Reading and Interpreting S-Series System Log Files

$SYSTEM.ZSERVICE.ZZUSERS and ZZUSERS2
The two TSM service application connection audit files in the
$SYSTEM.ZSERVICE subvolume are ZZUSERS and ZZUSERS2.
ZZUSERS is always the active audit file. When the maximum number of
records for the ZZUSERS file is reached, the ZZUSERS file is copied over to
the ZZUSERS2 file, a new ZZUSERS file is opened, and logging activity is
resumed.
These files are used by customers, service providers, the GCSC, or
Development to determine:
In RVUs prior to G06.02 without SPR T7945AAE:
User name❍
IP address❍
Date and time❍
●
In G06.02 and later or if SPR T7945AAE is installed:
User name❍
IP address❍
Date and time❍
Action name❍
Action object❍
Object ID❍
Object type❍
●
Prior to G06.02 without SPR T7945AAE, you cannot view the ZZUSERS
audit file while it is open. You must first stop the $ZTSM process, create an
edit file, copy ZZUSERS to the edit file, and then view the edit file using the
editor or the FUP copy command, with no [out-filename] specified. The
default [out-filename] displays the output on your screen. You can also
specify a spooler as an output device and print the file or view it by using
PERUSE.
Note: While the temporary file does not have to be an edit file, an edit file
is recommended. FUP can then copy ZZUSERS to the temporary file in a
structured edit format ready for viewing. If the destination file is not an edit
file, ZZUSERS is copied in an unstructured format without line breaks.
Example:
Use SCF to stop the $ZTSM process.1.
Create a temporary edit file and copy ZZUSERS to the file:
>Edit TEMP; EXIT
>FUP COPY $SYSTEM.ZSERVICE.ZZUSERS, TEMP
2.
Use SCF to start the $ZTSM process.3.
View the temporary file (TEMP) using the editor or the FUP copy
command:
>FUP COPY TEMP
4.