IBM System Management Facilities

Last updated July 05, 2024

IBM System Management Facility (SMF) is a component of IBM's z/OS for mainframe computers, providing a standardised method for writing out records of activity to a file (or data set to use a z/OS term). SMF provides full "instrumentation" of all baseline activities running on that IBM mainframe operating system, including I/O, network activity, software usage, error conditions, processor utilization, etc.

One of the most prominent components of z/OS that uses SMF is the IBM Resource Measurement Facility (RMF). RMF provides performance and usage instrumentation of resources such as processor, memory, disk, cache, workload, virtual storage, XCF and Coupling Facility. RMF is technically a priced (extra cost) feature of z/OS. BMC sells a competing alternative, CMF.

SMF forms the basis for many monitoring and automation utilities. Each SMF record has a numbered type (e.g. "SMF 120" or "SMF 89"), and installations have great control over how much or how little SMF data to collect. Records written by software other than IBM products generally have a record type of 128 or higher. Some record types have subtypes - for example Type 70 Subtype 1 records are written by RMF to record CPU activity.

SMF record types

Here is a list of the most common SMF record types:

RMF records are in the range 70 through to 79. RMF's records are generally supplemented - for serious performance analysis - by Type 30 (subtypes 2 and 3) address space records.
RACF type 80 records are written to record security issues, i.e. password violations, denied resource access attempts, etc. TopSecret, another security system, also writes type 80 records. ACF2 provides equivalent information in, by default, type 230 records but this SMF record type can be changed for each installed site.
SMF type 89 records indicate software product usage and are used to calculate reduced sub-capacity software pricing.
IBM Db2 writes type 100, 101 and 102 records, depending on specific Db2 subsystem options.
CICS writes type 110 records, depending on specific CICS options.
Websphere MQ writes type 115 and 116 records, depending on specific Websphere MQ subsystem options.
WebSphere Application Server for z/OS writes type 120. Version 7 introduced a new subtype to overcome shortcomings in the earlier subtype records. The new Version 7 120 Subtype 9 record provide a unified request-based view with lower overhead.

Evolving records

The major record types, especially those created by RMF, continue to evolve at a rapid pace. Each release of z/OS brings new fields. Different processor families and Coupling Facility levels also change the data model.

SMF data recording

SMF can record data in two ways:

The standard and classical way: Using buffers the SMF address space, together with a set of preallocated datasets (VSAM datasets) to use when a buffer fills up. The standard name for the datasets is SYS1.MANx, where x is a numerical suffix (starting from 0).
The relatively new way: Using log streams. SMF utilizes System Logger to record collected data, which improves the writing rate and avoids buffer shortages. It has more flexibility, allowing the z/OS system to straightforwardly record to multiple log streams, and (using keywords on the dump program) allowing z/OS to read a set of SMF data once and write it many times.

Both the two ways can be declared for the use, but only one is used at a time in order to have the other as a fallback alternative.

This data is then periodically dumped to sequential files (for example, tape drives) using the IFASMFDP SMF Dump Utility (or IFASMFDL when using log streams). IFASMFDP can also be used to split existing SMF sequential files and copy them to other files. The two dump programs produce the same output, so it does not involve changes in the SMF records elaboration chain, other than changing the JCL with the call of the new dump utility.

SMF data collection and analysis

SMF data can be collected through IBM Z Operational Log and Data Analytics and IBM Z Anomaly Analytics with Watson. IBM Z Operational Log and Data Analytics collects SMF data, transforms it in a consumable format and then sends the data to third-party enterprise analytics platforms like the Elastic Stack and Splunk, or to the included operational data analysis platform, for further analysis. IBM Z Anomaly Analytics with Watson collects SMF data from multiple IBM Z systems and subsystems, including IBM Db2 for z/OS, IBM CICS Transaction Server for z/OS and IBM MQ for z/OS, uses historical IBM Z metric and log data to build a model of normal operational behavior, and analyzes real-time operational data through comparison with the model of normal operations to detect and alert IT operations of anomalous behavior.

IBM Z Operational Log and Data Analytics collects SMF data in the following three ways, and IBM Z Anomaly Analytics with Watson collects SMF data in the first two of the following ways:

In log stream mode with SMF in-memory buffer

When SMF is run in the log stream mode, the Common Data Provider in IBM Z Operational Log and Data Analytics and IBM Z Anomaly Analytics with Watson can be configured to collect SMF from the SMF in-memory buffer with the SMF real-time interface.

