Using the audit report

Use the audit report to track changes to the control data set, identify inadvertent changes, and recover lost volumes. DFSMSrmm creates an audit SMF record whenever information about a volume, a rack number, or bin number changes in the control data set when you specify option SMFAUD(nnn). With EDGAUD, you can create reports that list the changes that have been made in the control data set.

The basic audit report consists of these individual reports: the VOLUME report, the RACK/BIN report, and the USERID report.
  • VOLUME report

    DFSMSrmm adds a report line in the volume report when volume information changes. The volume report is sorted by volume serial number.

  • RACK/BIN report

    DFSMSrmm updates information in this report when volume information and rack or bin number information change. The rack/bin report is sorted by rack or bin number.

  • USERID report

    DFSMSrmm updates information in this report when volume information and rack or bin number information change. The USERID report is sorted by user ID.

Changes to volume information can affect more than the volume report. For example, the EDGAUD utility makes these audit report entries when a volume is added to the library:
  • A volume line in the VOLUME report
  • A volume line in the RACK/BIN report
  • A volume line in the USERID report
  • A report line for deletion of an empty rack number in the RACK/BIN report
  • A report line for creation of an in-use rack number in the RACK/BIN report

When a volume is in the process of being moved, DFSMSrmm marks the location field in the audit report with the '<' character, as shown in Excerpts from an audit trail report. This marks the location as the one from which the volume is moving.

The audit report columns include:
VOLUME
Volume serial number.
RACK
Rack number.
BIN
Bin number.
USERID
User ID that initiated the change. A user ID that starts with an asterisk (*) indicates that a DFSMSrmm function initiated the change.
DATE
Date the control data set changed.
TIME
Time the control data set changed.
SYSTEM
The SMF system identifier.
STATUS
One of:
ABEND
A data set on the volume was closed by abend processing.
CLOSED
For a stacked volume, DFSMSrmm lists the stacked volume in the report because the stacked volume was closed by command processing or export processing.
EMPTY
Rack or bin number has no volume assigned. For a stacked volume, the stacked volume contains no volumes.
IN USE
Rack or bin number contains non-scratch volume.
MASTER
Volume is master status.
OPEN
Data set on the volume is open. For a stacked volume, the stacked volume contains at least one volume.
RELEASE
Volume is pending release.
SCRATCH
Volume is scratch or shelf location contains scratch volume.
USER
Volume is a user volume.
VITAL
Volume is retained by a vital record specification. For a stacked volume, the stacked volume contains volumes that are retained by vital record specifications.
LOCATION
Location where the volume is stored. When a volume is in the process of being moved, DFSMSrmm marks the location field in the audit report with the '<' character.
LOAN LOC
Location outside the library where the volume is on loan.
OWNER
Volume owner.
EXP DATE
Volume expiration date.
SECURITY
Highest security classification in effect when the volume was accessed.
ACTIVITY
Can be: CREATE, DELETE, or UPDATE.

Excerpts from an audit trail report shows excerpts from an audit trail report. The first column heading identifies the type of report information that is contained in the report.