IBM Support

PI05578: ENHANCE DSN1SMFP TO SUPPORT DB2 10 FOR Z/OS

A fix is available

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • ENHANCE DSN1SMFP TO SUPPORT DB2 10 FOR Z/OS
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: DB2 10 for z/OS customers who want a basic   *
    *                 tool for evaluating DB2 audit records.       *
    ****************************************************************
    * PROBLEM DESCRIPTION: This PTF provides a basic reporting     *
    *                      tool that can be used to read and       *
    *                      format selected fields in DB2 10 for    *
    *                      z/OS audit trace records that are       *
    *                      stored in SMF format.                   *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    This PTF adds DSN1SMFP to DB2 10 for z/OS.  DSN1SMFP is a
    DB2-supplied application for processing DB2 audit trace data
    into reports that are useful for basic evaluation.  This PTF
    also adds a sample job called DSNTEJCC that shows how to call
    DSN1SMFP.
    
    For complete evaluation, customers should also use other
    products, such as IBM Tivoli OMEGAMON XE for DB2 Performance
    Expert on z/OS for much more robust reporting.
    .
    ==============
    About DSN1SMFP
    ==============
    DSN1SMFP accepts one or more SMF data sets in standard SMF
    format and produces from one to nineteen reports. All SMF
    record types are accepted but only type 101 (DB2 Accounting)
    and 102 (DB2 Performance) records generated by the DB2 release
    level of DSN1SMFP and having one of the following DB2 IFCIDs are
    used:
      * 0003: Accounting - DDF Data by Location (security-relevant
              fields only)
      * 0004: Trace Start
      * 0005: Trace Stop
      * 0023: Utility Start
      * 0024: Utility Change
      * 0025: Utility End
      * 0083: Identify End
      * 0106: System Parameters (security-relevant fields only)
      * 0140: Audit Authorization Failures
      * 0141: Audit DDL Grant/Revoke
      * 0142: Audit DDL Create/Alter/Drop
      * 0143: Audit First Write
      * 0144: Audit First Read
      * 0145: Audit DML Statement
      * 0269: Trusted Connection
      * 0270: Trusted Context
      * 0350: SQL Statement
      * 0361: Audit Administrative Authorities
      * 0362: Trace Start and Stop with AUDITPOLICY
    
    Each such trace type is extracted and outputted in report format
    to a dedicated DD for that trace type.  The output DD name
    indicates the report source: For example, the report
    for each IFCID 0003 trace record is written to the IFCID003 DD,
    the report for each IFCID 0106 trace record is written to the
    IFCID106 DD, and so on.
    
    DSN1SMFP accepts SMF records from any release of DB2 but uses
    only those for the release in which it ships. You cannot, for
    example, use V10 DSN1SMFP to report on a V9 DB2.
    .
    DSN1SMFP also counts and reports the following values in the
    end-of-job summary, which is written to the SYSPRINT DD:
      * Total SMF records read
      * Total SMF type 101 records
      * Total SMF type 102 records
      * Separate totals for IFCIDs 0003, 0004, 0005, 0023, 0024,
        0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144, 0145,
        0269, 0270, 0350, 0361, 0362
        and "other IFCID" records read
      * Separate totals for formatted IFCID 0003, 0004, 0005, 0023,
        0024, 0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144, 0145,
        0269, 0270, 0350, 0361 and 0362 records written
      * Total formatted records written
    
    The SYSPRINT DD is also the destination for diagnostic and
    warning messages generated by DSN1SMFP.
    
