Using the audit report

Use the audit report to track changes to the control data set, identify inadvertent changes, and recover lost volumes. DFSMSrmm creates an audit SMF record whenever information about a volume, a rack number, or bin number changes in the control data set when you specify option SMFAUD(nnn). With EDGAUD, you can create reports that list the changes that have been made in the control data set.

The basic audit report consists of these individual reports: the VOLUME report, the RACK/BIN report, and the USERID report.

VOLUME report
DFSMSrmm adds a report line in the volume report when volume information changes. The volume report is sorted by volume serial number.
RACK/BIN report
DFSMSrmm updates information in this report when volume information and rack or bin number information change. The rack/bin report is sorted by rack or bin number.
USERID report
DFSMSrmm updates information in this report when volume information and rack or bin number information change. The USERID report is sorted by user ID.

Changes to volume information can affect more than the volume report. For example, the EDGAUD utility makes these audit report entries when a volume is added to the library:

A volume line in the VOLUME report
A volume line in the RACK/BIN report
A volume line in the USERID report
A report line for deletion of an empty rack number in the RACK/BIN report
A report line for creation of an in-use rack number in the RACK/BIN report

When a volume is in the process of being moved, DFSMSrmm marks the location field in the audit report with the '<' character, as shown in Excerpts from an audit trail report. This marks the location as the one from which the volume is moving.

The audit report columns include:

VOLUME

Volume serial number.

RACK

Rack number.

BIN

Bin number.

USERID

User ID that initiated the change. A user ID that starts with an asterisk (*) indicates that a DFSMSrmm function initiated the change.

DATE

Date the control data set changed.

TIME

Time the control data set changed.

SYSTEM

The SMF system identifier.

STATUS

One of:

ABEND: A data set on the volume was closed by abend processing.
CLOSED: For a stacked volume, DFSMSrmm lists the stacked volume in the report because the stacked volume was closed by command processing or export processing.
EMPTY: Rack or bin number has no volume assigned. For a stacked volume, the stacked volume contains no volumes.
IN USE: Rack or bin number contains non-scratch volume.
MASTER: Volume is master status.
OPEN: Data set on the volume is open. For a stacked volume, the stacked volume contains at least one volume.
RELEASE: Volume is pending release.
SCRATCH: Volume is scratch or shelf location contains scratch volume.
USER: Volume is a user volume.
VITAL: Volume is retained by a vital record specification. For a stacked volume, the stacked volume contains volumes that are retained by vital record specifications.

LOCATION

Location where the volume is stored. When a volume is in the process of being moved, DFSMSrmm marks the location field in the audit report with the '<' character.

LOAN LOC

Location outside the library where the volume is on loan.

OWNER

Volume owner.

EXP DATE

Volume expiration date.

SECURITY

Highest security classification in effect when the volume was accessed.

ACTIVITY

Can be: CREATE, DELETE, or UPDATE.

Excerpts from an audit trail report shows excerpts from an audit trail report. The first column heading identifies the type of report information that is contained in the report.