The //SHOW-STATISTICS statement is used to output selected records in the form of statistics. These are selected records from the SATUT input files or records that have been selected and edited by means of //START-SELECTION.
The available information is interpreted according to the selected input. SAT regards all data provided as input as belonging to a single session. The values for “begin of analyzed period” and “end of analyzed period” are taken from the first entry in the first file and the last entry in the last file, respectively.
The elapsed time is the difference between these two dates. If these two dates are very far apart, and if there are large gaps in the data provided as input, the results can be unexpected. Any evaluation executed by SAT must therefore be interpreted according to the selected data.
The data provides the following information:
global SAT logging statistics
a summary of the all events in event classes
complete SAT statistics for each event type
optionally, a histogram showing the number of events per minute can be output to SYSLST
SHOW-STATISTICS | ||||||||||||||||||||||||
| ||||||||||||||||||||||||
MACHINE-SPEED = <fixed 0.01..500>
The speed of the CPU in RPF. This parameter is used for calculation of the number of records per RPF and hour in the SAT statistics.
If no value is specified for this oparand, in the output of statistics the following elements are dropped:
the line "Machine speed" in the global SAT data
and
the column "# events/Mips/h" in the summary of events.
FROM-FILE = 0 / <integer 0..9> / *INPUT-FILES
The file from which the statistics are to be generated.
FROM-FILE = 0 / <integer 0..9>
The statistics are to be generated from the work file with the specified number.
FROM-FILE = *INPUT-FILES
The statistics are to be generated from the SATUT input files (//SELECT-INPUT-FILES).
HISTOGRAM =
This specifies whether or not a histogram is to be output. A histogram can be output only if OUTPUT=*SYSLST is specified.
HISTOGRAM = *NO
No histogram is to be generated and output.
HISTOGRAM = *YES
A histogram is to be generated and output.
OUTPUT = *SYSLST(...) / *SYSOUT
This specifies where the requested information is to be output.
OUTPUT = *SYSLST(...)
The requested information is to be output to SYSLST.
LINES-PER-PAGE = 64 / <integer 20..255>
This defines the number of lines per output page.
OUTPUT = *SYSOUT
The requested information is to be output to SYSOUT.
Notes
This statement evaluates all specified files sequentially by time. If the SAT logging has been deactivated in the meantime, or if no events occurred for a period, e.g. because of low system utilization, then this has the following effects. For the first four minutes of an “eventless” period SATUT outputs histogram lines containing null values. In order that the list does not contain an unnecessarily high number of blank lines, from the 5th minute of the “eventless” period onward SATUT suppresses the output of blank
histogram lines until such time as the next event occurs. The period during which the output was interrupted is represented by means of a line with the following contents:*** ----------- No events for n minutes ------------ ***where n is the number of minutes for which the output was suppressed.
Example
Extract from a histogram containing periods when no events occurred
2017/04/02 12:20 741 |FFFFFFFFF|FFFFFFFFF|LLLLLLLLL|LLLLLSXXX|XXXX 2017/04/02 12:21 623 |FFFFFFFFF|FFFFFFFFF|FFFFFFFFF|FFFFFFLSX 2017/04/02 12:22 217 |FFFFFFFFF|FFF 2017/04/02 12:23 0 | 2017/04/02 12:24 0 | 2017/04/02 12:25 0 | 2017/04/02 12:26 0 | *** ----------- No events for 2 minutes ------------ *** 2017/04/02 12:29 7 |BJSX 2017/04/02 12:30 0 | 2017/04/02 12:31 18 |BFJLUX 2017/04/02 12:32 0 | 2017/04/02 12:33 7 |BFJ 2017/04/02 12:34 0 | 2017/04/02 12:35 0 | 2017/04/02 12:36 0 | 2017/04/02 12:37 0 | *** ----------- No events for 25 minutes ------------ *** 2017/04/02 13:03 4 |SX
In this example there are two periods without any logged events (from 12:23 to
12:28 and from 12:34 to 13:02). The first four minutes of these periods are each represented by histogram lines containing null values, and the remaining time by the output of a line indicating the length of the period in minutes.
The contents of the work files (0 to 9) are not modified with this statement.
If the CONSLOG files do not have the same format as the SAT files, they must be converted before they can be output in statistics. If the files that are to be output in statistics have not yet been edited, message SAE5152 is output and execution of the statement is aborted.
Output of the statistics
The result of the //SHOW-STATISTICS statement is output to SYSLST or SYSOUT. This output consists of a number of tables, which are explained below.
