








	*SMF Tools*

SMF Type 119 Record - Subtype 70

This table shows the record layout for type 119 SMF records
(FTP Server Transfer Completion Record).

List of other SMF record layouts available.
List of sample SMF reports.

Purpose: Transmission Control Protocol/Internet Protocol (TCP/IP) writes type 119 records to collect statistics about Telnet servers and clients, FTP servers and clients, and API activity and stack usage information.

The Subtype 70 FTP server transfer completion record is collected when the z/OS FTP server completes processing of one of the following FTP file transfer operations: file appending, file deletion, file storage (includes both store and store unique operations), file retrieval, or file renaming. A common format for the record is used for each FTP file transfer operation, so the record contains an indication of which operation was performed. The record also contains optional sections provided when gethostbyaddr( ) processing was performed during the file transfer operation, as well as when the file names involved in the transfer operation were MVS™ or z/OS® UNIX® filenames.

The Type 119 FTP server transfer completion record is collected at the same point in file transfer processing as the equivalent Type 118 FTP server SMF records. The Type 118 records used different record subtypes, as opposed to a field within the SMF record information, to represent the different file transfer operations being recorded.

It's easy to report on SMF 119 data! (Jump to sample reports)

We have a low-cost 4GL report writer especially for SMF files. It's called Spectrum SMF Writer.

Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.

Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.

Plus, Spectrum SMF Writer can export SMF data as comma delimited files to use on your PC.

