SMF Records

[Sasso, Leonard]

A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.

1. What SMF Record Type was cut when the first file was transmitted?

2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?



Thank You,

Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn
CSRA
Think Next. Now.


This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Steve Beaver]

The SMF process is a sequential process and each records has a time and data
stamp. SMF records DO NOT overwrite previous smf records

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On
Behalf Of Sasso, Leonard
Sent: Tuesday, May 16, 2017 4:47 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: SMF Records

A customer transmits, via SFTP, a sequential file, from an external site to
an IBM Mainframe. An hour later, they transmit the same file with the SAME
file name, overwriting the original file.

1. What SMF Record Type was cut when the first file was transmitted?

2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record
Type as the original? If not, what SMF Record Type is cut?



Thank You,

Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn
CSRA Think Next. Now.


This electronic message transmission contains information from CSRA that may
be attorney-client privileged, proprietary or confidential. The information
in this message is intended only for use by the individual(s) to whom it is
addressed. If you believe you have received this message in error, please
contact me immediately and be aware that any use, disclosure, copying or
distribution of the contents of this message is strictly prohibited. NOTE:
Regardless of content, this email shall not operate to bind CSRA to any
order or other contract unless pursuant to explicit written agreement or
government initiative expressly permitting the use of email for such
purpose.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Sasso, Leonard]

What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?

Thank You,

Len Sasso
System Administrator


RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn
CSRA
Think Next. Now.


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Steve Beaver
Sent: Tuesday, May 16, 2017 6:02 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

The SMF process is a sequential process and each records has a time and data stamp. SMF records DO NOT overwrite previous smf records

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Sasso, Leonard
Sent: Tuesday, May 16, 2017 4:47 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: SMF Records

A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.

1. What SMF Record Type was cut when the first file was transmitted?

2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?



Thank You,

Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn CSRA Think Next. Now.


This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE:
Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Andrew Rowley]

Post by Sasso, Leonard
What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?

Normally when the same SMF events occur the same SMF record types will
be cut.

However, there can be some differences in exactly which records are cut
if the second transfer is not exactly the same.

For example, if the first transfer creates the dataset and the second
just replaces the content, you should see SMF records related to
creating catalog entries etc. on the first transfer but not on the second.

[Edward Gould]

Post by Sasso, Leonard
What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?

Normally when the same SMF events occur the same SMF record types will be cut.
However, there can be some differences in exactly which records are cut if the second transfer is not exactly the same.
For example, if the first transfer creates the dataset and the second just replaces the content, you should see SMF records related to creating catalog entries etc. on the first transfer but not on the second.

Maybe I am not understanding your question. Lets try and clear it up.
Dataset creation yes
Dataset write yes
Dataset read yes
The above is for 99.9 of all datasets. There are some exclusions the exclusion are system type datasets DSCB etc…But for all intents reasonable any batch/stc/tso are created SMF records are written.
If we take your example, TCP creates a file - Yes SMF record(s) are written.
If TCP reads the files - yes smh record is written.
IF TCP overwrites a file SMF record is written.
If TCP deletes a file SMF record(s) are written.

The only unknown here is if its a unix file, I am sure that they are written but what types are is to me unknown but S/B easily findable
The other *IF* is which type of records are cut. Types 14/15 are read write for non unix files there are records for unix files but I haven’t tried to go after them.
As one responder says try DAF on the CBTTape it is a good program and its free. You only have to have a basic knowledge of MVS to read the report(s).

Ed

--
Andrew Rowley
Black Hill Software
[phone]
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Lizette Koehler]

My basic understanding is this:

An SMF record is created for each event.

So, if you create a file/delete it - that would be a create and delete SMF Record.

If you do it hours apart, again new SMF records for create and delete are created.

SMF does not monitor to see if it is the same file or not. It just creates records.

Now you may have a tool in your shop that does filtering. Then I am not sure what that would do.


Basically SMF always writes a record, it does not check if that file name was done that way or not.