1. Global SAT data
The date and time of day of the evaluation run
The names of the input files or the names of the files specified in //SELECT-RECORDS or //START-SELECTION
The start and end of the evaluated period
The start time and date of the SATUT run are taken from the time stamp of the first record of the oldest SAT file available. The end time and date are taken from the time stamp of the last record of the most recent SAT file.Elapsed time: difference between the start and end time in seconds
Machine speed: computer power in MIPS if the MACHINE-SPEED operand has been specified
Records/hour: average number of records logged in the SAT file(s) per hour
# of records: Total number of audit records of the SAT input file(s) or the total number of records selected by means of //SELECT-RECORDS or //START-SELECTION
Mean length: average length of the audit records, based on all the selected audit records from the SAT input files
Mean kbytes/hour: Average number of bytes written to the SAT input file(s) in one hour. This value is meaningless if only individual records were selected by means of //SELECT-RECORDS or //START-SELECTION.
Example
//show-statistics output=*sysout
Input-files of statement = :PCO4:$SYSAUDIT.SYS.SATLOG.2017-04-01.137.01
:PCO4:$SYSAUDIT.SYS.SATLOG.2017-04-01.137.02
:PCO4:$SYSAUDIT.SYS.SATLOG.2017-04-02.137.03
Begin of analyzed period : 2017/04/01 10:19:21.24
End of analyzed period : 2017/04/02 17:44:34.23
Elapsed time = 113113 s = 1 d 26713 s
Records/hour = 53.56
# of records = 1683
Mean length = 102.00
Mean kbytes/hour = 5.54
2. Summary of the most important events
All events are collected in event classes in this statistic.
In all cases it is the total number of events that have occurred in each event class that are calculated (# events), as well as the average number of these events per hour (# events/h) and, if the MACHINE-SPEED operand has been specified, the average number of these events per MIPS per hour (# events/Mips/h).
Statistics are collected for the following event classes:
DMS
Files (file accesses)
Security (access to protection attributes in the user catalog)
Rename Files (renaming of files)
Catalog Management
(import and export of pubsets)Job Enable (Dialog & Batch)
(LOGON for interactive and batch tasks, both successful and unsuccessful)Job (Rest)
(job events without LOGON for interactive and batch jobs)Job Variables
(JVs: accesses to job variables)BLS
(Binder and Loader System: loading and unloading of (parts of) TU programs)Spool
Jobs (commands)
Devices (administration)
PLAM/LAM
(access to library members)DSSM (Dynamic SubSystem Management)
Connection/Disconnection:connection to/disconnection from privileged subsystems of TU jobs)
Catalog Management (DSSM catalog management)
Syntax Files
(access to syntax files)Users/Groups/Privileges
Users (user ID administration)
Privileges (privileges management)
Groups (user group administration)
Object Protection
GUARDS (Events relating to the corresponding objects)
Coowner Protection (Events relating to the corresponding objects)
Default Protection (Events relating to the corresponding objects)
Access Control List (ACL: accesses to ACL entries)
System Access Control Management
Terminal Sets (administration of terminal sets)
Operator Roles (administration of operator roles)
Keys (object KEY)
SAT
(SAT events)
UTM
(UTM events)
SESAM
(SESAM events)
POSIX
Files and Directories
Child Processes
Processes
System Resources
(Events relating to the corresponding objects)
Communication Methods
DCAM
BCAM
IP Security
(Events relating to the corresponding objects)
Memory Pools
(opening, closing, releasing, accessing)
Events
Serialization
Eventing
(activation and deactivation of eventing and serialization)
Fast Intertask Communication
(object FITC)
Storage Class Events
(object SMS)
Data Spaces
Volume
