Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Extracting SMF Records to find the userid who deleted a dataset

2,065 views
Skip to first unread message

vijay raj

unread,
Dec 13, 2007, 11:51:25 AM12/13/07
to
On one of our account, a production dataset is deleted. We
Greetings,

On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it.

Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid.

Any help is greatly appreciated.

Thanks
Vijay


5, 50, 500, 5000 - Store N number of mails in your inbox. Go to http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to list...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Lizette Koehler

unread,
Dec 13, 2007, 11:54:28 AM12/13/07
to
Vijay,

I would use SMF DUMP (IFASMPDP) and just dump the SMF record I wanted. If you have sas you can then filter through the SMF record for that data set. The SMF Manual is very good to show you how to dump specific records.

Or if you have DFSORT, I think there may be some control cards built for a DFSORT process to do this.

Lizette

Mark Jacobs

unread,
Dec 13, 2007, 12:07:24 PM12/13/07
to
vijay raj wrote:
> On one of our account, a production dataset is deleted. We
> Greetings,
>
> On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it.
>
> Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid.
>
> Any help is greatly appreciated.
>
> Thanks
> Vijay
>
>
>

Go to www.cbttape.org and download File 094: DAF from Mike Cleary -
Dataset Audit Facility

--
Mark Jacobs
Time Customer Service
Tampa, FL
------

The primary purpose of the DATA statement is to give names to
constants; instead of referring to pi as 3.141592653589793 at
every appearance, the variable PI can be given that value with
a DATA statement and used instead of the longer form of the constant.

This also simplifies modifying the program, should the value of
pi change.

- FORTRAN manual for Xerox computers

Jack Kelly

unread,
Dec 13, 2007, 12:31:13 PM12/13/07
to
<snip>

On one of our account, a production dataset is deleted
<snip>

A simple SAS routine will do the trick too. But i would also include
SMF18, SMF65 and SMF66. In general i check SMF14,15,17,18,60-66 although
the VSAM SMF6x aren't too useful.

Jack Kelly
202-502-2390 (Office)

David Betten

unread,
Dec 13, 2007, 12:49:46 PM12/13/07
to
You can try this

//SORT EXEC PGM=SORT,REGION=5000K
//SYSPRINT DD SYSOUT=*
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=inputsmf
//SORTOUT DD DISP=(NEW,PASS),DSN=&&TEMP,
// SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'11',&,
45,44,CH,EQ,
C'deleted.dsn ')
OPTION VLSHRT
/*
//PRINT EXEC PGM=IDCAMS
//IN1 DD DISP=(OLD,PASS),DSN=&&TEMP
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
PRINT INFILE(IN1) DUMP
/*

Type 17 is pretty easy becaue the dsn is part of the header so you know the
offset in each record. Some other smf record types are not so simple
because you need to use the triplet for the offset to the section that had
the data. Also, I used a length of 44 for the dsn field. If your dsn is
less tan 44, you can shorten the length and get rid of the trailing blanks.


Have a nice day,
Dave Betten
DFSORT Development, Performance Lead
IBM Corporation
email: bet...@us.ibm.com
DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/

IBM Mainframe Discussion List <IBM-...@BAMA.UA.EDU> wrote on 12/13/2007
11:51:04 AM:

Ed Gould

unread,
Dec 13, 2007, 1:37:21 PM12/13/07
to
There is a freebe on the CBTTAPE.ORG called DAF... this will do
everything you should need.

Ed

David Betten

unread,
Dec 13, 2007, 1:48:19 PM12/13/07
to
Frank Yaeger just pointed out to me that the trailing blanks are not
necessary since DFSORT will pad the constant on the right with blanks to
the length of the field. So you can just code it like this

//SORT EXEC PGM=SORT,REGION=5000K
//SYSPRINT DD SYSOUT=*
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=inputsmf
//SORTOUT DD DISP=(NEW,PASS),DSN=&&TEMP,
// SPACE=(CYL,(50,20),RLSE),DCB=*.SORTIN,UNIT=SYSLG
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'11',&,
45,44,CH,EQ,
C'deleted.dsn')
OPTION VLSHRT
/*
//PRINT EXEC PGM=IDCAMS
//IN1 DD DISP=(OLD,PASS),DSN=&&TEMP
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
PRINT INFILE(IN1) DUMP
/*

Have a nice day,


Dave Betten
DFSORT Development, Performance Lead
IBM Corporation
email: bet...@us.ibm.com
DFSORT/MVSontheweb at http://www.ibm.com/storage/dfsort/

IBM Mainframe Discussion List <IBM-...@BAMA.UA.EDU> wrote on 12/13/2007

12:45:18 PM:

Rick Fochtman

unread,
Dec 13, 2007, 3:15:07 PM12/13/07
to
-------------------<snip>--------------------

>On one of our account, a production dataset is deleted. We
>Greetings,
>
>On one of our account, a production dataset is deleted. We have to find the userid of the person who deleted that specific dataset. I know that we can extract the SMF records with IFASMFDP and Sort the record type 17 for it. However, I am not sure what would be the sort JCL and sort control statements for it.
>
>Could you please guide me or provide a sample jcl which could extract the SMF dataset and find the userid.
>
>Any help is greatly appreciated.
>
>

------------------<unsnip>------------------
You need the Dataset Monitor tool from the CBT tape (www.cbttape.org) .
It processes SMF data to give you exactly what you're looking for.

vijay raj

unread,
Dec 13, 2007, 4:08:04 PM12/13/07
to
Thanks

----- Original Message -
Thanks David and all who replied.

Thanks

You can try this

> On one of our account, a production dataset is deleted. We


> Greetings,
>
> On one of our account, a production dataset is deleted. We have to
> find the userid of the person who deleted that specific dataset. I
> know that we can extract the SMF records with IFASMFDP and Sort the
> record type 17 for it. However, I am not sure what would be the sort
> JCL and sort control statements for it.
>
> Could you please guide me or provide a sample jcl which could
> extract the SMF dataset and find the userid.
>
> Any help is greatly appreciated.
>

> Thanks
> Vijay
>
>
> 5, 50, 500, 5000 - Store N number of mails in your inbox. Go to
> http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html
>

> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to list...@bama.ua.edu with the message: GET IBM-MAIN INFO
> Search the archives at http://bama.ua.edu/archives/ibm-main.html
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to list...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html


Get the freedom to save as many mails as you wish. To know how, go to http://help.yahoo..com/l/in/yahoo/mail/yahoomail/tools/tools-08.html

0 new messages