Lizette



-----Original Message-----

Sent: May 16, 2017 3:11 PM
Subject: Re: SMF Records
What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?
Thank You,
Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
CSRA
Think Next. Now.
-----Original Message-----
Sent: Tuesday, May 16, 2017 6:02 PM
Subject: Re: SMF Records
The SMF process is a sequential process and each records has a time and data stamp. SMF records DO NOT overwrite previous smf records
-----Original Message-----
Sent: Tuesday, May 16, 2017 4:47 PM
Subject: SMF Records
A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.
1. What SMF Record Type was cut when the first file was transmitted?
2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?
Thank You,
Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Jesse 1 Robinson]

Keep in mind that SMF records are cut by applications or components that choose to do so. It's not automatic. SMF is a record manager, not a creator. In particular, SFTP is an add-on product that is not related to FTP(S) or TCP/IP. It may or may not create SMF records. If it does, it's almost certainly the same records type for every transmission.

.
.
J.O.Skip Robinson
Southern California Edison Company
Electric Dragon Team Paddler
SHARE MVS Program Co-Manager
323-715-0595 Mobile
626-543-6132 Office ⇐=== NEW
***@sce.com


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Sasso, Leonard
Sent: Tuesday, May 16, 2017 3:12 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: (External):Re: SMF Records

What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?

Thank You,

Len Sasso
System Administrator


RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn CSRA Think Next. Now.


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Steve Beaver
Sent: Tuesday, May 16, 2017 6:02 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

The SMF process is a sequential process and each records has a time and data stamp. SMF records DO NOT overwrite previous smf records

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Sasso, Leonard
Sent: Tuesday, May 16, 2017 4:47 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: SMF Records

A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.

1. What SMF Record Type was cut when the first file was transmitted?

2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?



Thank You,

Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn CSRA Think Next. Now.


----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Vernooij, Kees - KLM , ITOPT1]

Post by Steve Beaver
-----Original Message-----
Behalf Of Jesse 1 Robinson
Sent: 17 May, 2017 0:18
Subject: Re: SMF Records
Keep in mind that SMF records are cut by applications or components that
choose to do so. It's not automatic. SMF is a record manager, not a
creator. In particular, SFTP is an add-on product that is not related to
FTP(S) or TCP/IP. It may or may not create SMF records. If it does, it's
almost certainly the same records type for every transmission.
.
.

And in addition to that: look at the SMF manual: SMF 15 is written whenever a dataset is CLOSED after being opened for OUTPUT, period.
Every time a dataset is Closed for output, SMF15 is written, whether it was the same dataset or not, the same user or not etc, just the CLOSE cuts the record. This allows you to monitor via SMF who opened a dataset during some perion, e.g. to determine the one that might have corrupted it.

Kees.
********************************************************
For information, services and offers, please visit our web site: http://www.klm.com. This e-mail and any attachment may contain confidential and privileged material intended for the addressee only. If you are not the addressee, you are notified that no part of the e-mail or any attachment may be disclosed, copied or distributed, and that any other action related to this e-mail or attachment is strictly prohibited, and may be unlawful. If you have received this e-mail by error, please notify the sender immediately by return e-mail, and delete this message.

Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its employees shall not be liable for the incorrect or incomplete transmission of this e-mail or any attachments, nor responsible for any delay in receipt.
Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch Airlines) is registered in Amstelveen, The Netherlands, with registered number 33014286
********************************************************


----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Vernooij, Kees - KLM , ITOPT1]

Post by Steve Beaver
-----Original Message-----
From: Vernooij, Kees (ITOPT1) - KLM
Sent: 17 May, 2017 8:41
Subject: RE: SMF Records

Post by Steve Beaver
-----Original Message-----

On

Post by Steve Beaver
Behalf Of Jesse 1 Robinson
Sent: 17 May, 2017 0:18
Subject: Re: SMF Records
Keep in mind that SMF records are cut by applications or components

that

Post by Steve Beaver
choose to do so. It's not automatic. SMF is a record manager, not a
creator. In particular, SFTP is an add-on product that is not related

to

Post by Steve Beaver
FTP(S) or TCP/IP. It may or may not create SMF records. If it does,

it's

Post by Steve Beaver
almost certainly the same records type for every transmission.
.
.

And in addition to that: look at the SMF manual: SMF 15 is written
whenever a dataset is CLOSED after being opened for OUTPUT, period.
Every time a dataset is Closed for output, SMF15 is written, whether it
was the same dataset or not, the same user or not etc, just the CLOSE
cuts the record. This allows you to monitor via SMF who opened a dataset
during some perion, e.g. to determine the one that might have corrupted
it.
Kees.