(processing and management of tapes using MAREN; volume processing with NDM; volume processing with FDDRL, VOLIN or IOCFCOPY)
ADAM Device Management
ANY event (system exit)
Example
SUMMARY OF EVENTS
-----------------
Event class # events # events/h # events/Mips/h
----------- -------- ---------- ---------------
1 : DMS
Files 711 22.63 4.53
Security 733 23.33 4.67
Rename Files 5 0.16 0.03
2 : Catalog Management 0 0.00 0.00
3 : Job Enable (Dialog & Batch)
Success 33 1.05 0.21
Failure 6 0.19 0.04
4 : Job (Rest) 33 1.05 0.21
5 : Job Variables 0 0.00 0.00
6 : BLS 15 0.48 0.10
7 : Spool
Jobs 0 0.00 0.00
Devices 0 0.00 0.00
8 : PLAM/ILAM 20 0.64 0.13
9 : DSSM
Connection/Disconnection 2 0.06 0.01
Catalog Management 17 0.54 0.11
10 : Syntax Files 0 0.00 0.00
11 : Users/Groups/Privileges
Users 87 2.77 0.55
Privileges 0 0.00 0.00
Groups 0 0.00 0.00
12 : Object Protection
GUARDS 0 0.00 0.00
Coowner Protection 0 0.00 0.00
Default Protection 0 0.00 0.00
Access Control List 0 0.00 0.00
13 : System Access Control Management
Terminal Sets 0 0.00 0.00
Operator Roles 0 0.00 0.00
Keys 13 0.41 0.08
14 : SAT 2 0.06 0.01
15 : UTM 0 0.00 0.00
16 : SESAM 0 0.00 0.00
17 : POSIX
Files and Directories 0 0.00 0.00
Child Processes 0 0.00 0.00
Processes 0 0.00 0.00
System Resources 0 0.00 0.00
18 : Communication Methods
DCAM 0 0.00 0.00
BCAM 0 0.00 0.00
IP Security 0 0.00 0.00
19 : Memory Pools 0 0.00 0.00
20 : Events
Serialization 0 0.00 0.00
Eventing 0 0.00 0.00
21 : Fast Intertask Communication 0 0.00 0.00
22 : Storage Class Events 0 0.00 0.00
23 : Data Spaces 0 0.00 0.00
24 : Volume 0 0.00 0.00
25 : ADAM device management 0 0.00 0.00
26 : ANY event (system exit) 0 0.00 0.00 3. Complete SAT statistics for each event type
The statistical data for each individual event is listed in alphabetical order after the corresponding abbreviation (see section “Table of object-related events”).
The following information is supplied for each event:
EVENT | Abbreviation denoting the event |
| Number of audit records with the result SUCCESS logged for this event |
| Number of audit records with the result FAILURE logged for this event |
| This number should be 0; if it is not, you should check whether these audit records might not have come from an exit routine of the computer center (event type ANY); if this is not the case, you should contact the maintenance personnel.) |
LEN SUCC | Average length of the audit records for this event type which have the result SUCCESS |
LEN FAIL | Average length of the audit records for this event type which have the result FAILURE |
LEN NONE | Average length of the audit records for this event type without a result |
% EVENTS | Relationship (expressed as a percentage) between the totals of |
% FAIL (EVENT) | Relationship (expressed as a percentage) between the total number of audit records of this event type with the result FAILURE and the total number of audit records with the results SUCCESS, FAILURE and NONE |
RECORDS/HOUR | Average number of audit records for this event type which are logged in an hour |
These statistics cover only those event types which actually exist in the input files for SHOW-STATISTICS.
The values # NONE, LEN SUCC, LEN FAIL and LEN NONE are suppressed for output to SYSOUT.
Example
# EVENT # SUCC # FAIL # NONE LEN SUCC LEN FAIL LEN NONE % EVENTS % FAIL(EVENT) RECORDS/HOUR --- ----- ------ ------ ------ -------- -------- -------- -------- ------------- ------------ 1 FCD 59 0 0 108.61 0.00 0.00 3.51 0.00 1.88 2 FCL 298 0 0 97.52 0.00 0.00 17.71 0.00 9.48 3 FCS 58 0 0 106.02 0.00 0.00 3.45 0.00 1.85 4 FDD 64 2 0 100.62 99.00 0.00 3.92 3.03 2.10 5 FDS 64 20 0 103.94 100.50 0.00 4.99 23.81 2.67 6 FED 33 0 0 101.09 0.00 0.00 1.96 0.00 1.05 7 FMD 92 0 0 95.16 0.00 0.00 5.47 0.00 2.93 8 FMS 11 0 0 121.91 0.00 0.00 0.65 0.00 0.35 9 FRD 162 1 0 100.68 97.00 0.00 9.69 0.61 5.19 10 FRN 5 0 0 148.60 0.00 0.00 0.30 0.00 0.16 11 FRS 391 189 0 106.45 110.13 0.00 34.46 32.59 18.46 12 JBE 16 2 0 81.06 71.50 0.00 1.07 11.11 0.57 13 JDE 17 4 0 79.29 83.75 0.00 1.25 19.05 0.67 14 JED 16 0 0 58.94 0.00 0.00 0.95 0.00 0.51 15 JIN 17 0 0 69.00 0.00 0.00 1.01 0.00 0.54 16 KTC 13 0 0 125.00 0.00 0.00 0.77 0.00 0.41 17 LCL 10 0 0 128.50 0.00 0.00 0.59 0.00 0.32 18 LEE 10 0 0 124.50 0.00 0.00 0.59 0.00 0.32 19 SCR 14 3 0 79.71 78.33 0.00 1.01 17.65 0.54 20 SDS 2 0 0 85.00 0.00 0.00 0.12 0.00 0.06 21 UAD 2 0 0 81.00 0.00 0.00 0.12 0.00 0.06 22 UCK 71 10 0 82.70 82.90 0.00 4.81 12.35 2.58 23 UML 2 0 0 81.00 0.00 0.00 0.12 0.00 0.06 24 URM 1 1 0 81.00 81.00 0.00 0.12 50.00 0.06 25 XLD 10 0 0 199.00 0.00 0.00 0.59 0.00 0.32 26 XUL 5 0 0 80.00 0.00 0.00 0.30 0.00 0.16 27 ZBG 3 0 0 245.33 0.00 0.00 0.18 0.00 0.10 28 ZCH 2 0 0 130.00 0.00 0.00 0.12 0.00 0.06 29 ZND 3 0 0 83.33 0.00 0.00 0.18 0.00 0.10 --- ----- ------ ------ ------ -------- -------- -------- -------- ------------- ------------ TOTAL: 1451 232 0 101.26 106.65 0.00 100.00 13.78 53.6
4. Optional: histogram representing the number of events per minute
A histogram depicting the number and type of events is generated for each minute within the auditing period.
The axis on which the number of events is represented is subdivided into percentage fractions. Each segment represents 10%, and each letter represents 1% of the maximum possible number of events per minute. Each minute in which this value was reached is marked in the histogram by an asterisk (*).
Each line in the histogram contains the following information (from left to right):
date
time of day
number of events in this minute
’*’ if the maximum possible number of events per minute was logged
line in the histogram showing the distribution of the events for each event type.
Example (SYSLST)
/show-statistics from-file=*input-files, -
/ histogram=*yes, output=*syslst
Note
If there are gaps in the sequence of the SAT files specified or in the period of time which is covered by the input files, these gaps are treated like periods during which no events occurred. In the first four minutes of such a gap the histogram contains lines in which the number of events per minute is equal to zero; from the fifth minute onward a line is output indicating the length of time during which no events occurred.
SATUT V05.5A 2017-04-06 16:17:07 PAGE 4
PROCESSED STATEMENT : SHOW-STATISTICS
***********************************************************************************************************************************
# +---------+---------+---------+---------+---------+---------+---------+---------+---------+---------+
2017/04/01 10:19 1 |ZZ
2017/04/01 10:20 37 |FFFFFFFFF|FFFFFFFFJ|JJJJJKKSS|SSSSSSSSS|SUUUU
2017/04/01 10:21 35 |FFFFFFFFF|FFFFFFFFF|FFFJJJJJJ|JJJSSSSUU|UU
2017/04/01 10:22 4 |JJKKUUU
2017/04/01 10:23 1 |UU
2017/04/01 10:24 4 |JJKKUUU
2017/04/01 10:25 2 |JJUU
2017/04/01 10:26 3 |JJUUU
2017/04/01 10:27 2 |JJUU
2017/04/01 10:28 0 |
2017/04/01 10:29 0 |
2017/04/01 10:30 0 |
2017/04/01 10:31 3 |FFFUU
2017/04/01 10:32 1 |UU
...
2017/04/02 16:48 30 |FFFFFFFFF|FFFFFFFFF|FFFFFFFFF|FFFXX
2017/04/02 17:27 2 |FFF
2017/04/02 17:28 22 |FFFFFFFFF|FFFFFFFFF|LLLLXXX
2017/04/02 17:42 5 |FFFFFJJ
2017/04/02 17:43 19 |FFFFFFFFF|FFFFFFJJJ|SSXX
2017/04/02 17:44 2 |FFZZ
# +---------+---------+---------+---------+---------+---------+---------+---------+---------+---------+
SATUT V05.5A 2017-04-06 16:17:07 PAGE 9
PROCESSED STATEMENT : SHOW-STATISTICS
***********************************************************************************************************************************
EXPLANATION ON USED LETTERS:
----------------------------
F : FCD, FCL, FCS, FDD, FDS, FED, FMD, FMS, FRD, FRN, FRS
J : JBE, JDE, JED, JIN
K : KTC
L : LCL, LEE
S : SCR, SDS
U : UAD, UCK, UML, URM
X : XLD, XUL
Z : ZBG, ZCH, ZND