SMF Type 80 Record
This table shows the record layout for type 80 SMF records
It's easy to report on SMF 80 data! (Jump to sample reports)
Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.
Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.
Record length. This field and the next field (total of four bytes) form the RDW (record descriptor word). See “Standard SMF Record Header” on page 13-1 for a detailed description.
Segment descriptor (see record length field).
System indicator: Bit Meaning When Set 0-2 Reserved 3-6 Version indicators* 7 Reserved.*See “Standard SMF Record Header” on page 13-1 for a detailed description.
Record type 80 (X'50').
Time since midnight, in hundredths of a second, that the record was moved into the SMF buffer.
Date when the record was moved into the SMF buffer, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description.
System identification (from the SID parameter).
Bit Meaning When Set
0 The event is a violation
1 User is not defined to RACF
2 Record contains a version indicator (see SMF80VER)
3 The event is a warning
4 Record contains a version, release, and modification level number (see SMF80VRM)
Event code. For information about RACF event codes, see z/OS Security Server RACF Macros and Interfaces.
Event code qualifier. For information about RACF event codes, see z/OS Security Server RACF Macros and Interfaces.
Identifier of the user associated with this event (jobname is used if the user is not defined to RACF).
Group to which the user was connected (stepname is used if the user is not defined to RACF).
Offset to the first relocate section from beginning of the record header.
Count of the number of relocate sections.
Authorities used for processing commands or accessing resources Bit Meaning When Set 0 Normal authority check (resource access) 1 SPECIAL attribute (command processing) 2 OPERATIONS attribute (resource access, command processing) 3 AUDITOR attribute (command processing) 4 Installation exit processing (resource access) 5 Failsoft processing (resource access) 6 Bypassed-userid = *BYPASS* (resource access) 7 Trusted attribute (resource access).
Reason for logging. These flags indicate the reason RACF produced the SMF record Bit Meaning When Set 0 SETROPTS AUDIT(class) - changes to this class of profile are being audited. 1 User being audited 2 SPECIAL users being audited 3 Access to the resource is being audited due to the AUDIT option (specified when profile created or altered by a RACF command), a logging request from the RACHECK exit routine, or because the operator granted access during failsoft processing. 4 RACINIT failure 5 This command is always audited 6 Violation detected in command and CMDVIOL is in effect 7 Access to entity being audited due to GLOBALAUDIT option.
Terminal level number of foreground user (zero if not available).
Command processing error flag Bit Meaning When Set 0 Command had error and RACF could not back out some changes 1 No profile updates were made because of error in RACF processing 2-7 Reserved.
Terminal ID of foreground user (zero if not available).
Job name. For RACINIT records for batch jobs, this field can be zero. The job name, time, and date that the reader recognized the JOB card (for this job) constitute the job log identification, or transaction name (for APPC output).
Time since midnight, in hundredths of a second, that the reader recognized the JOB statement for this job. For RACINIT records for batch jobs, this field can be zero.
Date the reader recognized the JOB statement for this job, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description. For RACINIT records for batch jobs, this field can be zero.
User identification field from the SMF common exit parameter area. For RACINIT records for batch jobs, this field can be zero.
Version indicator (8 = Version 1, Release 8 or later). As of RACF 1.8.1, SMF80VRM is used instead.
Additional reasons for logging Bit Meaning When Set 0 Security level control for auditing 1 VMEVENT Auditing 2 Class being audited due to SETROPTS LOGOPTIONS 3 Entity audited due to SETROPTS SECLABELAUDIT 4 Reserved. 5-7 Reserved.
RACF version, release, and modification level number in the form VRRM (for example, 1081 represents RACF 1.8.1).
Security label of the user.
Offset to extended-length relocate sections.
Count of extended-length relocate sections.
Authority used continued. Bit Meaning When Set 0 OpenEdition superuser 1 OpenEdition system function 2-7 Reserved.
Data type. For description of the variable data elements of the relocate section, see z/OS Security Server RACF Macros and Interfaces.
Length of data that follows.
For description of the variable data elements of the relocate section, see z/OS Security Server RACF Macros and Interfaces.
Length of data that follows.
The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.
The sample SMF report below was created with Spectrum SMF Writer, the low-cost 4GL SMF report writer.
It reads as input the SMF file and selects just the type 80 (RACF Processing) records. (See SMF 80 record layout.)
We print a report showing each RACF processing event, with a description of what the event was, and the outcome. Note that the actual SMF record just contains codes for the event and its status. Our Spectrum SMF Writer definitions include code to expand those numeric values into descriptive texts.
Spectrum SMF Writer also uses a special exit to parse the variably formatted "relocation" fields at the end of the SMF 80 record. This lets us easily print such hard-to-access details as resource name (DSNAME), authority requested and authority allowed.
These events are grouped by unique JOB and printed in JOB/timestamp order.
All of this with just a few lines of code!
Why not install a Spectrum SMF Writer trial right now and start making your own SMF reports!