    DSN1SMFP requires the following DD statements:
      * STEPLIB/JOBLIB (input)
          The STEPLIB or JOBLIB DD must specify both the SDSNEXIT
          and SDSNLOAD libraries unless both of these are available
          from the link list.  The SDSNEXIT library needs to
          contain the DSNHDECP module used by the DB2 subsystem that
          generated the SMF records to be processed.
      * SMFINDD (input)
          The SMFINDD DD must specify one or more data sets that
          contain DB2 trace records in standard SMF format. All SMF
          records are acceptable but DSN1SMFP will select only SMF
          type 101 and 102 records that match its DB2 release level,
          and that have an IFCID type of 0003, 0004, 0005, 0023,
          0024, 0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144,
          0145, 0269, 0270, 0350, 0361 or 0362.
      * IFCID003 (output)
          Contains the Accounting - DDF data by location reports,
          derived from security-related fields of the IFCID 0003
          trace record.  Only IFCID 0003 records that contain a
          distributed data facility statistics (DSNDQLAC) block are
          reported.  One report is generated for each selected
          IFCID 0003 record.
      * IFCID004 (output)
          Contains the Trace Start reports, derived from the IFCID
          0004 trace record.  One report is generated for each
          selected IFCID 0004 record.
      * IFCID005 (output)
          Contains the Trace Stop reports, derived from the IFCID
          0005 trace record.  One report is generated for each
          selected IFCID 0005 record.
      * IFCID023 (output)
          Contains the Utility Start reports, derived from the
          IFCID 0023 trace record.  One report is generated for
          each selected IFCID 0023 record.
      * IFCID024 (output)
          Contains the Utility Change reports, derived from the
          IFCID 0024 trace record.  One report is generated for
          each selected IFCID 0024 record.
      * IFCID025 (output)
          Contains the Utility Stop reports, derived from the IFCID
          0025 trace record.  One report is generated for each
          selected IFCID 0025 record.
      * IFCID083 (output)
          Contains the An Identify Request End reports, derived from
          the IFCID 0083 trace record. One report is generated for
          each selected IFCID 0083 record.
      * IFCID106 (output)
          Contains the System Parameters reports, derived from
          security-related fields of the IFCID 0106 trace record.
          One report is generated for each selected IFCID 0106
          record, and each such report has five sections:
            * System Initialization Parameters
            * Miscellaneous Installation Parameters
            * Distributed Data Facility Parameters
            * Data Sharing Parameters
            * Application programming defaults
      * IFCID140 (output)
          Contains the Audit Authorization Failures reports,
          derived from the IFCID 0140 trace record. One report is
          generated for each selected IFCID 0140 record.
      * IFCID141 (output)
          Contains the Audit DDL GRANT/REVOKE reports, derived from
          the IFCID 0141 trace record. One report is generated for
          each selected IFCID 0141 record.
      * IFCID142 (output)
          Contains the Audit DDL CREATE/ALTER/DROP reports, derived
          from the IFCID 0142 trace record. One report is generated
          for each selected IFCID 0142 record.
      * IFCID143 (output)
          Contains the Audit First Write reports, derived from the
          IFCID 0143 trace record.  One report is generated for
          each selected IFCID 0143 record.
      * IFCID144 (output)
          Contains the Audit First Read reports, derived from the
          IFCID 0144 trace record.  One report is generated for
          each selected IFCID 0144 record.
      * IFCID145 (output)
          Contains the Audit DML Statements reports, derived from
          the IFCID 0145 trace record.  One report is generated for
          each selected IFCID 0145 record.
      * IFCID269 (output)
          Contains the Trusted Connection reports, derived from the
          IFCID 0269 trace record.  One report is generated for
          each selected IFCID 0269 record.
      * IFCID270 (output)
          Contains the Trusted Context Create/Alter reports, derived
          from the IFCID 0270 trace record.  One report is generated
          for each selected IFCID 0270 record.
      * IFCID350 (output)
          Contains the SQL statement reports, derived from the
          IFCID 0350 trace record.  One report is generated for
          each selected IFCID 0350 record.
      * IFCID361 (output)
          Contains the Audit Administrative Authorities reports,
          derived from the IFCID 0361 trace record.  One report is
          generated for each selected IFCID 0361 record.
      * IFCID362 (output)
          Contains the Trace Start and Stop with AUDITPOLICY
          reports, derived from the IFCID 0362 trace record.  One
          report is generated for each selected IFCID 0362 record.
      * SYSPRINT (output) Contains the end of job summary of records
        read plus diagnostic messages for any DSN1SMFP processing
        exceptions.
    
    ================
    Running DSN1SMFP
    ================
    DSN1SMFP loads the DSNHDECP module to obtain the EBCDIC CCSIDs
    to be used when converting Unicode-encoded trace data to EBCDIC
    format:  To avoid conversion problems and possible contamination
    of output, ensure that DSN1SMFP can load the DSNHDECP module
    used by the DB2 subsystem that generated the SMF records to be
    processed.  Users of DSN1SMFP must ensure that the library where
    the local DSNHDECP module resides (typically prefix.SDSNEXIT) is
    available and allocated ahead of prefix.SDSNLOAD in the JOBLIB
    or STEPLIB DD concatenation.  When DSN1SMFP encounters an IFCID
    0106, if the EBCDIC CCSID that is used by DB2 does not agree
    with the CCSID that is loaded from DSNHDECP, DSN1SMFP reports a
    warning message and ends with a minimum return code of 4.
    
    DSN1SMFP is designed for execution in the z/OS batch process.
    It has no dependency on DB2 other than as a source of the SMF
    records and the DSNHDECP module.
    
    Output DDs can be allocated to a print device, a data set, or
    held output.
    
    ===================
    Sample job DSNTEJCC
    ===================
    For convenience, sample job DSNTEJCC provides the basic JCL
    framework needed to execute DSN1SMFP.  DSNTEJCC is not intended
    to be run as part of the DB2 Installation Verification Procedure
    (IVP).  Note that DB2 does not provide sample SMF records.
    
    See the DSNTEJCC prolog for directions on how to customize it
    for use at your site.
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    PI05578

  • Reported component name

    DB2 OS/390 & Z/

  • Reported component ID

    5740XYR00

  • Reported release

    A10

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-11-06

  • Closed date

    2014-01-31

  • Last modified date

    2014-03-03

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

    UI14715

Modules/Macros

  • DSNTEJCC DSN1SMFP HDBAA10J
    

Fix information

  • Fixed component name

    DB2 OS/390 & Z/

  • Fixed component ID

    5740XYR00

Applicable component levels

  • RA10 PSY UI14715

       UP14/02/15 P F402

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.



Document information

More support for: DB2 for z/OS

Software version: 10.1

Reference #: PI05578

Modified date: 03 March 2014