Reading Type80 SMF Records file



All about SAF, RACF, encryption, Firewall, Risk assessment and integrity concepts

Re: Reading Type80 SMF Records file

Postby cortex » Mon Dec 26, 2011 9:32 pm

Honestly I don't know the point of this, because I suppose there are many other things that can do the job on the mainframe...but they say they can't do it (or at least, for all the Record types they want - but if there is anything that put any kind of records in an human-readable format, please let me know!!!).

So I asked for a type80 example to start pratice on this, as I really don't have the needed expertise on IBM stuff, as you could notice on all of my posts over here.

But now I understand everything...If any of you can, gently, answer my 2 last questions on previous posts about reading that example, I swear I will never back again with these stupid questions!

Regards,
cortex
 
Posts: 11
Joined: Mon Dec 26, 2011 5:53 pm
Has thanked: 0 time
Been thanked: 0 time

Re: Reading Type80 SMF Records file

Postby BillyBoyo » Mon Dec 26, 2011 9:35 pm

Looks like when you dump an SMF file you get the 02 as a "header" for that, even if selecting one record type.

Robert's print is not showing the RDW, so take four bytes off all field positions. You read left-to-right. If you note the 0111359F. Robert, today, created a file of the 80s from yesterday. So the 02 has today's date, 0111360F, and the 80s yesterday's date.
BillyBoyo
Global moderator
 
Posts: 3804
Joined: Tue Jan 25, 2011 12:02 am
Has thanked: 22 times
Been thanked: 265 times

Re: Reading Type80 SMF Records file

Postby enrico-sorichetti » Mon Dec 26, 2011 9:40 pm

I swear I will never back again with these stupid questions!

Your questions are not stupid... You are just the innocent victim of some incompetent idiot :D

anyway... are You allowed to work on the mainframe?
the simplest and most effective approach would be to produce the reports on the mainframe
using the appropriate mainframe tools, and after that download the reports to the <PC>

google for DFSORT ICETOOL RACF to find out how to produce reports with little effort
see also here for additional hints
http://publib.boulder.ibm.com/infocente ... a8b014.htm
cheers
enrico
When I tell somebody to RTFM or STFW I usually have the page open in another tab/window of my browser,
so that I am sure that the information requested can be reached with a very small effort
enrico-sorichetti
Global moderator
 
Posts: 2994
Joined: Fri Apr 18, 2008 11:25 pm
Has thanked: 0 time
Been thanked: 164 times

Re: Reading Type80 SMF Records file

Postby cortex » Mon Dec 26, 2011 9:45 pm

Oh, ok. Now it makes sense. I wasn't aware of the lack of the RDW on that example too. Thank you very much.

So, even if this is a silly and stupid task for me, I have to talk with the mainframe admin regarding two problems: The missing RDW and to give me a file with only one record type. From then on, I can ignore that first header and process all the records. Just another simple question: Does that header have a fixed size?



@ enrico-sorichetti

Thanks for the advice! I can't work on the mainframe but maybe the admin will find that tool very effective. But is that tool capable of generate reports regarding all the records type or just 80's?
cortex
 
Posts: 11
Joined: Mon Dec 26, 2011 5:53 pm
Has thanked: 0 time
Been thanked: 0 time

Re: Reading Type80 SMF Records file

Postby BillyBoyo » Mon Dec 26, 2011 10:01 pm

Not so simple, as the 80s are variable-length.

Usually a site will have a variety of "canned" reports to process the SMF data that they are interested in. It is usually a "techie" thing, and may be done by a variety of different groups (or centrally) depending on the site. There are some packages which do this, or with locally-developed stuff in whatever language/utility they like.

If all the data you require do not have existing reports, then Robert's example shows another way. If they do a "hex dump" of the file to a report, as Robert did, they can download that dataset to you. All the data will be in character format, and will already be showing the data for the lengths of each individual record. You would then need to "parse" the data, but that should not be too onerous.

The header record will be useful to you, as it will show you the (system) date of the extraction. You could validate the dates on individual records against the reporting period. The extraction date would always have to be at least one day ahead of the reporting period, else you'll have to get fancy with the times so as not to loose any data.
BillyBoyo
Global moderator
 
Posts: 3804
Joined: Tue Jan 25, 2011 12:02 am
Has thanked: 22 times
Been thanked: 265 times

Re: Reading Type80 SMF Records file

Postby cortex » Mon Dec 26, 2011 10:15 pm

BillyBoyo,

I think they've tried to do a SMFDUMP (I guess) but I heard they only can do it with Type 80. Maybe that is the "hex dump" you are talking about, no?

