z/OS Unix File Activity

Navigation:  Table of Contents > Reports > Dataset Activity Reports >

z/OS Unix File Activity

Previous pageReturn to chapter overviewNext page

This report lists information about z/OS Unix file activity. It lists:

File open

File close

MMAP (memory map file)

MUNMAP

File Delete

Security attribute changes

 

Information that may be shown, depending on the data included in the record includes:

Path name

Job

User

File I/O statistics

New name

 

File and Path Name Notes

 

1.Open and Close records

 

Open records (type 92 subtype 10) do not include the path name. EasySMF tries to find matching close records for each open in order to show the path name for the file open entry. EasySMF compares the System ID, Device, File Serial, Open File Token and Open STCK entries between open and close records to ensure that the records match. If an open has no matching close record, the pathname will be blank.

 

2.Entries without a path name

 

Often some detective work can find information about entries without a path name (or with unhelpful path names such as "." - the current directory). Clicking on the File Serial or Parent Serial cells in the report will "drill through" to the same report using the System, Device and File Serial as a filter.

 

This will often show other accesses to the same file (or the same directory for the Parent Serial) which do show the pathname. In some circumstances the file serial number might be reused, but sorting by time and looking at the pattern of access should indicate whether the information is reliable.

 

Drill through

 

Clicking on an entry in the table will drill through to show more information. The drill through target varies depending on the cell that is clicked:

File Serial: Drills through to the same report, using the System, Device and File Serial as a filter. This shows other accesses to the same file.

Parent Serial: (Delete records only) Drills through to the same report, using the System, Device and Parent Serial as a filter. This shows other accesses to the parent directory.

Device: Drills through to the same report, using the System and Device as a filter. Shows other accesses to the same physical filesystem.

UID: Drills through to the same report, using the UID as a filter. Shows other accesses by the same user.

Any other cell: Drills through to the Job Status During Interval report using the System and Jobname to display information about the job from SMF type 30 records. The time period is expanded to try to ensure that some type 30 records e.g. interval records for the job are captured.

 

Report Parameters

 

Parameter

Description

System

The SMF ID of the system that wrote the record.

Path

Filter by path name.

Note: The path name is not always recorded in the type 92 records, and the same entry may be recorded with different paths e.g. full or relative path names.

To find all entries for a particular file, you may need to use the name to find the device number and file serial, then filter on those names without the path filter. Click on the file serial number to drill though and filter on device number and file serial automatically.

Job

Filter by job name.

User

Filter by user name.

UID

Filter by unix numeric UID.

File Serial

Filter by file serial number.

Device #

Filter by device number for the file.

 

SMF records used for this report

 

Type

Subtype

92

10

92

11

92

12

92

13

92

14

92

15