Define z/OS SMF Record Exits - 2.1

Ironstream for Splunk®/Kafka®/Elastic® for IBM Z® Installation

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream for Splunk®
Ironstream > Ironstream for Kafka®
Version
2.1
Language
English
Product name
Ironstream for Splunk®/Kafka®/Elastic® for IBM Z®
Title
Ironstream for Splunk®/Kafka®/Elastic® for IBM Z® Installation
First publish date
2014
Last edition
2024-04-16
Last publish date
2024-04-16T06:23:09.429963

Ironstream uses the standard z/OS SMF record exits IEFU83, IEFU84, IEFU85, or IEFU86 for real-time capture. IEFU83, IEFU84, and IEFU85 are used to capture standard SMF record types, and IEFU86 is used to capture both standard and extended record types. Standard records have a single byte that holds their record type, from 0 to 255. Extended records have an SMF record type of 126 with an extended header that allows for the definition of up to 2048 record types.

If implemented in your system, the IEFU86 exit will be used to enable the capture of all SMF record types. If it is not, the IEFU83, IEFU84, and IEFU85 exits can be used, but only the capture of standard record types will be available.

Ironstream is only able to intercept and capture SMF records if these exits are defined in all SYS and SUBSYS EXIT parameter lists in the SMFPRMnn member of SYS1.PARMLIB or one of its related data sets.

There are different ways to configure your SMFPRMnn member. The following is an example of the relevant part of an SMFPRMnn member.
SYS(TYPE(2:4,7:9,11,
14:18,30,40,41,42,50,57,61:83,89,90,92,99,100:102,
109,110,113,115,116,117,118,119,120(9),128,132,205,207:210,
220,230,240,241),
EXITS(IEFU83,IEFU84,IEFU85,IEFU86,IEFACTRT,IEFUTL,
IEFUSI,IEFUJI,IEFU29),INTERVAL(000500),DETAIL)
SUBSYS(STC,EXITS(IEFU29,IEFU83,IEFU84,IEFU85,IEFU86,IEFUJP,IEFUSO))

Your installation may have fewer or more record types defined. Ironstream cannot collect records that are not included in the TYPE parameter. In addition, Ironstream will not collect records that are defined in the SMFPRMnn member but which are not specified in an Ironstream SELECT statement in the configuration file.

You can use the MVS D SMF,O command to view the currently active exits. If you do not see ones named IEFUnn, Ironstream will not collect the records that you select.

The following commands are also useful:

D PROG,EXIT,EXITNAME=SYS.IEFUnn,DIAG
D PROG,EXIT,ALL

Once you have saved the changes to your SMF member, you can use the z/OS console command SET SMF=xx to dynamically activate them.

For more information, see the IBM z/OS MVS Initialization and Tuning Reference manual, and make sure to see the one that corresponds to your operating system release.