Unix work running under z/OS can be difficult to track.
A Unix process can create thousands of child processes, each running in another address space. They may only exist for fractions of a second and produce no job output, so you don’t see them in SDSF. Child processes create their own SMF type 30 records for job accounting, so their resource usage doesn’t appear in the parent’s accounting records. The child processes may have a different jobname and can even run in different service and report classes to the parent.
I have seen a job running BPXBATCH where the job itself used virtually no CPU time, but it spawned over 10,000 sub tasks. More than 99% of the CPU time used by that batch job appeared in child process SMF records with different job names, service and report classes.
EasySMF has reports to help you understand your z/OS Unix work.
EasySMF uses the Unix process and parent process id information from the type 30 SMF records to build a tree view of your Unix work.
- You can see the parent – child relationships between different address spaces.
- You can see whether the child service and report classes are the same as the original job.
- When you collapse the tree, usage information from all the children is rolled up into the parent job. When you expand the tree, usage information is shown for the individual entries.
The expanded view of Unix work, showing the relationship between work running in different address spaces:
The collapsed view of the same work. Resources like CPU time show the total for all the related address spaces:
Related Processes
EasySMF can also help you find where work came from. If Related Processes is selected, EasySMF will search for and show parent and child tasks that do not match the main selection criteria. Here we can see a task with the job name ANDREWR, and Related Processes shows that particular task came in through SSH, and it had a number of Unix sub tasks.
More Detailed Information about Unix Work
The Unix Work report shows you more detail about work that uses z/OS Unix. As the name suggests, it only shows work that had a Unix component – other batch jobs and started tasks are ignored. This report shows information from the step and substep end records, which include some information about the program that was executed. This give clues to the processing taking place, although the information included in SMF is limited and may not show every program.
Unix processes don’t always run in a different address space under z/OS. Sometimes processes will share an address space. This gives multiple Unix Process sections in SMF, with most of the statistics reported at the shared address space level. You can see this in the Unix Process report where you have processes that do not report the address space level information.
You can filter the Unix Work report to find a particular process ID – in this case the selected process was one of multiple processes that shared one address space.
Detailed Unix information is included in EasySMF since version 3.2.
Upgrades are free for existing customers. If you are not a customer, a 30 day trial is available.