Reading SMF record - type 80
Posted: Fri Jun 25, 2010 9:10 pmHi all
I'm trying to write a job to read SMF record - type 80 - (RACF processing record)
Structure is described here: http://publibz.boulder.ibm.com/cgi-bin/ ... 0610215513
I can read the various bits and pieces but then i do not know how to read the reloacte sections.
As the above table shows it is 38 and 40. bytes that store the offset and count of the relocate sections.
Here i paste the piece of code i put together
The input file - UID.SMF.TESTDATA - was generated by issuing /I SMF to have SMF archive its current log into a flat file.
UID.SMF.TESTDATA parms: RECFM=VBS LRECL=32767 BLKSIZE=27998
Can you give me some help as to how i can read the relocate sections?
Actually i try to find ADDSD and DELDSD RACF commands in the SMF log.
If i omit the OUTREC statement and only use:
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'50')
OPTION VLSCMP
/*
i can see a lot more but to create a properly formatted output i need to know how to access the given bytes/ranges.
Please let me know if you need further info or my enquiry is ambiguous.
Thanks,
David
I'm trying to write a job to read SMF record - type 80 - (RACF processing record)
Structure is described here: http://publibz.boulder.ibm.com/cgi-bin/ ... 0610215513
I can read the various bits and pieces but then i do not know how to read the reloacte sections.
As the above table shows it is 38 and 40. bytes that store the offset and count of the relocate sections.
Here i paste the piece of code i put together
//SORT EXEC PGM=SORT,REGION=0M
//SYSPRINT DD SYSOUT=*
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=UID.SMF.TESTDATA
//SORTOUT DD SYSOUT=*
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'50')
OUTREC FIELDS=(1,4,7,4,BI,TO=ZD,1X, *TIME
11,4,PD,TO=ZD,1X, *DATE
15,4,1X, *SYSTEM ID
19,2,BI,TO=ZD,1X, *DESCRIPTOR FLAG
21,1,BI,TO=ZD,1X, *EVENT CODE
22,1,BI,TO=ZD,1X, *EVENT CODE QUALIFIER
23,8,1X, *UID
31,8,1X, *USER GROUP
39,2,BI,TO=ZD, *OFFSET TO RELOCATE SECTION
41,2,1X, *COUNT OF RELOCATE SECTIONS
43,1,BI,TO=ZD,1X, *AUTHORITIES - AUDITOR/SPEC/ETC..
71,8) *USER IDENTIFICATION FIELD
OPTION VLSCMP
/*
//SYSPRINT DD SYSOUT=*
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=UID.SMF.TESTDATA
//SORTOUT DD SYSOUT=*
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'50')
OUTREC FIELDS=(1,4,7,4,BI,TO=ZD,1X, *TIME
11,4,PD,TO=ZD,1X, *DATE
15,4,1X, *SYSTEM ID
19,2,BI,TO=ZD,1X, *DESCRIPTOR FLAG
21,1,BI,TO=ZD,1X, *EVENT CODE
22,1,BI,TO=ZD,1X, *EVENT CODE QUALIFIER
23,8,1X, *UID
31,8,1X, *USER GROUP
39,2,BI,TO=ZD, *OFFSET TO RELOCATE SECTION
41,2,1X, *COUNT OF RELOCATE SECTIONS
43,1,BI,TO=ZD,1X, *AUTHORITIES - AUDITOR/SPEC/ETC..
71,8) *USER IDENTIFICATION FIELD
OPTION VLSCMP
/*
The input file - UID.SMF.TESTDATA - was generated by issuing /I SMF to have SMF archive its current log into a flat file.
UID.SMF.TESTDATA parms: RECFM=VBS LRECL=32767 BLKSIZE=27998
Can you give me some help as to how i can read the relocate sections?
Actually i try to find ADDSD and DELDSD RACF commands in the SMF log.
If i omit the OUTREC statement and only use:
//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'50')
OPTION VLSCMP
/*
i can see a lot more but to create a properly formatted output i need to know how to access the given bytes/ranges.
Please let me know if you need further info or my enquiry is ambiguous.
Thanks,
David