Page 1 of 1

Reading Type80 SMF Records file

PostPosted: Mon Dec 26, 2011 6:03 pm
by cortex
Hello,

First of all, sorry to bothering you in this forum, as I am *really* not an IBM guy, but I need your help, since I found this forum.

The question is simple:

I need to compute a file full of type80 records. I know the file is binary and I was able to find his structure (http://publib.boulder.ibm.com/infocente ... e80fmt.htm)

So I wrote a simple C program just to look at the file content. Looking at the record structure I noticed that at the 6th byte, its contents *must* be 0x50 (because it's type80). But the weird thing is that I can't notice any 0x50 on the file, when I print the bytes to the stdout. So I guess I'm looking in the bad way to that file.

So, how can I correctly see the file contents? Is there any mismatch between little-endian or big-endian (as I'm working under a little-endian architecture, and I guess the file was written under big-endian)?


Sorry again to bothering you guys, and I hope you understand the problem.

Kind Regards

Re: Reading Type80 SMF Records file

PostPosted: Mon Dec 26, 2011 6:44 pm
by prino
Did you transfer the file from z/OS to your box running C as binary?

Re: Reading Type80 SMF Records file

PostPosted: Mon Dec 26, 2011 6:47 pm
by BillyBoyo
Edit: This is RACF data. If you are going through that, you surely have support people who will be in a much better place to answer than we can be.

Re: Reading Type80 SMF Records file

PostPosted: Mon Dec 26, 2011 7:02 pm
by cortex
@ BillyBoyo

Yes, I thought about that before posting this. Sorry. In a couple of minutes I'll open the thread overthere and this one can be closed.


@ prino

The Mainframe admin said that this file is the original binary one, so I suppose yes. (I will open another thread and this one will be closed, as I said. If you don't mind, can you reply on that? Thanks)

Re: Reading Type80 SMF Records file

PostPosted: Mon Dec 26, 2011 7:05 pm
by cortex
@ prino

mainframe-security/topic6860.html

Thanks in advance.

This one can be closed. Sorry for my error.