The z/OS Event Monitor (EM) operates with two different dataset, which are specified in its JCL.
According to the documentation of the EM they are used for the following:
- UCFILTER - Sequential file
This file contains filter definitions - the Event Monitor memorizes the filter which it has received from the Server. The whole file is rewritten if something is changed in the filter definitions. If the Event Monitor is restarted, it uses these filters (even without the agent). The Event Monitor can obtain additional filters or existing ones can be deactivated as soon as the connection to the agent has been established.
- UCEVENT - VSAM file
This file serves as event memory; the filtered events are stored. Only after the Server has acknowledged that the event has been processed does the Event Monitor delete it from this file. This ensures that the Event Monitor does not lose events and that they are kept even if the Event Monitor had been ended and restarted.
So basically the Filter file
is used to store filter patterns for the EM. Those are used to detect events during monitoring the system console and SMF records. There is a direct relation between the entries in the Filter file and the active Events in the Process Monitoring Perspective (Activities).
Whenever an Event is activated or deactivated (quit, stop, cancel, etc.) the Automation Engine (AE) advice the EM (via the Agent) to change the Filer file accordingly. Which means add or remove records form the file.
The Event file
is used to store detected events until they are committed by the AE. So the EM adds a record when an event (matching the current Filter) appears. Then it’s sent to the AE, when it’s committed as processed by the AE the EM deletes the record from the file.
Both files needs to be created during the installation, which is described at the “New Installation” description:Installation Guide > Installing the Automation Engine > New Installation > Installing the Agent for z/OS