In data set recording mode

When SMF is run in the data set recording mode, the Common Data Provider in IBM Z Operational Log and Data Analytics and IBM Z Anomaly Analytics with Watson collect and stream SMF data via a set of SMF user exits.

In batch mode

The System Data Engine of the Common Data Provider in IBM Z Operational Log and Data Analytics can be run stand-alone in batch mode to read SMF data from a data set and then write it to a file. The System Data Engine batch jobs can be created to write SMF data to data sets and send SMF data to the Data Streamer.

SMF data can be analyzed on the following analytics platforms:

Z Data Analytics platform, a component of IBM Z Operational Log and Data Analytics, which can help to visualize and search through a large number of Z operational data on a single pane of glass. The dashboards and saved searches provide insights into the operational data and help with early problem detection and problem diagnosis.
Enterprise platforms such as Splunk, the Elastic Stack, Apache Kafka, or Humio that can receive and process operational data for analysis. The platforms like the Elastic Stack and Splunk do not include expert knowledge about z Systems and applications, but users can create or import their own analytics to run against the data.
IBM Z Anomaly Analytics with Watson, a product that uses both log-based and metric-based machine learning technology to provide anomaly detection.
IBM Db2 Analytics Accelerator for z/OS, a database application that provides query-based reporting.
IntelliMagic Vision for z/OS, from IntelliMagic.^[1] The platform can provide insights and recommended actions to the system owners, which are based on expert knowledge about z Systems and applications.

External links

IBM z/OS SMF Reference
Performance Instrumentation Management Techniques wiki (requires "My developerWorks: Sign in" 20090224)
CA ACF2 for z/OS - 15.0 & 16.0 Documentation
CA Top Secret® for z/OS - 16.0 Documentation ^{[ permanent dead link ]}

Related Research Articles

Multiple Virtual Storage, more commonly called MVS, is the most commonly used operating system on the System/370, System/390 and IBM Z IBM mainframe computers. IBM developed MVS, along with OS/VS1 and SVS, as a successor to OS/360. It is unrelated to IBM's other mainframe operating system lines, e.g., VSE, VM, TPF.

z/OS is a 64-bit operating system for IBM z/Architecture mainframes, introduced by IBM in October 2000. It derives from and is the successor to OS/390, which in turn was preceded by a string of MVS versions. Like OS/390, z/OS combines a number of formerly separate, related products, some of which are still optional. z/OS has the attributes of modern operating systems but also retains much of the older functionality that originated in the 1960s and is still in regular use—z/OS is designed for backward compatibility.

Db2 is a family of data management products, including database servers, developed by IBM. It initially supported the relational model, but was extended to support object–relational features and non-relational structures like JSON and XML. The brand name was originally styled as DB2 until 2017, when it changed to its present form.

The IBM Information Management System (IMS) is a joint hierarchical database and information management system that supports transaction processing.

IBM CICS is a family of mixed-language application servers that provide online transaction management and connectivity for applications on IBM mainframe systems under z/OS and z/VSE.

Adabas, a contraction of “adaptable database system," is a database package that was developed by Software AG to run on IBM mainframes. It was launched in 1971 as a non-relational database. As of 2019, Adabas is marketed for use on a wider range of platforms, including Linux, Unix, and Windows.

In software engineering, a pipeline consists of a chain of processing elements, arranged so that the output of each element is the input of the next. The concept is analogous to a physical pipeline. Usually some amount of buffering is provided between consecutive elements. The information that flows in these pipelines is often a stream of records, bytes, or bits, and the elements of a pipeline may be called filters. This is also called the pipe(s) and filters design pattern which is monolithic. Its advantages are simplicity and low cost while its disadvantages are lack of elasticity, fault tolerance and scalability. Connecting elements into a pipeline is analogous to function composition.

In computing, a Parallel Sysplex is a cluster of IBM mainframes acting together as a single system image with z/OS. Used for disaster recovery, Parallel Sysplex combines data sharing and parallel computing to allow a cluster of up to 32 systems to share a workload for high performance and high availability.

IBM Storage Protect is a data protection platform that gives enterprises a single point of control and administration for backup and recovery. It is the flagship product in the IBM Spectrum Protect family.

