Creating DFSMSrmm SMF audit record reports

Figure 1 shows the sample JCL for processing SMF records. The sample uses this information, taken from the volume details within the SMF record:

Volume serial number
Volume creation date
Date that the volume information last changed
User ID that last changed the volume information by command
Date that the volume information was last changed by an RMM TSO subcommand request

The report also includes this information which is taken from the SMF record header:

Time
Date
System identification
RACF® user ID
Activity type

The ICETOOL JCL example in Figure 1 performs these functions:

Uses a COPY operator to create a data set with just the SMF audit (X'FC') volume records (V) for use by the subsequent DISPLAY operator.
Uses a DISPLAY operator to create an SMF audit record for the V records.

You must add 1 to an SMF field offset to get its position for DFSORT and ICETOOL statements. Alternatively, you can use DFSORT symbols, which map the DFSMSrmm fields you need, freeing you from having to know their positions, lengths, and formats. See Using symbols with DFSORT's ICETOOL and DFSORT for more information about using symbols.

Figure 1. Sample ICETOOL JCL for processing SMF records

//STEP1  EXEC  PGM=ICETOOL
//TOOLMSG  DD SYSOUT=*   ICETOOL MESSAGES
//DFSMSG   DD SYSOUT=*   DFSORT  MESSAGES
//RAWSMF   DD DSN=ACCT.SJFEMVSA.D921102.T230004,DISP=SHR
//RMMV     DD DSN=&&TEMPV,REFDD=*.RAWSMF
//VREPT DD SYSOUT=*
//TOOLIN   DD *          CONTROL STATEMENTS
* FIND THE RMM SMF AUDIT 'VOLUME' RECORDS
  COPY FROM(RAWSMF) TO(RMMV) USING(SMFV)
* DISPLAY VARIOUS FIELDS FROM THE SMF HEADER AND VOLUME SECTION
  DISPLAY FROM(RMMV) LIST(VREPT) -
     TITLE('DFSMSrmm - SMF Audit Records') DATE TIME PAGE -
     BLANK -
*    SMF HEADER FIELDS
     HEADER('TIME') ON(8,3,HEX) -
     HEADER('DATE') ON(11,4,PD) -
     HEADER('SYS') ON(15,4,CH) -
     HEADER('USER') ON(35,8,CH) -
     HEADER('ACT') ON(43,1,CH) -
*    VOLUME SECTION FIELDS
     HEADER('VOLUME') ON(46,6,CH) -
     HEADER('CREATE') ON(104,4,PD) -
     HEADER('LASTCH') ON(128,4,PD) -
     HEADER('LASTUSER') ON(136,8,CH) -
     HEADER('LASTSYS') ON(144,8,CH) -
     HEADER('LASTUSCH') ON(152,4,PD)
//SMFVCNTL DD *
* The X'FC' is the SMF record number specified to RMM SMFAUD
* The X'FC' is record number 252 - Change it to your record number
  INCLUDE COND=(6,1,BI,EQ,X'FC',AND,
              44,1,CH,EQ,C'V')
  OPTION VLSHRT
/*

See Figure 1 for the equivalent sample JCL using DFSORT symbols.

Figure 2 shows sample report output for the SMF audit report.

Figure 2. Sample DISPLAY Report (VREPT DD)

RMM SMF AUDIT RECORDS        11/05/97        07:40:13        - 1 -

 TIME         DATE   SYS    USER       ACT   VOLUME     CREATE     LASTCH   LASTUSER   LASTSYS   LASTUSCH
 ------   --------   ----   --------   ---   ------   --------   --------   --------   -------   --------
 63202A      97307   MVSA   HOLLYYAM   C     ND0335    1997058    1997307   TAPELIB    MVSA       1997058
 6321B6      97307   MVSA   YAEGER     C     ND0336    1997058    1997307   TAPELIB    MVSA       1997058
 6321B8      97307   MVSA   WILLITS    C     ND0339    1997058    1997307   TAPELIB    MVSA       1997058
   .
   .
   .
 853C1A      97307   MVSA   YAEGER     C     ND0338    1997035    1997307   TAPELIB    MVSA       1997035
 863C24      97307   MVSA   JMB01      C     NB1876    1996271    1997307   TAPELIB    MVSA       1996271