IBM Mainframe Forum Index
 
Log In
 
IBM Mainframe Forum Index Mainframe: Search IBM Mainframe Forum: FAQ Register
 

Structure of SMF Record 65 Catalog Record


IBM Mainframe Forums -> JCL & VSAM
Post new topic   Reply to topic
View previous topic :: View next topic  
Author Message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Wed Oct 28, 2009 2:55 pm
Reply with quote

Hi to all.
I'm looking for information about the smf record 65 that is written, in example, when I delete a file that was cataloged as resident on a tape.
The IBM MVS System Management Facility guide reports the structure of SMF record type 65 just only to the section SMF65CRC (Catalog Record) excluded.

Unfortunately I did not find anything about the section starting at SMF65CRC (and SMF66CRC too).

I attach a smf65 sample: the smf65crc section, is clear, starts at offset x'CC'.
Basically I'm searching the dataset creation date and size, and the device type.

Thank you very much anybody can help me.
Back to top
View user's profile Send private message
expat

Global Moderator


Joined: 14 Mar 2007
Posts: 8797
Location: Welsh Wales

PostPosted: Wed Oct 28, 2009 3:21 pm
Reply with quote

My first comment is do not post attachments as I for one can not open them, so have no idea of what you have posted there.

Second, SMF type 61 is catalog record creation, so why you look at 65 and 66 I don't know.

The SMF records will not contain the size of the dataset, that will be in the VTOC or DCOLLECT records created via an IDCAMS job.

IGGCSIRX (SYS1.SAMPLIB) will get a lot of catalog information for you, but is a real bummer to code unless you are pretty au-fait with REXX coding.

I suggest that you take a look at the analysis and reporting available from ISMF. Also to go talk to your storage management team to see if they already have this information available.
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Wed Oct 28, 2009 5:45 pm
Reply with quote

Data about the catalog record is rare; your best bet is the IBM manual ICF Catalog Diagnosis Reference, SY26-3897-1. Check the IBM web site.
Back to top
View user's profile Send private message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Wed Oct 28, 2009 8:15 pm
Reply with quote

Sorry, now I go ot append the sample.
Why smf65? Simply, I get the information after the dsn has been deleted and it cannot be on VTOC nor reached by DCOLLECT no more.
My target is to know who(uid)-deleted-what-when ...
I'm not lucky I can not look at ICF Catalog Diag Ref icon_sad.gif

note: Please do not look at the dsname I used for my tests.
Reading each byte, I find '080926 8F'hex in the smf65crc section. This is not clear to me since the standard date should be 4-bytes 'ccyyddds'hex so this looks like 2709.268 !!! And I'm unable to find size and device type...

Code:
RECORD SEQUENCE NUMBER - 1
 000000  1E410068 935F0109 299FE2E8 E2F84040   4040C4C5 00000028 000A0001 00000032   *.....^....SYS8    DE............*
 000020  009E0001 40F1C3C1 E3D4C7D4 E340C4C5   D3E3C1D7 F0400068 70420109 299FC9C2   *.... 1CATMGMT DELTAP0 ........IB*
 000040  D4E4E2C5 D940E4C3 C1E3C1D3 D6C74BE5   D7D9C4F0 F0F14040 40404040 40404040   *MUSER UCATALOG.VPRD001          *
 000060  40404040 40404040 40404040 40404040   404040C1 C9C2D4E4 E2C5D94B C1F0F3F1   *                   AIBMUSER.A031*
 000080  4BC4C1E3 C14BE2F2 F0F0F9F2 F6F84BE3   F1F5F5F0 F1F44040 40404040 40404040   *.DATA.S2009268.T155014          *
 0000A0  40404040 40404040 40404040 40404040   40404040 40404040 40404040 40404040   *                                *
 0000C0  40404040 40404040 40404040 00600034   C1000001 2DC9C2D4 E4E2C5D9 4BC1F0F3   *            .-..A....IBMUSER.A03*
 0000E0  F14BC4C1 E3C14BE2 F2F0F0F9 F2F6F84B   E3F1F5F5 F0F1F440 40404040 40404040   *1.DATA.S2009268.T155014         *
 000100  40000014 01FFFFFF FFFFFFFF FF080926   8F00000F 01000016 0400E3F1 F5F9F9F5   * .........................T15995*
 000120  78048081 88000000 00000001                                                  *............                    *
 IDC0005I NUMBER OF RECORDS PROCESSED WAS 1
Back to top
View user's profile Send private message
expat

Global Moderator


Joined: 14 Mar 2007
Posts: 8797
Location: Welsh Wales

PostPosted: Wed Oct 28, 2009 8:29 pm
Reply with quote

br15 wrote:
Basically I'm searching the dataset creation date and size, and the device type.

br15 wrote:
My target is to know who(uid)-deleted-what-when ...

