Discussion:
IBM-MAIN Digest - 18 Dec 2017 to 19 Dec 2017 (#2017-353)
(too old to reply)
Robert S. Hansel , RSH
2017-12-21 11:55:52 UTC
Permalink
Peter,

If this is a RACF protected system and depending on what audit settings were in effect, you might see an SMF 80 record for the unmount. The event code is 55. If you have SMF unload records available, look for event UMNTFSYS.

Regards, Bob

Robert S. Hansel
Lead RACF Specialist
RSH Consulting, Inc. *** Celebrating our 25th Year ***
617-969-8211
www.linkedin.com/in/roberthansel
http://twitter.com/RSH_RACF
www.rshconsulting.com

-----Original Message-----
Date: Tue, 19 Dec 2017 18:10:10 -0600
From: Peter Ten Eyck <***@AMERICANNATIONAL.COM>
Subject: How to find what performed an OMVS unmount?

I have an OMVS dataset that was mounted via a batch job on a z/OS 2.2 LPAR:

//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
PROF MSGID WTPMSG
MOUNT FILESYSTEM('CICSTS53.CICS.ESA1.HFS.FF') +
MODE(RDWR) TYPE(ZFS) NOAUTOMOVE +
MOUNTPOINT('/usr/lpp/cicsts53')

This job was run after the CICS region was already up and is used for CICS TS 5.3 web services. The web services were dynamically installed from this successfully mounted dataset and worked fine.

Sometime over night the dataset (file) became un-mounted. How can I determine what un-mounted the file? I do not see anything in the syslog or the CICS log. Can I use SMF to determine this, what record type would be used?

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN
Sankaranarayanan, Vignesh
2017-12-21 12:01:59 UTC
Permalink
SMF record type 92, subtype 5.

https://s3-us-west-1.amazonaws.com/watsonwalker/ww/wp-content/uploads/2016/02/09233352/SMF-Reference-20150926.pdf

– Vignesh
Mainframe Infrastructure

-----Original Message-----
From: IBM Mainframe Discussion List [mailto:IBM-***@LISTSERV.UA.EDU] On Behalf Of Robert S. Hansel (RSH)
Sent: 21 December 2017 17:27
To: IBM-***@LISTSERV.UA.EDU
Subject: Re: IBM-MAIN Digest - 18 Dec 2017 to 19 Dec 2017 (#2017-353)

Peter,

If this is a RACF protected system and depending on what audit settings were in effect, you might see an SMF 80 record for the unmount. The event code is 55. If you have SMF unload records available, look for event UMNTFSYS.

Regards, Bob

Robert S. Hansel
Lead RACF Specialist
RSH Consulting, Inc. *** Celebrating our 25th Year ***
617-969-8211
www.linkedin.com/in/roberthansel
http://twitter.com/RSH_RACF
www.rshconsulting.com

-----Original Message-----
Date: Tue, 19 Dec 2017 18:10:10 -0600
From: Peter Ten Eyck <***@AMERICANNATIONAL.COM>
Subject: How to find what performed an OMVS unmount?

I have an OMVS dataset that was mounted via a batch job on a z/OS 2.2 LPAR:

//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
PROF MSGID WTPMSG
MOUNT FILESYSTEM('CICSTS53.CICS.ESA1.HFS.FF') +
MODE(RDWR) TYPE(ZFS) NOAUTOMOVE +
MOUNTPOINT('/usr/lpp/cicsts53')

This job was run after the CICS region was already up and is used for CICS TS 5.3 web services. The web services were dynamically installed from this successfully mounted dataset and worked fine.

Sometime over night the dataset (file) became un-mounted. How can I determine what un-mounted the file? I do not see anything in the syslog or the CICS log. Can I use SMF to determine this, what record type would be used?

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions, send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN

MARKSANDSPENCER.COM
________________________________
Unless otherwise stated above:
Marks and Spencer plc
Registered Office:
Waterside House
35 North Wharf Road
London
W2 1NW

Registered No. 214436 in England and Wales.

Telephone (020) 7935 4422
Facsimile (020) 7487 2670

www.marksandspencer.com

Please note that electronic mail may be monitored.

This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to ***@listserv.ua.edu with the message: INFO IBM-MAIN
Loading...