RACF command logging time difference

Document ID : KB000013052
Last Modified Date : 14/02/2018
Show Technical Document Details
Question:

I record all RACF commands in the ADMACCOUNT table in Compliance Manager.

We have noticed an almost 8/10 of a second difference between the time  Compliance Manager records the RACF command and the time of the command in SMF.

Interestingly the  Compliance Manager date/time stamp is earlier than the SMF date/stamp by almost 8/10 of a second.

 

Answer:

The SMFWTM (SMF) fills in the time value SMFxTME. However this is the time since midnight.

The value in the Compliance Event Manager/Compliance Manager event records are STCK format.

ECA_R001_TOD_UTC DS XL8 UTC timestamp
ECA_R001_TOD_SYS DS XL8 Local timestamp

http://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.ieag200/smfhdr.htm

So they appear to be slightly different given the different format.