You appear to have changed your goal in mid flight here. Tell us exactly what it is that you really want and we may be able to help you if we know exactly what it is you want.
Back to top
View user's profile Send private message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Wed Oct 28, 2009 8:38 pm
Reply with quote

No, I did not change my target: the smf65 record is write out just when the dsname has been deleted, and this sample shows me the dsname has been deleted at time x'0068 935F' and date x'0109 299F' (bytes offset 2 thru 9); and DELTAP0 is the uid.
But ... when was this dsname allocated? and where? and the size?
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Wed Oct 28, 2009 9:08 pm
Reply with quote

Quote:
the smf65 record is write out just when the dsname has been deleted
Not always true -- it will also be written out if the dataset was uncatalogued from the disk but left there.

Quote:
But ... when was this dsname allocated? and where? and the size?
Do you mean when the data set was created? If not, there could be, literally, thousands of jobs a day allocating the data set -- are you really wanting to know every one of those jobs? And what do you mean by "where" -- it all happens in the LPAR you're working in! Size of the data set? You won't get that from SMF unless you do a lot of hard collecting of data -- you can best get that from DCOLLECT.

Perhaps you should step back from the issue, determine what you are really wanting to do, and contact your site storage management group for assistance before confusing us more.
Back to top
View user's profile Send private message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Wed Oct 28, 2009 10:02 pm
Reply with quote

In summary:
- Yes as already said: "when" it was created.
- "Where" means on dasd or tape, 3390 or 3480, etc.
- The size of the dataset.
IBM SMF Guide indicates SMF65CRC is the start of the Catalog Record section. The Catalog Record should have the same information I can get with LISTC-ENT before deleting the dataset, and could have what I'm looking for.


A part from above of my interest.
- Several thousands of records per day can be filtered by iceman.
- DCOLLECT can not give information on a dataset when it has been deleted (not uncataloged).

Anyway, thanks a lot expat, thanks a lot Robert Sample.
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Wed Oct 28, 2009 10:40 pm
Reply with quote

Quote:
The Catalog Record should have the same information I can get with LISTC-ENT before deleting the dataset, and could have what I'm looking for.
Why? The catalog on a z/OS system just contains basic data such as the data set name and the volume it is on. Details about the data set come from the VTOC which is on the volume pointed to by the catalog. I think you seriously misunderstand the catalog structure if you think you'll get all the data set details from the catalog alone. And tapes are a different kind of animal, as well -- check out the contents of standard labels.

I recommend you go back to the manuals and read up in the DFSMS Using Data Sets manual and the manuals pointed to by this one.
Back to top
View user's profile Send private message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Thu Oct 29, 2009 12:26 am
Reply with quote

We just found the device type DEVTYPE translate table in the "DFSMS Access Method Services for Catalogs" manual.
In my sample at offset x'0120 (in the middle of SMF65CRC section) we can read "78048081"hex
This would mean: 3490 Magnetic Tape.

Do somebody help me about creation date and dataset size, if exist in the SMF65CRC structure...?
Thanks to all

Robert, VTOC does not exist on a TAPE, and a dataset (deleted from 3390) is unreachable using DCOLLECT.
More, IDCAMS "LISTCAT" get information from CATALOG and NVDS/VVDS while the dataset exists, and not after it has been deleted. (Underlined my trouble)
Thanks
Back to top
View user's profile Send private message
dick scherrer

Moderator Emeritus


Joined: 23 Nov 2006
Posts: 19244
Location: Inside the Matrix

PostPosted: Thu Oct 29, 2009 12:43 am
Reply with quote

Hello,

To repeat what Robert mentioned earlier:
Quote:
I recommend you go back to the manuals and read up in the DFSMS Using Data Sets manual and the manuals pointed to by this one.

There are many basic concepts that you have not yet understood. . .

The best source of info about tape datasets is the tape management system. Suggest you talk with the tape storage admins.
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Thu Oct 29, 2009 1:11 am
Reply with quote

I believe I mentioned in an earlier post tape labels separate from VTOC -- because they are different.

Quote:
deleted from 3390
Not likely -- most shops haven't run 3390 disk drives in quite a few years; modern devices such as the DS8000 emulate 3390 but are not 3390 devices. If you'd said "deleted from DASD" that would be one thing, but saying "deleted from 3390" merely indicates how little you know about the topic you are attempting to talk about.

