which SMF records are selected based on a 24-hour clock. SMF records generated after this specified time of day are ignored.

The report will show how many ACF2 records are being cut:

*-- RECORD SELECTION SUMMARY - BY DDNAME --*

     DDNAME DESCRIPTION COUNT SELECTION

SMFPR SYSTEM ENTRY VIO 1,201 P,230-*

SMFER INFO-STG DB LOG 06 E,230-*

SMFVR RESOURCE LOG/VIO 20 V,230-*

.....

            --- TOTAL RECORDS PROCESSED ---

READ=17,692,038 SELECTED=29,615 WRITTEN=29,615

 

Review the COUNT column. If one of these reports show the number close to the overall number, run the appropriate report and review the output to see where the problem is. Maybe a rule was changed to LOG. If the count of the ACF2 records does not meet the overall number, then most likely another product is using type 230. In the above example, there was over 17 million SMF type 230 records, but only 29 thousand were ACF2.  We have seen products like Endeavor and IDMS Performance Monitor use type 230. Any product could be using that number.