Displaying Users and Processes for UNIX z/OS Functions

[Lizette Koehler]

I am running into an issue where I will see messages like the following

BPXTF009E FILESYSTEM EXCEEDS 94% FULL: /tmp  

BPXTF009E FILESYSTEM EXCEEDS 99% FULL: /tmp 

BPXTF010E FILESYSTEM IS FULL: /tmp  

I have automation to trap these messages to send me a notification when they
occur.

What I need to know is what/who was running at the time that caused this
condition.

I have been looking at the D OMVS commands, but cannot see what I can use.

What command or process, that I can automate with OPS/MVS, could show me
what/who was doing X at the time of the message?

Or is that not possible?

Thanks
        


Lizette Koehler

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to list...@listserv.ua.edu with the message: INFO IBM-MAIN

[John McKown]

On Fri, Jun 10, 2016 at 11:01 AM, Lizette Koehler <star...@mindspring.com>
wrote:

> I am running into an issue where I will see messages like the following
>
> BPXTF009E FILESYSTEM EXCEEDS 94% FULL: /tmp
>
> BPXTF009E FILESYSTEM EXCEEDS 99% FULL: /tmp
>
> BPXTF010E FILESYSTEM IS FULL: /tmp
>
> I have automation to trap these messages to send me a notification when
> they
> occur.
>
> What I need to know is what/who was running at the time that caused this
> condition.
>
> I have been looking at the D OMVS commands, but cannot see what I can use.
>
> What command or process, that I can automate with OPS/MVS, could show me
> what/who was doing X at the time of the message?
>

​the closest that I can think of, which may or may not be of any use is to
use the ADDRESS USS functionality in CA-OPS/MVS in your message rule.
Something like:

ADDRESS USS "USSCMD LOG(Y)" ||,
"COMMAND('/bin/ps -Aflm') "

but I don't know where the STDOUT output will go. And the RACF id under
which the OPSUSS server(s) is/are running needs to have the appropriate
UNIX (and RACF) authorities. You could probably "log" the output something
like:

ADDRESS USS "USSCMD LOG(Y)" ||,
"COMMAND('/bin/ps -Aflm >>/var/log/ps-Aflm.txt') "​

Or run some shell script instead of /bin/ps, if you want to do multiple
commands.

>
> Or is that not possible?
>
> Thanks
>
>
>
> Lizette Koehler
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to list...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
The unfacts, did we have them, are too imprecisely few to warrant our
certitude.

Maranatha! <><
John McKown

[Gladys Behnke]

Try issuing from OMVS: fuser -cu /tmp

But that will only work if the task/user is still running.


Gladys

[Gladys Behnke]

Try issuing from OMVS: fuser -cu /tmp

But that will only work if the task/user is still running.

- Gladys

[Tony Harminc]

On 10 June 2016 at 12:01, Lizette Koehler <star...@mindspring.com> wrote:
> BPXTF010E FILESYSTEM IS FULL: /tmp
>
> I have automation to trap these messages to send me a notification when they occur.
>
> What I need to know is what/who was running at the time that caused this condition.
>
> I have been looking at the D OMVS commands, but cannot see what I can use.
>
> What command or process, that I can automate with OPS/MVS, could show me
> what/who was doing X at the time of the message?

Bill Schoen has written a number of utilities that are on the UNIX
Tools & Toys page that you might be able to use to help with this.

http://www-03.ibm.com/systems/z/os/zos/features/unix/bpxa1ty2.html

I'd guess the "fsinuse" tool would be a good start. It's all in REXX,
so would be easy to integrate into your auto-ops.

Bill seems to watch the OMVS list, but maybe here too. He obviously
knows more about this than I do - perhaps he will chime in.

Tony H.

[Paul Gilmartin]

On Fri, 10 Jun 2016 09:01:43 -0700, Lizette Koehler wrote:

>I am running into an issue where I will see messages like the following
>

>BPXTF010E FILESYSTEM IS FULL: /tmp��

>
>What I need to know is what/who was running at the time that caused this
>condition.
>

I'd try the UNIX command, "ls -alrt /tmp", which would show timestamps,
user IDs, and file sizes. It's at least a good start. Automate with BPXBATCH
or BPXWUNIX.

-- gil

[Peter Hunkeler]

>I'd try the UNIX command, "ls -alrt /tmp", which would show timestamps,
>user IDs, and file sizes. It's at least a good start. Automate with BPXBATCH
>or BPXWUNIX.

That would not show files that have been unlinked but are still in use (open). I understand it is quite common for temporary files: OPEN (create mode), UNLINK, WRITE & READ to and from file, CLOSE.


The temporary file will be deleted a CLOSE time. In the case of unnormal end, the kernel will CLOSE the file, thus the file will be deleted also in that case. No zombie file left behind.


"ls" will not show this file.


"fsinuse" will show processes that use files in a specific directoy, but /tmp might be used by many. So, how do you indentify the one eating up all space?


--
Peter Hunkeler

[Kirk Wolf]

On z/OS 2.1 or later, you can use this command:

zlsof -d /tmp

Other commands and suggestions for managing /tmp can be found here:
http://dovetail.com/docs/pt-quick-inst/pto-inst-tmp.html

Kirk Wolf
Dovetailed Technologies
http://dovetail.com