You said
Quote:
The Catalog Record should have the same information I can get with LISTC-ENT before deleting the dataset, and could have what I'm looking for.
and you have been told -- multiple times by multiple people -- that the catalog record does not contain the information you can retrieve with a LISTC command. Whether or not you think it should is your opinion, and you can continue to hold that as long as you want, but don't expect us to believe your opinions just because you tell them to us.

Data set size, for example, is not maintained in the catalog and you cannot expect to get it from a catalog record -- period. Data set size for a disk data set is the number of tracks (cylinders, blocks, or allocation units) times the number of bytes per track (cylinder, block, allocation unit) -- but you must take into consideration each volume of a multi-volume data set to get the accurate size. Hence the need to access the VTOC. If the data set is deleted, unless you have a historical record such as a DCOLLECT you cannot find out how big it was. Tape labels can be used to get the number of blocks in the data set and based on block size and density (recording mode) of the tape a data set size can be calculated. But again, once the tape is scratched and reused unless you kept the numbers you're not going to get them from the catalog.

So what exactly are you attempting to achieve by accessing the SMF records? If you tell you what your goal is, and not how you are going to get there, we may be able to suggest some viable alternatives. If you insist, however, in specifying that you have to get your data from catalog records in the SMF data you will not find much help here since we already know limitations you don't seem to be interested in.
Back to top
View user's profile Send private message
br15

New User


Joined: 13 Jun 2007
Posts: 7
Location: Alaska

PostPosted: Sat Oct 31, 2009 3:30 pm
Reply with quote

First of all. Rigth, DASD is more accurated than 3390.
Real or emulated, we normally allocate datasets on them and we can also specify '3390' if this symbol is still defined to the system (as I seen everywhere) although relating different DASD types.
This is what I did intend saying '3390', but this is out of my question.

Last and most, to me, important item.
Please try and let us know what the system returns when you issue 1) one LISTC about an existing dataset and 2) one other just after it has been DELeted. After that, then 3) print the related record SFM 65 (obviously, if the system is enabled to write it).
I'm sure just a bit you will get the 'Catalog Record' information that was on the system catalog before deletion, as everyone can know reading the IBM SMF manual and like my above coded sample.
When you scratch a TAPE or init & validate a DASD, you probabily unaligne the system catalog and the device (if the dataset is cataloged, of course).
But also this is not my question.

You are right: I do not understand something.
I'm thinking I don't understand why I'm still looking at a single source of information that I need: who-deleted-what.
Why not? Why do I have to involve one storage management or tape management product that can change from provider to provider?
I'm not confused: few ideas but clear, useful and tested.
But, once more, this is not my question.

I expected this Forum give me some suggestion, or some tip, or some idea by experience, or a strong 'it is not possible'.
I'd like to read the "ICF Catalog Diagnosis Reference, SY26-3897" but I can't do it... Anyway, thank you Robert for this appreciated suggestion.

By the way, within my original sample I found what I need more and less: "who" deleted "what".
Thanks once more, Robert, about data set size: you remember me that a file can be spanned over several devices, so I decided to renounce to know the size in any kind of measurement unit.

Be sure, as IBM manual stated the SMF 65 carries information that were on the catalog and/or vvds and/or VTOC at deletion time.
Asking another one Forum, Great Forum, I got following information that makes sense for my question:
Quote:
Look at my sample SMF record 65:
subtype c"DE" means deleted but also uncataloged
"who" is logged at the offset x'2C'
"what", it's clear, starts at the offset x'74' and the previous byte "A" means non-vsam dataset.
"when" has been created is 3-hex-byte(!) at offset x'10C'; really in the format x'ydddF' (hex value '9263F') !! this sounds good!
and this field is followed by the expiration date at the offset x'111': my sample reports 3-byte hex value "00000F"
the unit was 3490 tape as indicated by x"78048081" at offset x'120'

That's all but not sufficient because, now I know, the 'Catalog Record' section of the SMF record type 65, is different in case of CLUSTER, SMS or non-SMS managed, etc..
But this is my next question and, sorry, on another side.

Stop
smile
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Sat Oct 31, 2009 7:03 pm
Reply with quote

From the z/OS Basic Skills center at IBM I found:
Quote:
A catalog describes data set attributes and indicates the volumes on which a data set is located.