Additional to that: in SMFPRMxx you can specify which records SMF will write and which it will not write when the application cuts them and gives them to SMF tob e written.

Kees.
********************************************************
For information, services and offers, please visit our web site: http://www.klm.com. This e-mail and any attachment may contain confidential and privileged material intended for the addressee only. If you are not the addressee, you are notified that no part of the e-mail or any attachment may be disclosed, copied or distributed, and that any other action related to this e-mail or attachment is strictly prohibited, and may be unlawful. If you have received this e-mail by error, please notify the sender immediately by return e-mail, and delete this message.

Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its employees shall not be liable for the incorrect or incomplete transmission of this e-mail or any attachments, nor responsible for any delay in receipt.
Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch Airlines) is registered in Amstelveen, The Netherlands, with registered number 33014286
********************************************************


----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Charles Mills]

By file do you mean dataset or UNIX file? For a dataset:

1. Potentially an SMF Type 15. Type 15 would have to be enabled in SMFPRMxx.
Potentially an SMF Type 80 (assuming RACF) if the dataset is audited.

2. Yes. Details would be different but it would still be an SMF Type 15.
Potentially an SMF Type 80.

For a UNIX file:

1. Potentially an SMF 92. Type 92 would have to be enabled in SMFPRMxx. I
don't recall if RACF can audit USS file access.

2. Yes. Details would be different but it would still be an SMF Type 92.

The above answers are for the access to the file or dataset. I am assuming
you are referring to the receiving end. If the sending end is MVS, then same
answers except SMF 15 becomes SMF 14.

Other SMF records might also be cut: Job or TSO session start and end. Some
SFTP implementations cut their own SMF records. Perhaps others.

I know of no distinction in any SMF records for "the first time you do
something" versus "re-doing it a little later." SMF records tend to stand on
their own. SMF record cutting is essentially stateless.

Charles


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On
Behalf Of Sasso, Leonard
Sent: Tuesday, May 16, 2017 2:47 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: SMF Records

A customer transmits, via SFTP, a sequential file, from an external site to
an IBM Mainframe. An hour later, they transmit the same file with the SAME
file name, overwriting the original file.

1. What SMF Record Type was cut when the first file was transmitted?

2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record
Type as the original? If not, what SMF Record Type is cut?

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Lizette Koehler]

To add to that. The records are cut each time. There is no filtering to see if that event has already been done. Everytime the FTP(S) or TCP/IP does something that can create an SMF record type, it is created.

Can you provide more detail as to the reason the question is being asked? Are you missing SMF Data? Or not getting SMF Data?


Lizette


-----Original Message-----

Sent: May 16, 2017 3:18 PM
Subject: Re: SMF Records
Keep in mind that SMF records are cut by applications or components that choose to do so. It's not automatic. SMF is a record manager, not a creator. In particular, SFTP is an add-on product that is not related to FTP(S) or TCP/IP. It may or may not create SMF records. If it does, it's almost certainly the same records type for every transmission.
.
.
J.O.Skip Robinson
Southern California Edison Company
Electric Dragon Team Paddler
SHARE MVS Program Co-Manager
323-715-0595 Mobile
626-543-6132 Office ⇐=== NEW
-----Original Message-----
Sent: Tuesday, May 16, 2017 3:12 PM
Subject: (External):Re: SMF Records
What I am asking is if the SAME file is transmitted with the SAME file name again, is the SAME SMF Record Type cut or is a different SMF Record Type cut?
Thank You,
Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
-----Original Message-----
Sent: Tuesday, May 16, 2017 6:02 PM
Subject: Re: SMF Records
The SMF process is a sequential process and each records has a time and data stamp. SMF records DO NOT overwrite previous smf records
-----Original Message-----
Sent: Tuesday, May 16, 2017 4:47 PM
Subject: SMF Records
A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.
1. What SMF Record Type was cut when the first file was transmitted?
2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?
Thank You,
Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Edward Finnell]

I think DAF off CBT will answer all the questions.


In a message dated 5/16/2017 5:16:17 P.M. Central Daylight Time,
***@MINDSPRING.COM writes:

Basically SMF always writes a record, it does not check if that file name
was done that way or not.