SMF Type 119 Record -- FTP Server Transfer Completion Record
Offset (Dec.)	Offset (Hex)	Name	Length	Format	Description
0	0	SMF119LEN	2	binary	Record length. This field and the next field (total of four bytes) form the RDW (record descriptor word). See “Standard SMF Record Header” on page 13-1 for a detailed description.
2	2	SMF119SEG	2	binary	Segment descriptor (see record length field).
4	4	SMF119FLG	1	binary	System indicator Bit Meaning When Set 0 New record format 1 Subtypes used 2 Reserved. 3-6 Version indicators* 7 System is running in PR/SM mode.*See “Standard SMF Record Header” on page 13-1 for a detailed description.
5	5	SMF119RTY	1	binary	Record type 119 (X'77').
6	6	SMF119TME	4	binary	Time since midnight, in hundredths of a second, that the record was moved into the SMF buffer.
10	A	SMF119DTE	4	packed	Date when the record was moved into the SMF buffer, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description.
14	E	SMF119SID	4	EBCDIC	System identification (from the SMFPRMxx SID parameter).
18	12	SMF119SSI	4	EBCDIC	Subsystem identification.
22	16	SMF119STY	2	binary	Record subtype.
Self Defining Section
24	18	SMF119TRN	2	binary	Number of triplets in this record. A triplet is a set of three SMF fields (offset/length/number values) that defines a section of the record. The offset is the offset from the RDW.
26	1A	--	2	binary	Reserved.
28	1C	SMF119IDOff	4	binary	Offset to TCP/IP identification section from RDW.
32	20	SMF119IDLen	2	binary	Length of TCP/IP identification section.
34	22	SMF119IDNum	2	binary	Number of TCP/IP identification sections.
36	24	SMF119S1Off	4	Binary	Offset to first data section
40	28	SMF119S1Len	2	Binary	Length of first data section
42	2A	SMF119S1Num	2	Binary	Number of first data sections
44	2C	SMF119S2Off	4	Binary	Offset to 2nd data section
48	30	SMF119S2Len	2	Binary	Length of 2nd data section
50	32	SMF119S2Num	2	Binary	Number of 2nd data sections
52	34	SMF119S3Off	4	Binary	Offset to 3rd data section
56	38	SMF119S3Len	2	Binary	Length of 3rd data section
58	3A	SMF119S3Num	2	Binary	Number of 3rd data sections
60	3C	SMF119S4Off	4	Binary	Offset to 4th data section
64	40	SMF119S4Len	2	Binary	Length of 4th data section
66	42	SMF119S4Num	2	Binary	Number of 4th data sections
68	44	SMF119S5Off	4	Binary	Offset to 5th data section
72	48	SMF119S5Len	2	Binary	Length of 5th data section
74	4A	SMF119S5Num	2	Binary	Number of 5th data sections
TCP/IP Identification Section For the FTP server transfer completion record, the TCP/IP stack identification section indicates FTPS as the subcomponent and X'08' (event record) as the record reason. (Offset from beginning of record: SMF119IDOff)
0	0	SMF119TI_ SYSName	8	EBCDIC	System name from SYSNAME in IEASYSxx
8	8	SMF119TI_ SysplexName	8	EBCDIC	Sysplex name from SYSPLEX in COUPLExx
16	10	SMF119TI_ Stack	8	EBCDIC	TCP/IP stack name
24	18	SMF119TI_ ReleaseID	8	EBCDIC	z/OS Communications Server TCP/IP release identifier
32	20	SMF119TI_ Comp	8	EBCDIC	TCP/IP subcomponent (right padded with blanks): FTPC FTP Client FTPS FTP server IP IP layer STACK Entire TCP/IP stack TCP TCP layer TN3270C TN3270 Client TN3270S TN3270 server UDP UDP layer
40	28	SMF119TI_ ASName	8	EBCDIC	Started task qualifier or address space name of address space that writes this SMF record
48	30	SMF119TI_ UserID	8	EBCDIC	User ID of security context under which this SMF record is written
56	38	--	2	EBCDIC	Reserved
58	3A	SMF119TI_ ASID	2	Binary	ASID of address space that writes this SMF record
60	3C	SMF119TI_ Reason	1	Binary	Reason for writing this SMF record: X'08' Event record X'C0' Interval statistics record, more records follow X'80' Interval statistics record, last record in set X'60' End-of-statistics record, more records follow X'20' End-of-statistics record, last record in set X'50' Shutdown starts record, more records follow X'10' Shutdown starts record, last record in set
61	3D	--	3	EBCDIC	Reserved
Subtype 70 - FTP server transfer completion specific section of this SMF record.(Offset from beginning of record: SMF119S1Off)
0	0	SMF119FT_ FSOper	1	Binary	FTP Operation according to SMF77 subtype classification: x'01': Append x'02': Delete x'03': Rename x'04': Retrieve x'05': Store x'06': Store Unique
1	1	--	3	Binary	Reserved
4	4	SMF119FT_ FSCmd	4	EBCDIC	FTP command (according to RFC 959+)
8	8	SMF119FT_ FSFType	4	EBCDIC	File type (SEQ, JES, or SQL)
12	C	SMF119FT_ FSDRIP	16	Binary	Remote IP address (data connection)
28	1C	SMF119FT_ FSDLIP	16	Binary	Local IP address (data connection)
44	2C	SMF119FT_ FSDRPort	2	Binary	Remote port number (data connection - client)
46	2E	SMF119FT_ FSDLPort	2	Binary	Local port number (data connection - server)