When a data set is cataloged, it can be referred to by name without the user needing to specify where the data set is stored. Data sets can be cataloged, uncataloged, or recataloged. All system-managed DASD data sets are cataloged automatically in a catalog. Cataloging of data sets on magnetic tape is not required, but doing so can simplify users' jobs.

In z/OSĀ®, the master catalog and user catalogs store the locations of data sets. Both disk and tape data sets can be cataloged.
To find a data set that you have requested, z/OS must know three pieces of information:

* Data set name
* Volume name
* Unit (the volume device type, such as a 3390 disk or 3590 tape)

You can specify all three values on ISPF panels or in JCL. However, the unit device type and the volume are often not relevant to an end user or application program. A system catalog is used to store and retrieve UNIT and VOLUME location of a data set. In its most basic form, a catalog can provide the unit device type and volume name for any data set that is cataloged. A system catalog provides a simple look-up function. With this facility the user need only provide a data set name.

A z/OS system always has at least one master catalog. If it has a single catalog, this catalog would be the master catalog and the location entries for all data sets would be stored in it. A single catalog, however, would be neither efficient nor flexible, so a typical z/OS system uses a master catalog and numerous user catalogs connected to it as shown in Figure 1.

A user catalog stores the name and location of a data set (dsn/volume/unit). The master catalog usually stores only a data set high-level qualifier (HLQ) with the name of the user catalog, which contains the location of all data sets prefixed by this HLQ. The HLQ is called an alias.
Your original request included:
Quote:
I attach a smf65 sample: the smf65crc section, is clear, starts at offset x'CC'.
Basically I'm searching the dataset creation date and size, and the device type.
and the creation date and size are not kept in the catalog, hence cannot be retrieved from the SMF 65 record recording deletion of the data set.

Research indirectly cataloged data sets -- I deal with them frequently and if not handled properly, it is very easy to have a catalog entry for a data set that does not exist on the disk pack any more. For such a data set, there is no SMF 65 record cut when the data set is deleted since the SYSRES pack is copied and the overlaid data had the data set but the overlay data does not. You will get an SMF 65 when the catalog entry is deleted, which could be hours, days, ... , years after the data set stopped existing on the system.

Quote:
Please try and let us know what the system returns when you issue 1) one LISTC about an existing dataset and 2) one other just after it has been DELeted. After that, then 3) print the related record SFM 65 (obviously, if the system is enabled to write it).
LISTC returns data from the various VTOC entries (if the data set is on multiple volumes); I do not know how you are going to do a LISTC on a data set that has been deleted, and the SMF 65 data will not have anything about the data set create date or size -- just name, volume, unit.
Back to top
View user's profile Send private message
dick scherrer

Moderator Emeritus


Joined: 23 Nov 2006
Posts: 19244
Location: Inside the Matrix

PostPosted: Sun Nov 01, 2009 4:02 am
Reply with quote

Quote:
I'd like to read the "ICF Catalog Diagnosis Reference, SY26-3897" but I can't do it...
Why not? IBM Manuals are free and you obviously have an internet connection. . .

Quote:
Asking another one Forum, Great Forum, I got following information that makes sense for my question:
In other words, they would do the work for you and post the answer in a way that was more to your liking. Might be incomplete, but you liked that presentation better. . . icon_rolleyes.gif
Back to top
View user's profile Send private message
enrico-sorichetti

Superior Member


Joined: 14 Mar 2007
Posts: 10872
Location: italy

PostPosted: Mon Nov 02, 2009 4:55 pm
Reply with quote

search/google for "michel clery dataset audit facility"
it' s almost ready to run and will give plenty of info, if the info You want has been collected...
to save some of Your precious time here is the link to the above said softeare ( freeware )

home.pacbell.net/mcleary/freeware.html

Quote:
Asking another one Forum, Great Forum,

if You feel that the other forum is better, no reason to hang around here
( but maybe they just told You what You wanted to hear )
Back to top
View user's profile Send private message
View previous topic :: :: View next topic  
Post new topic   Reply to topic View Bookmarks
All times are GMT + 6 Hours
Forum Index -> JCL & VSAM

 


Similar Topics
Topic Forum Replies
No new posts How to split large record length file... DFSORT/ICETOOL 7
No new posts SFTP Issue - destination file record ... All Other Mainframe Topics 2
No new posts FINDREP - Only first record from give... DFSORT/ICETOOL 3
No new posts To find whether record count are true... DFSORT/ICETOOL 6
No new posts Validating record count of a file is ... DFSORT/ICETOOL 13
Search our Forums:

Back to Top