Applied7 min readLesson 3 of 3
Investigations and reporting what you find
Three investigations come up again and again: a data set that disappeared, a job that used too much CPU, and failed access to sensitive data. The method is the same each time, and so is the rule for the report: say what the records show, with times and IDs, and leave conclusions about intent to the people who own them.
1. The data set that disappeared
- Extract type 17 (scratch) and 18 (rename) for the window when it was last known to exist.
- Find the record for the data set name: it gives the job name, the time and the system.
- If the job name is a TSO user ID, the user deleted it interactively; otherwise look at that job's type 30 records and its JCL.
- If the data set's RACF profile audits successful access, type 80 records add the user and the access level.
2. The job that used too much CPU
- Extract type 30 subtype 5 (job end) for the period, and subtype 4 (step end) for the jobs of interest.
- Compare CPU time, not elapsed time; check zIIP time separately if the site uses zIIPs.
- Compare with the same job on previous days: a sudden increase usually follows a change in data volume or program.
3. Failed access to sensitive data
- Extract type 80 for the window and filter on the resource name.
- List each event: time, user ID, resource, access requested and access allowed.
- Look for patterns, such as repeated attempts by one user ID or attempts by many.
- Report to the security team; they decide whether it is a mistake or an attack.
Reporting
| Write | Avoid |
|---|---|
| "Type 17 shows PROD.GL.MASTER scratched at 16:47:53 on MPS1 by job MPU0412." | "MPU0412 deleted it on purpose." |
| "Three failed READ attempts by MPU2231, 09:14 to 15:02." | "MPU2231 is trying to steal payroll data." |
| "GLPOST used 21 minutes 55 seconds of CPU, up from about 12 on previous days." | "GLPOST is broken." |
TRY IT YOURSELF
Which type 30 subtype is written at the end of a job?
Show a hint
Step end is 4.
Show the solution
Subtype 5.
Common mistakes
Comparing elapsed time when the question is CPU
A job can run long while using little CPU, waiting for I/O or other work.
Stating intent
Records show actions, not reasons. Leave conclusions about intent to security and management.
Leaving extracts lying around
SMF extracts contain sensitive information; protect and delete them.
What you will see at work
- Auditors often ask for evidence that a control works, such as all failed access to payroll data last quarter; type 80 extracts answer that.
- Capacity planners use types 70, 72 and 30 over months to forecast growth.
- Practise reading these reports in the Command Center's SMF desk drill.
Key terms
Check your understanding.
Take this lesson's quiz and save your progress. Free.