Skip to main content

Setting up the SMF Real Time Interface

The z/OS SMF Real Time Interface allows programs to read SMF records from in-memory resources as they are written. It does not require exits or APF authorization, and access is controlled by RACF. Records are stored in a wrap-around buffer. The oldest records are discarded when the buffer is full. If a task reading the in-memory resource hasn't read a record before it is discarded, it will get a notification that it has missed data.

Up to 32 SMF in-memory resources can be defined to receive different combinations of records. Up to 8 different readers can connect to an in-memory resource.

EasySMF can share an in-memory resource if you already have resources defined to receive the required records.

The process to define in-memory resources is summarized here. Refer to the IBM SMF manuals for full details:

Prerequisites​

  • SMF must be running in Logstream mode.
  • Ensure you are not using DEFAULTLSNAME to define a default logstream for SMF records. If you send SMF records to an in-memory resource, they will not be written to the default logstream.

Define In-Memory resources​

In memory resource names have the form: IFASMF.name

RACF configuration​

SAF resources in the FACILITY class are required to protect the in-memory resource. The SAF resource name starts with IFA. followed by the resource name, e.g. IFA.IFASMF.EASYSMF

Users that will read from the in-memory resource need READ access to the resource.

RDEFINE FACILITY IFA.IFASMF.EASYSMF OWNER(SECADMIN) UACC(NONE)

SETROPTS RACLIST(FACILITY) REFRESH

SMF Configuration​

They are defined in the SMFPRMxx PARMLIB member. Syntax is similar to SMF logstream definitions, with an additional parameter for the buffer size.

RECORDING(LOGSTREAM)
INMEM(IFASMF.EASYSMF,RESSIZMAX(256M),TYPE(0,14,15,17,18,30,42,
      61,62,64,65,66,70:79,90,92,119))