How does the z/OS Event Monitor operate with its datasets?

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

The z/OS Event Monitor (EM) operates with two different dataset, which are specified in its JCL.
According to the documentation of the EM they are used for the following:

• UCFILTER - Sequential file
  This file contains filter definitions - the Event Monitor memorizes the filter which it has received from the Server. The whole file is rewritten if something is changed in the filter definitions. If the Event Monitor is restarted, it uses these filters (even without the agent). The Event Monitor can obtain additional filters or existing ones can be deactivated as soon as the connection to the agent has been established.
   
• UCEVENT - VSAM file
  This file serves as event memory; the filtered events are stored. Only after the Server has acknowledged that the event has been processed does the Event Monitor delete it from this file. This ensures that the Event Monitor does not lose events and that they are kept even if the Event Monitor had been ended and restarted.

 
So basically the Filter file is used to store filter patterns for the EM. Those are used to detect events during monitoring the system console and SMF records. There is a direct relation between the entries in the Filter file and the active Events in the Process Monitoring Perspective (Activities).
Whenever an Event is activated or deactivated (quit, stop, cancel, etc.) the Automation Engine (AE) advice the EM (via the Agent) to change the Filer file accordingly. Which means add or remove records form the file.
The Event file is used to store detected events until they are committed by the AE. So the EM adds a record when an event (matching the current Filter) appears. Then it’s sent to the AE, when it’s committed as processed by the AE the EM deletes the record from the file.
 
Both files needs to be created during the installation, which is described at the “New Installation” description:
Installation Guide > Installing the Automation Engine > New Installation > Installing the Agent for z/OS
 
 

Environment

Release: AOATAM99000-9.0-Automic-One Automation Tools-Application Manager
Component:

Resolution

Under exceptional circumstances (such as disaster recovery, storage issue, EV crash, etc.) it might be necessary to recreate those files. The following procedure and impact should be considered:
 

• Stop the Event Monitor STC (and the SMF Exit)
  Impact:                Events will not be detected any longer.
   
• Remove Filter and / or Event file using common IBM utilities or tools.
  Impact:                Event hits stored in the Event file, which were not sent to the Automation Engine yet, will be lost!
   
• Create the Filter and / or Event file as depicted in the Documentation mentioned above.
   
• Started the Event Monitor.
  Impact:                In case the Filter file was not recreated the EM will start detected events (matching the current filter patterns) immediately. Otherwise it will take some time until the EM receives the currently active Events and adds it to the Filter file. (This depends on how fast it can reconnect via the Agent to the AE.)

 
 
More useful information can also be found in the documentation:
Integration Guide > Automation Engine and Target Systems > z/OS > Event Monitor