In computing, Advanced Program to Program Communication or APPC is a protocol which computer programs can use to communicate over a network. APPC is at the application layer in the OSI model, it enables communications between programs on different computers, from portables and workstations to midrange and host computers. APPC is defined as VTAM LU 6.2

In IBM System z9 and successor mainframes, the System z Integrated Information Processor (zIIP) is a special purpose processor. It was initially introduced to relieve the general mainframe central processors (CPs) of specific Db2 processing loads, but currently is used to offload other z/OS workloads as described below. The idea originated with previous special purpose processors, the zAAP, which offloads Java processing, and the IFL, which runs Linux and z/VM but not other IBM operating systems such as z/OS, DOS/VSE and TPF. A System z PU is "characterized" as one of these processor types, or as a CP, or SAP. These processors do not contain microcode or hardware features that accelerate their designated workloads. Instead, by relieving the general CP of particular workloads, they often lead to a higher workload throughput at reduced license fees.

To quiesce is to pause or alter a device or application to achieve a consistent state, usually in preparation for a backup or other maintenance.

Teleprocessing Network Simulator (TPNS) is an IBM licensed program, first released in 1976 as a test automation tool to simulate the end-user activity of network terminal(s) to a mainframe computer system, for functional testing, regression testing, system testing, capacity management, benchmarking and stress testing.

The World Programming System, also known as WPS Analytics or WPS, is a software product developed by a company called World Programming.

Resource Measurement Facility (RMF) is a performance monitor for the z/OS Operating System. It also collects data for long-term performance analysis and capacity planning. The product consists of the following components:

GenevaERS is an enterprise reporting system that currently executes in the IBM mainframe z/OS environment. It is similar to MapReduce or Apache Spark but predates their development by a decade. It has been used as a data warehousing ETL, reporting, and application development platform. It was designed to support business systems using William McCarthy's theory of Resources, Events, Agents.

IBM WebSphere Application Server for z/OS is one of the platform implementations of IBM's WebSphere Application Server family. The latest version is Version 9.0.

IBM WebSphere Optimized Local Adapters (OLA or WOLA) is a functional component of IBM's WebSphere Application Server for z/OS that provides an efficient cross-memory mechanism for calls both inbound to WAS z/OS and outbound from z/OS. Because it avoids the overhead of other communication mechanisms, it is capable of high volume exchange of messages. WOLA is an extension to the existing cross-memory exchange mechanism of WAS z/OS, with WOLA providing an external interface so z/OS address spaces outside the WAS z/OS server may participate in cross-memory exchanges. WOLA supports connectivity between a WAS z/OS server and one or more of the following: CICS, IMS, Batch, UNIX Systems Services and ALCS. WOLA was first made available in WAS z/OS Version 7, Fixpack 4 (7.0.0.4). Functional enhancements have appeared in subsequent fixpacks as documented in this article.

The SMF 120 Subtype 9 is a new SMF record made available IBM's WebSphere Application Server for z/OS Version 7. Its design is based on customer feedback regarding the data required when operating WAS z/OS. The previous WAS z/OS SMF records were Subtypes 1, 3, 5, 6, 7 and 8. Those subtypes continue to exist, but Subtype 9 may be viewed as a replacement.

PureSystems is an IBM product line of factory pre-configured components and servers also being referred to as an "Expert Integrated System". The centrepiece of PureSystems is the IBM Flex System Manager in tandem with the so-called "Patterns of Expertise" for the automated configuration and management of PureSystems.

References

↑ "Home". intellimagic.com.

IBM Redbooks. ABCs of z/OS System Programming Volume 2, International Technical Support Organization, July 2008.
BMC CMF Monitor - http://www.bmc.com/products/proddocview/0,2832,19052_19429_23401_1365,00.html Archived 2009-03-14 at the Wayback Machine
Examples of SMF Reports - http://www.pacsys.com/smf/smf_example_list.htm
Streaming z/OS IT Operational Data with IBM Z Common Data Provider. Planet Mainframe. August 27, 2020.
IBM Z Operational Log and Data Analytics documentation - https://www.ibm.com/docs/en/z-logdata-analytics/5.1.0?topic=overview-z-common-data-provider
IBM Z Operational Log and Data Analytics Product Page - https://www.ibm.com/products/z-log-and-data-analytics
IBM Z Anomaly Analytics with Watson documentation - https://www.ibm.com/docs/en/z-anomaly-analytics/5.1.0
IBM Z Anomaly Analytics with Watson Product page - https://www.ibm.com/products/z-anomaly-analytics

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.

[1] "Home". intellimagic.com.

[1]