SMF record type 92

SMF record type 92 provides reports of activities related to the z/OS® UNIX file system.

Tip: The File System I/O counts displayed in the ISHELL mount table is available if type 92 subtype 5 (unmount) is active at the time the file system was mounted. To avoid the overhead associated with recording type 92 subtype 10, 11, and 14 (open, close, delete or rename), adjust the parameters in SMPFPRMxx using the TYPE or NOTYPE operands to exclude the subtype 10, 11, and 14 records.

Table 1 lists the subtypes for SMF record type 92.

Table 1. Subtypes for SMF record type 92. This table lists the subtypes for SMF record type 92 and explains how they are produced.
Subtype	Produced ...
1	After the file system is mounted. I/O activity for a file system is reported in a subtype 5 record when the file system is unmounted. This activity is not accumulated unless subtype 5 is active when the file system is mounted. When a file system is mounted, SMF begins collecting accounting data for the file system's I/O activity if subtype 5 for unmount is active at the time of the mount. Partial SMF accounting does not occur; either all the information for a file system is collected, or none is collected. Subtype 1 records are useful because they provide information about the total space available in the file system and the total space currently used. You can see if it is time to increase the size of a mountable file system.
2	After the file system is quiesced (that is, suspended). HFS file systems are quiesced when they are backed up by the hierarchical storage manager (HMS). Any non-zFS system can also be quiesced by programs that call the BPX1QSE (quiesce) callable service. Any file system might be quiesced during certain sysplex operations such as when a file system is moved within a shared file system configuration.
4	After the file system is unquiesced (that is, resumed).
5	After the file system is unmounted. Unmount records provide the following I/O data summarized for the entire mountable file system: Directory reads Read and write callable services requested Read and write EXCP counts Total bytes read and bytes written To obtain this data, SMF recording for unmount must be active at the same time that the file system is originally mounted.
6	After the file system is remounted. If a file system is remounted to change modes between read-only and read/write, a subtype 6 record is produced. It contains the same information as in the type 5 (unmount) record. In order for the remount records to contain data on I/O activity, unmount recording must be active at the time the file system is originally mounted.
7	After the file system is moved. If ownership of a file system is changed in a shared file system configuration, a subtype 7 record is produced.
10	After a file is opened. I/O activity for particular open is reported in a subtype 11 (close) record when the file is closed. This activity is not accumulated unless subtype 11 is active when the file is opened. When a file is opened, SMF begins collecting accounting data for I/O activity related to this open if subtype 11 is active. Partial SMF accounting does not occur; either all the information for an open file is collected, or none is collected. Because collecting file activity can be expensive, collect subtype 10 records only when file-level data is needed.
11	When a file is closed. File-close records provide information about I/O activity of a user or application against a specific file. These records provide the following data for a specific user or application and a specific file: Read and write callable services requested Read and write EXCP counts Total bytes that are read and bytes that are written Path name of the file To obtain a record of I/O activity, SMF recording must be active for subtype 11 at the time a file is both opened and closed. Because collecting file activity can be expensive, collect subtype 11 records when file-level data is needed.
12	After mmap() is used to establish a mapping between a process's address space and a file.
13	After munmap() is used to remove the mapping that was established by a previous mmap() request.
14	After a file or file directory is deleted or renamed. To gather information about the deleting of files and directories, you can set up monitoring for SMF type 92 records with subtype 14. When files or directories are deleted, you will receive information about the time the file or directory was deleted or renamed, in addition to its file type, serial number, and unique device number. In a shared file system, the recording occurs on the user's system where the command was issued.
15	When the security attributes for APF-authorized programs, shared library programs, or programs defined to program control are changed. External calls to change these attributes are audited. The various places where the system clears these attributes, such as if the file is opened for write or if it is renamed, are not audited. In addition to the regular user, file, and file system information for type 92 records, the following information is also included The old and the new security attributes, to show what was changed. The file's RACF® file ID, to help in correlating these records with the XXXX_FILE_ID field of SMF 80 records for the same file . The full path name of the file. If the path name string that was passed on the call to chattr() is an absolute path name, it is copied here. If it is a relative path name, the input string is appended to the realpath() value of the current working directory. The path name will be as passed on the call to chattr() for absolute path names. For relative path names the input path name segment is appended to the realpath() value of the current working directory.
16	For socket and character special files, when a file is closed. File-close records provide information about I/O activity of a user or application against a specific file. These records provide the following data for a specific user or application and a specific file: Read and write callable services requested Read and write EXCP counts Total bytes that are read and bytes that are written Path name of the file To obtain a record of I/O activity, SMF recording must be active for subtype 16 at the time a file is both opened and closed. Because collecting file activity can be expensive, only collect subtype 16 records when file-level data is needed.
17	Contains information about the number of times a file is accessed throughout the life of an open. The information is written on the SMF global recording interval and when the internal representation (control block) of the file is freed. In some error flows (for example, file system move failures and dead system recovery), some SMF records might be lost.

Unmount records also provide the following I/O data summarized for the entire mountable file system:

Directory reads
Read and write callable services requested
Read and write EXCP counts
Total bytes read and bytes written

File-close records provide information about I/O activity of a user or application against a specific file. These records provide the following data for a specific user or application and a specific file:

Read and write callable services requested
Read and write EXCP counts
Total bytes that are read and bytes that are written
Path name of the file