Reading SMF record - type 80



IBM's flagship sort product DFSORT for sorting, merging, copying, data manipulation and reporting. Includes ICETOOL and ICEGENER

Reading SMF record - type 80

Postby dohara » Fri Jun 25, 2010 9:10 pm

Hi all

I'm trying to write a job to read SMF record - type 80 - (RACF processing record)

Structure is described here: http://publibz.boulder.ibm.com/cgi-bin/ ... 0610215513

I can read the various bits and pieces but then i do not know how to read the reloacte sections.
As the above table shows it is 38 and 40. bytes that store the offset and count of the relocate sections.

Here i paste the piece of code i put together

//SORT  EXEC PGM=SORT,REGION=0M
//SYSPRINT DD  SYSOUT=*                             
//SYSOUT   DD  SYSOUT=*                             
//SORTIN   DD  DISP=SHR,DSN=UID.SMF.TESTDATA     
//SORTOUT  DD  SYSOUT=*                             
//SYSIN    DD   *                                   
   SORT FIELDS=COPY                                 
   INCLUDE COND=(6,1,BI,EQ,X'50')
   OUTREC FIELDS=(1,4,7,4,BI,TO=ZD,1X,   *TIME                           
                 11,4,PD,TO=ZD,1X,                  *DATE                           
                 15,4,1X,                                  *SYSTEM ID                       
                 19,2,BI,TO=ZD,1X,                   *DESCRIPTOR FLAG                 
                 21,1,BI,TO=ZD,1X,                   *EVENT CODE                     
                 22,1,BI,TO=ZD,1X,                   *EVENT CODE QUALIFIER           
                  23,8,1X,                                 *UID                             
                  31,8,1X,                                 *USER GROUP                     
                 39,2,BI,TO=ZD,                       *OFFSET TO RELOCATE SECTION     
                 41,2,1X,                                  *COUNT OF RELOCATE SECTIONS
                 43,1,BI,TO=ZD,1X,                   *AUTHORITIES - AUDITOR/SPEC/ETC..
                 71,8)                                      *USER IDENTIFICATION FIELD       
   OPTION VLSCMP                                                       
/*                                                                                 

The input file - UID.SMF.TESTDATA - was generated by issuing /I SMF to have SMF archive its current log into a flat file.
UID.SMF.TESTDATA parms: RECFM=VBS LRECL=32767 BLKSIZE=27998

Can you give me some help as to how i can read the relocate sections?
Actually i try to find ADDSD and DELDSD RACF commands in the SMF log.
If i omit the OUTREC statement and only use:

//SYSIN DD *
SORT FIELDS=COPY
INCLUDE COND=(6,1,BI,EQ,X'50')
OPTION VLSCMP
/*

i can see a lot more but to create a properly formatted output i need to know how to access the given bytes/ranges.

Please let me know if you need further info or my enquiry is ambiguous.

Thanks,
David
dohara
 
Posts: 42
Joined: Thu Apr 09, 2009 3:15 pm
Has thanked: 0 time
Been thanked: 1 time

Re: Reading SMF record - type 80

Postby Frank Yaeger » Fri Jun 25, 2010 10:34 pm

DFSORT/ICETOOL does not have any built-in functions for addressing bytes "indirectly".

Not sure if this will help, but you might want to take a look at Mark Nelson's RACFICE2 package which uses DFSORT/ICETOOL to produce various reports:

http://www.ibm.com/systems/z/os/zos/fea ... cfice.html

Perhaps there's something there you can use.
Frank Yaeger - DFSORT Development Team (IBM) - yaeger@us.ibm.com
Specialties: JOINKEYS, FINDREP, WHEN=GROUP, ICETOOL, Symbols, Migration
=> DFSORT/MVS is on the Web at http://www.ibm.com/storage/dfsort
User avatar
Frank Yaeger
Global moderator
 
Posts: 1079
Joined: Sat Jun 09, 2007 8:44 pm
Has thanked: 0 time
Been thanked: 15 times

Re: Reading SMF record - type 80

Postby dohara » Mon Jun 28, 2010 11:26 pm

Hi Frank

Thanks for your reply and your suggestion.
I reformatted the raw SMF records by IRRADU00, which gave a readable output, which i managed to process with DFSORT.


regards,
David
dohara
 
Posts: 42
Joined: Thu Apr 09, 2009 3:15 pm
Has thanked: 0 time
Been thanked: 1 time


Return to DFSORT/ICETOOL/ICEGENER

 


  • Related topics
    Replies
    Views
    Last post