This report lists information about z/OS Unix file activity. It lists:
•File open
•File close
•MMAP (memory map file)
•MUNMAP
•File Delete
•Security attribute changes
Information that may be shown, depending on the data included in the record includes:
•Path name
•Job
•User
•File I/O statistics
•New name
File and Path Name Notes
1.Open and Close records
Open records (type 92 subtype 10) do not include the path name. EasySMF tries to find matching close records for each open in order to show the path name for the file open entry. EasySMF compares the System ID, Device, File Serial, Open File Token and Open STCK entries between open and close records to ensure that the records match. If an open has no matching close record, the pathname will be blank.
2.Entries without a path name
Often some detective work can find information about entries without a path name (or with unhelpful path names such as "." - the current directory). Clicking on the File Serial or Parent Serial cells in the report will "drill through" to the same report using the System, Device and File Serial as a filter.
This will often show other accesses to the same file (or the same directory for the Parent Serial) which do show the pathname. In some circumstances the file serial number might be reused, but sorting by time and looking at the pattern of access should indicate whether the information is reliable.
Drill through
Clicking on an entry in the table will drill through to show more information. The drill through target varies depending on the cell that is clicked:
•File Serial: Drills through to the same report, using the System, Device and File Serial as a filter. This shows other accesses to the same file.
•Parent Serial: (Delete records only) Drills through to the same report, using the System, Device and Parent Serial as a filter. This shows other accesses to the parent directory.
•Device: Drills through to the same report, using the System and Device as a filter. Shows other accesses to the same physical filesystem.
•UID: Drills through to the same report, using the UID as a filter. Shows other accesses by the same user.
•Any other cell: Drills through to the Job Status During Interval report using the System and Jobname to display information about the job from SMF type 30 records. The time period is expanded to try to ensure that some type 30 records e.g. interval records for the job are captured.
Report Parameters
Parameter |
Description |
System |
The SMF ID of the system that wrote the record. |
Path |
Filter by path name. Note: The path name is not always recorded in the type 92 records, and the same entry may be recorded with different paths e.g. full or relative path names. To find all entries for a particular file, you may need to use the name to find the device number and file serial, then filter on those names without the path filter. Click on the file serial number to drill though and filter on device number and file serial automatically. |
Job |
Filter by job name. |
User |
Filter by user name. |
UID |
Filter by unix numeric UID. |
File Serial |
Filter by file serial number. |
Device # |
Filter by device number for the file. |
SMF records used for this report
Type |
Subtype |
92 |
10 |
92 |
11 |
92 |
12 |
92 |
13 |
92 |
14 |
92 |
15 |