48	30	SMF119FT_ FSCRIP	16	Binary	Remote IP address (control connection)
64	40	SMF119FT_ FSCLIP	16	Binary	Local IP address (control connection)
80	50	SMF119FT_ FSCRPort	2	Binary	Remote port number (control connection - client)
82	52	SMF119FT_ FSCLPort	2	Binary	Local port number (control connection - server)
84	54	SMF119FT_ FSSUser	8	EBCDIC	Client User ID on server
92	5C	SMF119FT_ FSType	1	EBCDIC	Data type: A: ASCII E: EBCDIC I: Image B: Double-byte U: UCS-2
93	5D	SMF119FT_ FSMode	1	EBCDIC	Transmission mode B: Block C: Compressed S: Stream
94	5E	SMF119FT_ FSStruct	1	EBCDIC	Data structure F: File R: Record
95	5F	SMF119FT_ FSDsType	1	EBCDIC	Data set type S: SEQ P: PDS H: HFS
96	60	SMF119FT_ FSSTime	4	Binary	Transmission start time of day
100	64	SMF119FT_ FSSDate	4	Packed	Transmission start date
104	68	SMF119FT_ FSETime	4	Binary	Transmission end time of day
108	6C	SMF119FT_ FSEDate	4	Packed	Transmission end date
112	70	SMF119FT_ FSDur	4	Binary	File transmission duration in units of 1/100 seconds
116	74	SMF119FT_ FSBytes	8	Binary	Transmission byte count; 64-bit integer
124	7C	SMF119FT_ FSLReply	4	EBCDIC	Last reply to client (3-digit RFC 959 code, right justified)
128	80	SMF119FT_ FSM1	8	EBCDIC	PDS Member name
136	88	SMF119FT_ FSRS	8	EBCDIC	Reserved for abnormal end information
144	90	SMF119FT_ FSM2	8	EBCDIC	Second PDS member name (if rename operation)
152	98	SMF119FT_ FSBytesFloat	8	Floating	point hex z/OS floating point format for transmission byte count
160	A0	SMF119FT_ FSCConnID	4	Binary	TCP connection ID of FTP control connection
164	A4	SMF119FT_ FSDConnID	4	Binary	TCP connection ID of FTP data connection, or 0
168	A8	SMF119FT_ FSSessionID	15	EBCDIC	FTP activity logging session ID. The activity logging session ID uniquely identifies the FTP session between a client and a server. The identifier is created by combining the job name of the FTP daemon with a 5-digit number in the range 00000 - 99 999.
183	B7	--	1	Binary	Reserved
Subtype 70 - FTP server transfer completion host name section. This section is optional, and is present if gethostbyaddr operation was performed for the local IP address(Offset from beginning of record: SMF119S2Off)
0	0	SMF119FT_ FSHostname	VARIABLE	EBCDIC	Host Name
Subtype 70 - FTP server transfer completion first associated data set name section. This section represents the server MVS or z/OS UNIX data set name associated with a rename or file transfer. Use the Data Set Type field information in the FTP server transfer completion section to determine the type of filename represented here.(Offset from beginning of record: SMF119S3Off)
0	0	SMF119FT_ FSFileName1	VARIABLE	EBCDIC	Server MVS or z/OS UNIX file name associated with the file transfer or rename operation. When the operation is a rename, this is the file or data set original name.
Subtype 70 - FTP server transfer completion second associated data set name section. This section represents an MVS or z/OS UNIX data set name associated with the rename operation. Use the Data Set Type field information in the FTP server transfer completion section to determine the type of file name represented here.(Offset from beginning of record: SMF119S4Off)
0	0	SMF119FT_ FSFileName2	VARIABLE	EBCDIC	Second MVS or z/OS UNIX file name associated with a rename. This is the new file or data set name.
Subtype 70 - FTP server security section(Offset from beginning of record: SMF119S5Off)
0	0	SMF119FT_ FSMechanism	1	EBCDIC	Protection Mechanism N None T TLS G GSSAPI A AT-TLS
1	1	SMF119FT_ FSCProtect	1	EBCDIC	Control connection protection level N None C Clear S Safe P Private
2	2	SMF119FT_ FSDProtect	1	EBCDIC	Data connection Protection Level N None C Clear S Safe P Private
3	3	SMF119FT_ FSLoginMech	1	EBCDIC	Login Method P Password C Certificate T Kerberos ticket
4	4	SMF119FT_ FSProtoLevel	8	EBCDIC	Protocol level (only present if Protocol Mechanism is TLS or AT-TLS) Possible values are: * SSLV2 * SSLV3 * TLSV1
12	C	SMF119FT_ FSCipherSpec	20	EBCDIC	Cipher Specification (only present if Protocol Mechanism is TLS or AT-TLS). Possible values when Protocol Level is SSLV2: * RC4 US * RC4 Export * RC2 US * RC2 Export * DES 56-Bit * Triple DES US Possible values when Protocol Level is SSLV3 or TLSV1: * SSL_NULL_MD5 * SSL_NULL_SHA * SSL_RC4_MD5_EX * SSL_RC4_MD5 * SSL_RC4_SHA * SSL_RC2_MD5_EX * SSL_DES_SHA * SSL_3DES_SHA * SSL_AES_128_SHA * SSL_AES_256_SHA
32	20	SMF119FT_ FSProtoBufSize	4	Binary	Negotiated protection buffer size
36	24	SMF119FT_ FSCipher	2	EBCDIC	Hexadecimal value of cipher specification (present only when Protocol Mechanism is TLS or AT-TLS).

The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.

Spectrum SMF Writer - the 4GL SMF Report Writer.

Sample Report from SMF 119 Subtype 2 Records
Showing Information about TCP Connections

The sample SMF report below was created with Spectrum SMF Writer, the low-cost 4GL SMF report writer.

In this report, we read as input the SMF file and select just the type 119 subtype 2 TCP Connection Termination records. (See SMF 119 Subtype 2 record layout.) The report shows information about terminated TCP connections, including start time, end time and computed elapsed time. It also shows the total number of bytes sent and received during the connection and the termination code. Our record layout also expands the 1-byte termination code into a readable descriptive text. The report is grouped by TCP/IP Stack and Resource. The report includes subtotals for each Resource.

All of this with just a few lines of code!
Why not install a Spectrum SMF Writer trial right now and start making your own SMF reports!

These Spectrum SMF Writer Statements:


INPUT:  SMF119 LIST(YES)

INCLUDEIF: SMF119RTY=119 AND SMF119STY=2

COMPUTE: MY_DURATION(2) = #MAKETIME(
               ((#MAKENUM(SMF119AP_TTEDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTETIME))
             - ((#MAKENUM(SMF119AP_TTSDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTSTIME))
                                   )

TITLE: 'Z/OS TCP DAILY CONNECTIONS REPORT'
TITLE: 'SYSTEM:' SMF119TI_SYSNAME
       'SYSPLEX:' SMF119TI_SYSPLEXNAME
       'STACK:' SMF119TI_STACK
TITLE: 'SORTED BY STACK AND RESOURCE NAME'

COLUMNS: SMF119AP_TTRNAME('RESOURCE')
         SMF119AP_TTSDATE('DATE/STARTED')
         SMF119AP_TTSTIME('TIME/STARTED')
         SMF119AP_TTEDATE('DATE/ENDED')
         SMF119AP_TTETIME('TIME/ENDED')
         MY_DURATION('CONNECTION/DURATION/HH:MM:SS.SS' ACCUM
                     TP'ZZ:ZZ:Z9.99')
         SMF119AP_TTINBYTES('INBOUND/BYTES')
         SMF119AP_TTOUTBYTES('OUTBOUND/BYTES')
         SMF119AP_TTTERMCODE(HEX 'TERM/CODE')
         SMF119AP_TTTERMCODE_DESC('TERM CODE DESC')

SORT:    SMF119TI_STACK
         SMF119AP_TTRNAME
         SMF119AP_TTSDATE
         SMF119AP_TTSTIME

BREAK:   SMF119AP_TTRNAME

Produce This SMF Report:


                                              Z/OS TCP DAILY CONNECTIONS REPORT
                                    SYSTEM: ST1      SYSPLEX: SYPROD    STACK: S01QDAS
                                             SORTED BY STACK AND RESOURCE NAME

                                                    CONNECTION
            DATE      TIME       DATE      TIME      DURATION      INBOUND        OUTBOUND    TERM
 RESOURCE STARTED    STARTED    ENDED      ENDED    HH:MM:SS.SS     BYTES          BYTES      CODE     TERM CODE DESC
 ________ ________ ___________ ________ ___________ ___________ ______________ ______________ ____ _______________________

 FTPTA5   03/21/09 14:04:06.81 03/21/09 14:04:07.46        0.65        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:05:35.59 03/21/09 14:05:45.67       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 14:12:13.81 03/21/09 14:12:14.51        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:12:27.35 03/21/09 14:12:37.42       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 15:30:34.96 03/21/09 15:30:35.64        0.68        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 15:35:13.92 03/21/09 15:35:24.00       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA5   (    6 ITEMS)                     32.26        853,740         10,143
 
 FTPTA6   03/21/09 14:05:38.03 03/21/09 14:05:38.70        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:07:23.60 03/21/09 14:07:33.68       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 14:12:29.83 03/21/09 14:12:30.50        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:17:10.02 03/21/09 14:17:20.16       10.14         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 15:35:16.45 03/21/09 15:35:17.21        0.76        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 15:36:15.10 03/21/09 15:36:25.18       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA6   (    6 ITEMS)                     32.40        853,740         10,143
 
 FTPTA7   03/21/09 14:07:26.16 03/21/09 14:07:26.86        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:08:24.36 03/21/09 14:08:34.50       10.14             70            507  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 14:17:12.60 03/21/09 14:17:13.31        0.71        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:21:40.01 03/21/09 14:21:50.08       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 15:36:17.53 03/21/09 15:36:18.17        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 15:37:11.45 03/21/09 15:37:21.53       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA7   (    6 ITEMS)                     32.34        826,767         10,321
 
 FTPTA8   03/21/09 08:09:32.96 03/21/09 15:29:02.41  7:19:29.45        274,763         15,912  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 13:17:39.42 03/21/09 14:42:50.82  1:25:11.40         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:42:57.42 03/21/09 14:43:21.38       23.96         45,921          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:43:26.45 03/21/09 15:28:27.01    45:00.56         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:50:01.00 03/21/09 15:28:26.10    38:25.10         35,513          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:51:01.03 03/21/09 14:52:28.82     1:27.79         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:05.50 03/21/09 15:28:22.53    35:17.03         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:51.74 03/21/09 14:55:51.42     1:59.68         35,306          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:56:05.98 03/21/09 15:11:31.19    15:25.21         33,066            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:12:01.80 03/21/09 15:13:30.66     1:28.86         35,266          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:13:45.48 03/21/09 15:17:09.41     3:23.93         38,223          2,199  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:18:54.59 03/21/09 15:20:07.26     1:12.67         34,273          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:20:22.01 03/21/09 15:28:20.73     7:58.72         33,118            875  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA8   (   13 ITEMS)               11:16:44.36        726,991         34,632

 
 FTPTA9   03/21/09 14:09:28.52 03/21/09 14:09:29.22        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 14:10:24.02 03/21/09 14:10:34.10       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA9   03/21/09 15:01:06.82 03/21/09 15:01:07.46        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 15:13:52.13 03/21/09 15:14:02.53       10.40         27,043            329  52  APPL ISSUED CLOSE

 ...

See other sample SMF reports.