When you wish to dump an SMF log stream to archive the data to a permanent medium such as tape, or so that existing user written analysis routines can run against the dump data sets, you can dump SMF log stream data by issuing the SWITCH SMF command, which first dumps the SMF data in the buffers out to the log streams, and then passes control to the IEFU29L SMF log stream dump exit. The operator can use the SMF log stream dump program, IFASMFDL, to dump the specified log stream data to dump data sets. For more information on the IEFU29L exit, see z/OS MVS Installation Exits.
Unlike the SMF data set dump program, there is no CLEAR option on the log stream dump program to delete data. When you use log streams to record SMF data, you can use the ARCHIVE and DELETE options to delete data from the log stream. System logger also allows you to manage log data retention using options on the log stream definition in the LOGR couple data set (specified using the administrative data utility, IXCMIAPU). See Managing log streams and SMF log stream data.
The SMF log stream dump program dumps the contents of one or more log streams to sequential data sets on either tape or direct access devices. The SMF log stream dump program allows the installation to route different records to separate files and produce a summary activity report. This report is described in Creating the summary activity report. The job control language (JCL) to execute the SMF log stream dump program is described in Running the SMF log stream dump program.
During the dump process, the SMF log stream dump program creates two SMF records and writes them to every output data set: a dump header (record type 2) at the beginning of the data set and a dump trailer (record type 3) at the end of the data set.
- If the SMF log stream dump program is unable to read a log stream, it writes an error message indicating which log stream it could not read.
- If the SMF log stream dump program is unable to open an output data set, it writes an error message indicating which data set it could not open.
- If the SMF buffers become full or the log stream
is full or not available, SMF will be in a data lost condition and
will be unable to record data. All data created after this condition
is encountered will be lost. When this condition occurs, SMF tracks
the number of lost records in record type 7 and the operator receives
a message stating that data is being lost.
You can use the SET SMF or SETSMF command to have new records issued to an available log stream.
When you use SMF logging, you can write individual record types to multiple log streams if you wish to, producing duplicate records. If you are dumping several log streams that contain the same record types, the dump may contain duplicate records. In addition, if you dump a log stream that contains data from multiple systems, you should coordinate the timezone of the recording system(s) and the dumping system.
The SMF log stream dump program writes a message to the SYSPRINT data set for all input log streams and output data sets and includes the names of the data sets in the message.
When reading SMF records from
a log stream that has been compressed with zEDC, IBM® recommends that you run the IFASMFDL utility
on a system running with z/OS® V2R1
or higher that has access to a zEDC Express® feature.
If the IFASMFDL utility is run with the default NOSOFTINFLATE option
and the system does not currently have access to a zEDC Express feature, IFASMFDL halts processing
log streams containing zEDC compressed SMF records and generates a
return code of 4. When SOFTINFLATE is specified, the IFASMFDL utility
uses software decompression to read the records when hardware is unavailable.
Note that the SOFTINFLATE option may cause the IFASMFDL utility to
use additional time and CPU resources.