Or that hex dump is another thing that can "textualize" any record from any type, and they aren't aware of the existence of it?
cortex
 
Posts: 11
Joined: Mon Dec 26, 2011 5:53 pm
Has thanked: 0 time
Been thanked: 0 time

Re: Reading Type80 SMF Records file

Postby BillyBoyo » Mon Dec 26, 2011 10:31 pm

Just looked back at Robert's example :-)

It is possible to produce a hex dump with the character representation as well, which would help you out a lot. For character fields, you'd get the correct ASCII values without having to get fancy. For non-character fields, you'd have the EBCDIC representation in hexadecimal pairs for each byte, which you could interpret correctly and produce the output from your program in ASCII, ie the date field (unsigned packed-decimal) and the time field (eight-bit unsigned binary representation of hundredths of second since midnight). You will also have binary fields telling you how many sections of repeating data particular records have, bit-mask values etc. You won't need to interpret everything I assume.

The 102 might be more of a nightmare, but there you go.

I now see another response "crossing in the post", so:

They should be able to "dump" any types of SMF records from the huge SMF dataset as far as I'm aware.

Having got the selected data out, there would be a number of ways to produce a "hex dump" of a particular dataset, including such character-representations that match the byte values (like the MVS1 in your example). You'd also get characters, by chance, in non-display fields, just because they happen to match a character value, so don't get confused by that.

If reports already exist, that would be a better way to go. If they don't exist but can be written, that would be a better way to go. If "none of the above" you could still work from a "print" of the dataset showing character and hex values. The disadvantage would be extra work for you, accurately, interpreting the data which is in mainframe formats. The advantage would be if there is no other way to get all the pre-formatted data for your task.

I think you (via your boss) need to bounce it to someone on the mainframe to establish if reports are available, with everything you need, and if not whether they can be produced. You have a fallback position. The bosses have to decide about the various efforts involved in doing this.
BillyBoyo
Global moderator
 
Posts: 3804
Joined: Tue Jan 25, 2011 12:02 am
Has thanked: 22 times
Been thanked: 265 times

Re: Reading Type80 SMF Records file

Postby enrico-sorichetti » Mon Dec 26, 2011 10:33 pm

why produce an hex dump...
a reformatting to plain text using the installed <SORT>/<ICETOOL> editing facilities looks simpler to me
cheers
enrico
When I tell somebody to RTFM or STFW I usually have the page open in another tab/window of my browser,
so that I am sure that the information requested can be reached with a very small effort
enrico-sorichetti
Global moderator
 
Posts: 2994
Joined: Fri Apr 18, 2008 11:25 pm
Has thanked: 0 time
Been thanked: 164 times

Re: Reading Type80 SMF Records file

Postby cortex » Mon Dec 26, 2011 10:43 pm

Yes, I have to escalate this problem to someone on the mainframe.

So, if I've got it right, there are mechanisms at the mainframe capable of producing reports that "translate" the records from the mainframe format to a more "friendly" format. This format can easily be parsed with some regular expressions or something. And this is valid for every record type. If there is no reports, someone can write them, again, for every record type.

If, for any reason, this is a "no-go", then I have to develop a huge pre-processor to translate and parse all of that binary stuff.

Is that it?
cortex
 
Posts: 11
Joined: Mon Dec 26, 2011 5:53 pm
Has thanked: 0 time
Been thanked: 0 time

Re: Reading Type80 SMF Records file

Postby enrico-sorichetti » Mon Dec 26, 2011 10:58 pm

So, if I've got it right, there are mechanisms at the mainframe capable of producing reports that "translate" the records from the mainframe format to a more "friendly" format. This format can easily be parsed with some regular expressions or something. And this is valid for every record type. If there is no reports, someone can write them, again, for every record type.


no need for regular expression parsing, the data can be formatted according to any specification, usually fixed format, or sometimes as CSVs
top get a grasp of it look in the dfsort section of the forum for example of using dfsort to edit/reformat data

see here for DFSORT mother of all knowledge
http://www-01.ibm.com/support/docview.w ... g3T7000077
and here for the examples
http://www-01.ibm.com/support/docview.w ... g3T7000081
Symbols (DFSMSrmm, DCOLLECT, RACF)
Papers (DFSORT, ICETOOL, RACF)
Examples (DFHSM, DFSMSrmm, DCOLLECT, SMF, Hiperbatch)


once You have understood the basic DSSORT ways of processing some kind of SMF data,
modifying the examples to work with any other SMF record type is quite easy
cheers
enrico
When I tell somebody to RTFM or STFW I usually have the page open in another tab/window of my browser,
so that I am sure that the information requested can be reached with a very small effort
enrico-sorichetti
Global moderator
 
Posts: 2994
Joined: Fri Apr 18, 2008 11:25 pm
Has thanked: 0 time
Been thanked: 164 times

PreviousNext

Return to Mainframe Security