Skip to main content

Real Time Interface Performance

EasySMF:Events needs to receive enough service from the system to keep up with the SMF records written to the SMF in memory resource.

The SMF in memory resource has a buffer for SMF records, so EasySMF can tolerate some delays. How much delay depends on the size of the in memory resource buffer (the RESSIZMAX parameter in SMFPRMxx) and the rate and size of SMF records. As a starting point, we suggest grouping the EasySMF:Events started task with your medium priority system STCs, and evaluating performance.

If EasySMF can't keep up with the rate of SMF data, it will issue messages indicating that it missed data.

Monitoring EasySMF:Events Performance​

The Black Hill Software EasySMF for z/OS app in Splunk has a dashboard to monitor the Real Time Interface agent performance. Select EasySMF Status->RTI Agent Performance from the menu.

Reports include:

CPU Percent​

The overall CPU and zIIP CPU usage.

GC CPU Percent​

The amount of time spent in Java garbage collection. This should be a very small number. If this becomes significant, it suggests that Java needs more storage. Increase the value for -Xmx (maximum Java heap space). Increase the MEMLIMIT if required. IBM recommends the MEMLIMIT is set to at least 1024MB more than the maximum heap size.

SMF RTI Queue Size​

The amount of SMF data read before having to wait for more data. This is one indication of how much of the in-memory resource buffer space is being used. If the maximum queue size approaches the buffer size it means that there is a danger of missing data. Normally the queue size should be much smaller than the buffer size.

HEC Post Size​

The amount of data sent in each post to the HEC. The maximum post size is set in the configuration. If the post size is consistently high it could mean that the HEC connection is having trouble keeping up with the rate data is being produced, or that the SMF data produced is unusually "bursty". Check the Splunk HEC performance, the TCP/IP performance and try turning compression on or off in the configuration.