Turning a question into an SMF search
Most SMF work starts with someone else's question: who deleted this, which job used the CPU, who tried to read payroll data. Turn it into record types, systems and a time window, then extract only those records with IFASMFDP or IFASMFDL before you read anything.
From question to record types
| Question | Record types to start with |
|---|---|
| Who deleted or renamed a data set? | 17 (scratch), 18 (rename); 80 if the data set's RACF profile audits it |
| Who read or wrote a data set? | 14 (input closed), 15 (output closed); 62 and 64 for VSAM |
| How much CPU or I/O did a job use? | 30 (address space accounting; subtype 4 step end, 5 job end) |
| Who failed a security check or logon? | 80 (RACF processing) |
| How busy was the processor, and did work meet its goals? | 70 (CPU activity), 72 (workload activity) |
| How did CICS transactions or Db2 threads perform? | 110 (CICS), 101 (Db2 accounting) |
| What did MQ do? | 115 (MQ statistics), 116 (MQ accounting) |
Which systems, which time
Each system writes its own SMF records, marked with its system ID. Ask which system or systems the work ran on, and narrow the time window as far as you honestly can: SMF volumes are large, and a day of records from a busy system can be many gigabytes.
Extract before you read
SMF is written to log streams (most sites) or to SYS1.MANx data sets, and dumped regularly to archive data sets. You extract what you need into a working data set: IFASMFDL reads log streams and IFASMFDP reads data sets, both with filters for record types, dates and times.
//SMFX EXEC PGM=IFASMFDP //DUMPIN DD DSN=SMF.ARCHIVE.D2026291,DISP=SHR //DUMPOUT DD DSN=AUDIT.SMF1718.D2026291,DISP=(NEW,CATLG), // SPACE=(CYL,(10,10)),RECFM=VBS,LRECL=32760 //SYSPRINT DD SYSOUT=* //SYSIN DD * INDD(DUMPIN,OPTIONS(DUMP)) OUTDD(DUMPOUT,TYPE(17,18)) DATE(2026291,2026291) START(0000) END(2400) /*
OPTIONS(DUMP) copies records without clearing the input. TYPE(17,18) keeps only those types. DATE takes the Julian dates yyyyddd and START and END the times hhmm. The output keeps SMF's variable-length spanned records, so it is read by a reporting tool or program, not browsed as text.
Which SMF record type is written when a non-VSAM data set is scratched (deleted)?
Show a hint
Rename is the next number up.
Show the solution
Type 17.
Examples are for learning. Run commands and jobs only on a system you are authorised to use, such as a training or test system, and never on production without approval.
Common mistakes
Choose the types first. Reading everything is slow and buries the answer.
If the job could have run on any system in the sysplex, extract from all of them.
SMF records are binary. Use a reporting tool or a program that understands the layouts.
What you will see at work
- Audit and security requests usually arrive with a data set name, a user ID or a date; those become the filters.
- Many sites keep SMF archives for years, so old questions can be answered if the right types were collected.
- Collection itself is controlled by SMFPRMxx, covered in the SMF and RMF course.
Key terms
Check your understanding.
Take this lesson's quiz and save your progress. Free.