----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Nims,Alva John , Al]

You might want to consider that the OpenSSH SMF records are part of the Type 119 record and use subtype 94, 95, 96, 97, and 98
Subtype 96 is the "Server" transfer complete record and 97 is the "Client" equivalent. These records would give you who, what and where someone accessed a file, including the SFTP command executed against the file.

I gathered the above information from: "z/OS IBM Ported Tools for z/OS: OpenSSH User's Guide Version 1 Release 3" (SA23-2246-03), the details for the subtypes 94 through 98 are in this manual and not in the "z/OS Communications Server: IP Programmer's Guide and Reference" which will have the other SMF 119 record subtype descriptions.

Al Nims
Systems Admin/Programmer 3
UFIT
University of Florida
[phone]

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Edward Finnell
Sent: Tuesday, May 16, 2017 6:30 PM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

I think DAF off CBT will answer all the questions.


In a message dated 5/16/2017 5:16:17 P.M. Central Daylight Time, ***@MINDSPRING.COM writes:

Basically SMF always writes a record, it does not check if that file name was done that way or not.


----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Mike Myers]

Leonard:

I don't have access to the system any more where I did this, but based
on the retained documents of the time, I gathered SMF type 119 records
from TCP/IP. Subtype 7 records contain all data relating to FTP file
transfers. They give the file name, origin IP address, time stamp (date
is relative and not in the record), receptor IP address, and file size.
Filtering on these, I was able to find info on all files FTPed into or
out of the z/OS box. You should be able to use this by sorting by file
name to discover your over-writes. If I recall, it didn't matter whether
the file was a USS or MVS file.

As I recall, I did have to turn on SMF record creation in TCP/IP, which
were not being generated by default.

Mike Myers
Vice President
z/OS consultant
Mentor Services Corporation

Post by Sasso, Leonard
A customer transmits, via SFTP, a sequential file, from an external site to an IBM Mainframe. An hour later, they transmit the same file with the SAME file name, overwriting the original file.
1. What SMF Record Type was cut when the first file was transmitted?
2. Is another SMF Record cut for the overwrite and is it the SAME SMF Record Type as the original? If not, what SMF Record Type is cut?
Thank You,
Len Sasso
System Administrator
RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
CSRA
Think Next. Now.
This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Charles Mills]

1. I think you are thinking of other subtypes, one each for SFTP client (3)
and server (70). Subtype 7 is the Server port statistics record:
The Port Statistics record, as an interval record, periodically records
statistics on
ports that have been configured with the PORT statement in the TCP/IP
PROFILE.
All ports that were defined by the PORTRANGE statement, ports for which the
RESERVED flag has been set, or ports that were defined by the PORT UNRSV
statement are excluded.

2. But the OP is using SFTP, so "FTP" SMF records are irrelevant.

Yes, you need to turn on SMF 119 in IP config if you want them.

Charles


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On
Behalf Of Mike Myers
Sent: Wednesday, May 17, 2017 3:18 AM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

Leonard:

I don't have access to the system any more where I did this, but based on
the retained documents of the time, I gathered SMF type 119 records from
TCP/IP. Subtype 7 records contain all data relating to FTP file transfers.
They give the file name, origin IP address, time stamp (date is relative and
not in the record), receptor IP address, and file size.
Filtering on these, I was able to find info on all files FTPed into or out
of the z/OS box. You should be able to use this by sorting by file name to
discover your over-writes. If I recall, it didn't matter whether the file
was a USS or MVS file.

As I recall, I did have to turn on SMF record creation in TCP/IP, which were
not being generated by default.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Kirk Wolf]

FYI, Co:Z SFTP supports both Unix files and z/OS data sets and cuts SMF 119
subtypes 3 and 70, the same as IBM FTP.

