IBM Mainframe Forum

Hello,

My apologies for incorrect usage of terminology and a badly worded post.

I am trying to figure out who initiated an allocate/de-allocate dataset request, in CICS file owning region.
It can be a request initiated from other MRO regions as well, which triggered the aforementioned activity in 'FOR'; I need to find out who (in case of manual trigger)/what (in case of transaction) triggered the event.

Resources available:
a. SMF dataset
b. Time interval of allocation/de-allocation

Already attempted:
a. OMEGAMON reporting option: 'REPORT FILE DETAIL'

I am unsure where to look for this information; any guidance to SMF type-110 sub-type or OMEGAMON reporting option that can give me this info or a manual that can guide me, would be really helpful.

Thank you.

The FOR message log doesn't give you enough information?

The SMF data should be able to tell you what you want to know, but unless your site is using MXG or another SMF analysis tool, pulling out the appropriate data can be dauntingly difficult. The formats are laid out in the various manuals, but sometimes you have to know if a given bit is 0 or 1 to know whether or not another field has a valid value or not; there are a lot of bit flags and data that is not human readable.

Hello Robert,

Thank you, really appreciate the pointers.

From the MSGUSR/JES*/CEE* logs, the only information that I was able to cull out were:
a. Time at which dataset were de-allocated
b. List of datasets
c. The initiator module (which in this case appears to be one of the application programs)

What I am assuming from the above is, a transaction could have been manually initiated from one of the AORs, which in turn impacted the FOR.
I had a look at the list of all transactions that were initiated during the time-interval across all AORs (a fairly large number per second); there is a dubious looking guy, but it misses the second mark by 4 seconds; it is difficult to conclude basis this; I need to figure something out from the FOR trace so as to pinpoint the exact trigger.

I checked for MXG, strongly doubt that we have it; though will double verify with the admin ('don't have it' is still the stronger opinion).

Can't we work something out with OMEGAMON.
SMF, if you can kindly point me to 'something', maybe I can do a hit/trial to see if I can make some sense of the data.
Any guidance would be really-really helpful.

Thank you once again.

there is a dubious looking guy, but it misses the second mark by 4 seconds

It still might be worth looking at that one closer -- time stamps from LPAR to LPAR aren't always as synchronized as we'd like.

I am by no means an expert on OMEGAMON so I'm not sure if what you want is available in the product nor how to retrieve it assuming it is available. If you have access to SAS, that can vastly simplify getting to SMF records and reading their data. From looking at the data, it looks like SMF 110 record type and subtype 0002 is probably what you need (STID 67).

Based on what you've said so far, what I'd probably do for a first look would be to extract the 110 records for the FOR around the time in question, then dump those records (IDCAMS PRINT) and scan for the data set name. That would give me a starting place to tackle extracting the transaction and user id of whoever de-allocated the data set.

Robert Sample wrote:.....
it looks like SMF 110 record type and subtype 0002 is probably what you need (STID 67)
.....
what I'd probably do for a first look would be to extract the 110 records for the FOR around the time in question, then dump those records (IDCAMS PRINT) and scan for the data set name. That would give me a starting place to tackle extracting the transaction and user id of whoever de-allocated the data set.

Thanks a ton Robert, that indeed gives me something to start with; let me work it out, will share the final results asa I make something out of it.

Regards.

Hello,

I seem to be doing something wrong here, but unable to figure out what:

a. Extracted the Type- 110, Sub-type-002 records:



b. Executed DFH$MOLS on the extracted dataset:



Though, at this point, DFH$MOLS is returning:



I am unable to figure out why same is not giving me any extract; even though OMEGAMON extraction job executed on the same dataset is giving me valid records; 'IDCAMS PRINT' also returned valid PRINT records (dataset name was found in the PRINT dump).
It must be something trivial which is causing this.

On further thought, is there another way to pull out Unit of Work information for the FOR; maybe if I can get the TRAN info from this, then I can correlate it to the already extracted AOR data.

Thanks.

DFH$MOLS processes the monitoring records, which are subtype 1. Try extracting both the subtype 1 and 2 records then running DFH$MOLS against them.

Hello Robert,

Whups I totally miread the print there; my apologies.

Thanks a ton; will get on it.