When a warning statement is triggered, zCID has two ways to communicate atypical access rate behavior: with a write to operator z/OS message (WTOR), a zCID message in a SYSOUT statement (specified by the user), or both a WTOR and SYSOUT. Use the SYSOUT communication method using the WARNLOG JCL control statement when in Implementation Strategy step 3, so as not to saturate z/OS SYSLOG with WTOR messages.

The message zCID puts out in z/OS SYSLOG, SYSOUT, or both is:

• ECID911W ***            ## trk/s WR or RD at <timestamp> on <date>, <WARN messageID>, <z/OS resource monitored>

Where:

• ECID911W is the message ID that zCID creates for atypical access
• ‘##” is the number of tracks that were accessed
• WR or RD indicates whether the ECIDW911W is for ‘WRITES’ (WR) or ‘READS’ (‘RD’)
• <timestamp> is the end of the interval in which the atypical access occurred
• <date> is the date of the atypical access
• <WARN messageID> is the WARN label you gave in your WARN statements
• <z/OS resource monitored> is the resource that was accessed. If a volume was accessed, it shows VOLSER=<volserid>. If it is an SMS Group, it would show the SMS Group name.