https://dovetail.com/docs/sftp/smf-support.html


Kirk Wolf
Dovetailed Technologies
http://dovetail.com

Post by Charles Mills
1. I think you are thinking of other subtypes, one each for SFTP client (3)
The Port Statistics record, as an interval record, periodically records
statistics on
ports that have been configured with the PORT statement in the TCP/IP
PROFILE.
All ports that were defined by the PORTRANGE statement, ports for which the
RESERVED flag has been set, or ports that were defined by the PORT UNRSV
statement are excluded.
2. But the OP is using SFTP, so "FTP" SMF records are irrelevant.
Yes, you need to turn on SMF 119 in IP config if you want them.
Charles
-----Original Message-----
Behalf Of Mike Myers
Sent: Wednesday, May 17, 2017 3:18 AM
Subject: Re: SMF Records
I don't have access to the system any more where I did this, but based on
the retained documents of the time, I gathered SMF type 119 records from
TCP/IP. Subtype 7 records contain all data relating to FTP file transfers.
They give the file name, origin IP address, time stamp (date is relative and
not in the record), receptor IP address, and file size.
Filtering on these, I was able to find info on all files FTPed into or out
of the z/OS box. You should be able to use this by sorting by file name to
discover your over-writes. If I recall, it didn't matter whether the file
was a USS or MVS file.
As I recall, I did have to turn on SMF record creation in TCP/IP, which were
not being generated by default.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Sasso, Leonard]

Sorry, I was not specific, I meant an MVS Dataset.

Many thanks to everyone, your responses have been very helpful.


Thank You,

Len Sasso
System Administrator


RDC - 327 Columbia TPKE, Rensselaer NY 12144-4400
t: +1.518.257.4209 | m: +1.518.894.0879
***@csra.com | www.csra.com Follow us on Facebook | Twitter | LinkedIn
CSRA
Think Next. Now.

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Kirk Wolf
Sent: Wednesday, May 17, 2017 9:33 AM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

FYI, Co:Z SFTP supports both Unix files and z/OS data sets and cuts SMF 119 subtypes 3 and 70, the same as IBM FTP.

https://dovetail.com/docs/sftp/smf-support.html


Kirk Wolf
Dovetailed Technologies
http://dovetail.com

Post by Charles Mills
1. I think you are thinking of other subtypes, one each for SFTP
The Port Statistics record, as an interval record, periodically
records statistics on ports that have been configured with the PORT
statement in the TCP/IP PROFILE.
All ports that were defined by the PORTRANGE statement, ports for
which the RESERVED flag has been set, or ports that were defined by
the PORT UNRSV statement are excluded.
2. But the OP is using SFTP, so "FTP" SMF records are irrelevant.
Yes, you need to turn on SMF 119 in IP config if you want them.
Charles
-----Original Message-----
On Behalf Of Mike Myers
Sent: Wednesday, May 17, 2017 3:18 AM
Subject: Re: SMF Records
I don't have access to the system any more where I did this, but based
on the retained documents of the time, I gathered SMF type 119 records
from TCP/IP. Subtype 7 records contain all data relating to FTP file transfers.
They give the file name, origin IP address, time stamp (date is
relative and not in the record), receptor IP address, and file size.
Filtering on these, I was able to find info on all files FTPed into or
out of the z/OS box. You should be able to use this by sorting by file
name to discover your over-writes. If I recall, it didn't matter
whether the file was a USS or MVS file.
As I recall, I did have to turn on SMF record creation in TCP/IP,
which were not being generated by default.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

This electronic message transmission contains information from CSRA that may be attorney-client privileged, proprietary or confidential. The information in this message is intended only for use by the individual(s) to whom it is addressed. If you believe you have received this message in error, please contact me immediately and be aware that any use, disclosure, copying or distribution of the contents of this message is strictly prohibited. NOTE: Regardless of content, this email shall not operate to bind CSRA to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of email for such purpose.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

[Charles Mills]

@Kirk, my apologies. There are a couple of SFTP's out there and they are not all alike in their SMF approach. You guys did it right! (Don't re-invent the wheel.) My thanks.

Charles


-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Kirk Wolf
Sent: Wednesday, May 17, 2017 6:33 AM
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: SMF Records

FYI, Co:Z SFTP supports both Unix files and z/OS data sets and cuts SMF 119 subtypes 3 and 70, the same as IBM FTP.

https://dovetail.com/docs/sftp/smf-support.html


Kirk Wolf
Dovetailed Technologies
http://dovetail.com

Post by Charles Mills
1. I think you are thinking of other subtypes, one each for SFTP
The Port Statistics record, as an interval record, periodically
records statistics on ports that have been configured with the PORT
statement in the TCP/IP PROFILE.
All ports that were defined by the PORTRANGE statement, ports for
which the RESERVED flag has been set, or ports that were defined by
the PORT UNRSV statement are excluded.
2. But the OP is using SFTP, so "FTP" SMF records are irrelevant.
Yes, you need to turn on SMF 119 in IP config if you want them.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN