A fix is available
APAR status
Closed as program error.
Error description
ENHANCE DSN1SMFP TO SUPPORT DB2 10 FOR Z/OS
Local fix
N/A
Problem summary
**************************************************************** * USERS AFFECTED: DB2 10 for z/OS customers who want a basic * * tool for evaluating DB2 audit records. * **************************************************************** * PROBLEM DESCRIPTION: This PTF provides a basic reporting * * tool that can be used to read and * * format selected fields in DB2 10 for * * z/OS audit trace records that are * * stored in SMF format. * **************************************************************** * RECOMMENDATION: * **************************************************************** This PTF adds DSN1SMFP to DB2 10 for z/OS. DSN1SMFP is a DB2-supplied application for processing DB2 audit trace data into reports that are useful for basic evaluation. This PTF also adds a sample job called DSNTEJCC that shows how to call DSN1SMFP. For complete evaluation, customers should also use other products, such as IBM Tivoli OMEGAMON XE for DB2 Performance Expert on z/OS for much more robust reporting. . ============== About DSN1SMFP ============== DSN1SMFP accepts one or more SMF data sets in standard SMF format and produces from one to nineteen reports. All SMF record types are accepted but only type 101 (DB2 Accounting) and 102 (DB2 Performance) records generated by the DB2 release level of DSN1SMFP and having one of the following DB2 IFCIDs are used: * 0003: Accounting - DDF Data by Location (security-relevant fields only) * 0004: Trace Start * 0005: Trace Stop * 0023: Utility Start * 0024: Utility Change * 0025: Utility End * 0083: Identify End * 0106: System Parameters (security-relevant fields only) * 0140: Audit Authorization Failures * 0141: Audit DDL Grant/Revoke * 0142: Audit DDL Create/Alter/Drop * 0143: Audit First Write * 0144: Audit First Read * 0145: Audit DML Statement * 0269: Trusted Connection * 0270: Trusted Context * 0350: SQL Statement * 0361: Audit Administrative Authorities * 0362: Trace Start and Stop with AUDITPOLICY Each such trace type is extracted and outputted in report format to a dedicated DD for that trace type. The output DD name indicates the report source: For example, the report for each IFCID 0003 trace record is written to the IFCID003 DD, the report for each IFCID 0106 trace record is written to the IFCID106 DD, and so on. DSN1SMFP accepts SMF records from any release of DB2 but uses only those for the release in which it ships. You cannot, for example, use V10 DSN1SMFP to report on a V9 DB2. . DSN1SMFP also counts and reports the following values in the end-of-job summary, which is written to the SYSPRINT DD: * Total SMF records read * Total SMF type 101 records * Total SMF type 102 records * Separate totals for IFCIDs 0003, 0004, 0005, 0023, 0024, 0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144, 0145, 0269, 0270, 0350, 0361, 0362 and "other IFCID" records read * Separate totals for formatted IFCID 0003, 0004, 0005, 0023, 0024, 0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144, 0145, 0269, 0270, 0350, 0361 and 0362 records written * Total formatted records written The SYSPRINT DD is also the destination for diagnostic and warning messages generated by DSN1SMFP. DSN1SMFP requires the following DD statements: * STEPLIB/JOBLIB (input) The STEPLIB or JOBLIB DD must specify both the SDSNEXIT and SDSNLOAD libraries unless both of these are available from the link list. The SDSNEXIT library needs to contain the DSNHDECP module used by the DB2 subsystem that generated the SMF records to be processed. * SMFINDD (input) The SMFINDD DD must specify one or more data sets that contain DB2 trace records in standard SMF format. All SMF records are acceptable but DSN1SMFP will select only SMF type 101 and 102 records that match its DB2 release level, and that have an IFCID type of 0003, 0004, 0005, 0023, 0024, 0025, 0083, 0106, 0140, 0141, 0142, 0143, 0144, 0145, 0269, 0270, 0350, 0361 or 0362. * IFCID003 (output) Contains the Accounting - DDF data by location reports, derived from security-related fields of the IFCID 0003 trace record. Only IFCID 0003 records that contain a distributed data facility statistics (DSNDQLAC) block are reported. One report is generated for each selected IFCID 0003 record. * IFCID004 (output) Contains the Trace Start reports, derived from the IFCID 0004 trace record. One report is generated for each selected IFCID 0004 record. * IFCID005 (output) Contains the Trace Stop reports, derived from the IFCID 0005 trace record. One report is generated for each selected IFCID 0005 record. * IFCID023 (output) Contains the Utility Start reports, derived from the IFCID 0023 trace record. One report is generated for each selected IFCID 0023 record. * IFCID024 (output) Contains the Utility Change reports, derived from the IFCID 0024 trace record. One report is generated for each selected IFCID 0024 record. * IFCID025 (output) Contains the Utility Stop reports, derived from the IFCID 0025 trace record. One report is generated for each selected IFCID 0025 record. * IFCID083 (output) Contains the An Identify Request End reports, derived from the IFCID 0083 trace record. One report is generated for each selected IFCID 0083 record. * IFCID106 (output) Contains the System Parameters reports, derived from security-related fields of the IFCID 0106 trace record. One report is generated for each selected IFCID 0106 record, and each such report has five sections: * System Initialization Parameters * Miscellaneous Installation Parameters * Distributed Data Facility Parameters * Data Sharing Parameters * Application programming defaults * IFCID140 (output) Contains the Audit Authorization Failures reports, derived from the IFCID 0140 trace record. One report is generated for each selected IFCID 0140 record. * IFCID141 (output) Contains the Audit DDL GRANT/REVOKE reports, derived from the IFCID 0141 trace record. One report is generated for each selected IFCID 0141 record. * IFCID142 (output) Contains the Audit DDL CREATE/ALTER/DROP reports, derived from the IFCID 0142 trace record. One report is generated for each selected IFCID 0142 record. * IFCID143 (output) Contains the Audit First Write reports, derived from the IFCID 0143 trace record. One report is generated for each selected IFCID 0143 record. * IFCID144 (output) Contains the Audit First Read reports, derived from the IFCID 0144 trace record. One report is generated for each selected IFCID 0144 record. * IFCID145 (output) Contains the Audit DML Statements reports, derived from the IFCID 0145 trace record. One report is generated for each selected IFCID 0145 record. * IFCID269 (output) Contains the Trusted Connection reports, derived from the IFCID 0269 trace record. One report is generated for each selected IFCID 0269 record. * IFCID270 (output) Contains the Trusted Context Create/Alter reports, derived from the IFCID 0270 trace record. One report is generated for each selected IFCID 0270 record. * IFCID350 (output) Contains the SQL statement reports, derived from the IFCID 0350 trace record. One report is generated for each selected IFCID 0350 record. * IFCID361 (output) Contains the Audit Administrative Authorities reports, derived from the IFCID 0361 trace record. One report is generated for each selected IFCID 0361 record. * IFCID362 (output) Contains the Trace Start and Stop with AUDITPOLICY reports, derived from the IFCID 0362 trace record. One report is generated for each selected IFCID 0362 record. * SYSPRINT (output) Contains the end of job summary of records read plus diagnostic messages for any DSN1SMFP processing exceptions. ================ Running DSN1SMFP ================ DSN1SMFP loads the DSNHDECP module to obtain the EBCDIC CCSIDs to be used when converting Unicode-encoded trace data to EBCDIC format: To avoid conversion problems and possible contamination of output, ensure that DSN1SMFP can load the DSNHDECP module used by the DB2 subsystem that generated the SMF records to be processed. Users of DSN1SMFP must ensure that the library where the local DSNHDECP module resides (typically prefix.SDSNEXIT) is available and allocated ahead of prefix.SDSNLOAD in the JOBLIB or STEPLIB DD concatenation. When DSN1SMFP encounters an IFCID 0106, if the EBCDIC CCSID that is used by DB2 does not agree with the CCSID that is loaded from DSNHDECP, DSN1SMFP reports a warning message and ends with a minimum return code of 4. DSN1SMFP is designed for execution in the z/OS batch process. It has no dependency on DB2 other than as a source of the SMF records and the DSNHDECP module. Output DDs can be allocated to a print device, a data set, or held output. =================== Sample job DSNTEJCC =================== For convenience, sample job DSNTEJCC provides the basic JCL framework needed to execute DSN1SMFP. DSNTEJCC is not intended to be run as part of the DB2 Installation Verification Procedure (IVP). Note that DB2 does not provide sample SMF records. See the DSNTEJCC prolog for directions on how to customize it for use at your site.
Problem conclusion
Temporary fix
Comments
APAR Information
APAR number
PI05578
Reported component name
DB2 OS/390 & Z/
Reported component ID
5740XYR00
Reported release
A10
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2013-11-06
Closed date
2014-01-31
Last modified date
2014-03-03
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
UI14715
Modules/Macros
DSNTEJCC DSN1SMFP HDBAA10J
Fix information
Fixed component name
DB2 OS/390 & Z/
Fixed component ID
5740XYR00
Applicable component levels
RA10 PSY UI14715
UP14/02/15 P F402
Fix is available
Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEPEK","label":"Db2 for z\/OS"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.1","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}},{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M","label":"APARs - z\/OS environment"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.1","Edition":"","Line of Business":{"code":"","label":""}}]
Document Information
Modified date:
03 March 2014