SMF Type 119 Record - Subtype 72
This table shows the record layout for type 119 SMF records
It's easy to report on SMF 119 data! (Jump to sample reports)
Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.
Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.
Record length. This field and the next field (total of four bytes) form the RDW (record descriptor word). See “Standard SMF Record Header” on page 13-1 for a detailed description.
Segment descriptor (see record length field).
System indicator Bit Meaning When Set 0 New record format 1 Subtypes used 2 Reserved. 3-6 Version indicators* 7 System is running in PR/SM mode.*See “Standard SMF Record Header” on page 13-1 for a detailed description.
Record type 119 (X'77').
Time since midnight, in hundredths of a second, that the record was moved into the SMF buffer.
Date when the record was moved into the SMF buffer, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description.
System identification (from the SMFPRMxx SID parameter).
Number of triplets in this record. A triplet is a set of three SMF fields (offset/length/number values) that defines a section of the record. The offset is the offset from the RDW.
Offset to TCP/IP identification section from RDW.
Length of TCP/IP identification section.
Number of TCP/IP identification sections.
Offset to first data section
Length of first data section
Number of first data sections
Offset to 2nd data section
Length of 2nd data section
Number of 2nd data sections
For the FTP server logon failure record, the TCP/IP stack identification section indicates FTPS as the subcomponent and X'08' (event record) as the record reason.
System name from SYSNAME in IEASYSxx
Sysplex name from SYSPLEX in COUPLExx
TCP/IP stack name
z/OS Communications Server TCP/IP release identifier
TCP/IP subcomponent (right padded with blanks):
FTPC FTP Client
FTPS FTP server
IP IP layer
STACK Entire TCP/IP stack
TCP TCP layer
TN3270C TN3270 Client
TN3270S TN3270 server
UDP UDP layer
Started task qualifier or address space name of address space that writes this SMF record
User ID of security context under which this SMF record is written
ASID of address space that writes this SMF record
Reason for writing this SMF record:
X'08' Event record
X'C0' Interval statistics record, more records follow
X'80' Interval statistics record, last record in set
X'60' End-of-statistics record, more records follow
X'20' End-of-statistics record, last record in set
X'50' Shutdown starts record, more records follow
X'10' Shutdown starts record, last record in set
Remote IP address
Local IP address
Remote port number (Client)
Local port number (Server)
Client User ID received by server
Login failure reason:
'01'X Password is not valid.
'02'X Password has expired.
'03'X User ID has been revoked.
'04'X User does not have server access.
'05'X FTCHKPWD User exit reject login.
'06'X Excessive bad passwords.
'07'X Group ID process failed.
'08'X User ID is unknown.
'09'X Certificate is not valid
'0A'X Client name associated with certificate or ticket does not match user name.
TCP connection ID of FTP control connection
FTP activity logging session ID. The activity logging session ID uniquely identifies the FTP session between a client and a server. The identifier is created by combining the job name of the FTP daemon with a 5-digit number in the range 00000 - 99 999. 67 49 1 Binary Reserved
Control Connection Protection Level
Data connection protection level
- Login failure occurred before login method was determined.
T Kerberos ticket
Protocol level (present only if Protocol Mechanism is TLS or AT-TLS) Possible values are:
Cipher specification (only present if protocol mechanism is TLS or AT-TLS) Possible values when protocol level is SSLV2:
* RC4 US
* RC4 Export
* RC2 US
* RC2 Export
* DES 56-Bit
* Triple DES US
Possible values when protocol level is SSLV3 or TLSV1:
Negotiated protection buffer size
Hexadecimal value of cipher specification ( present only if protocol mechanism is TLS or AT-TLS.
The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.
The sample SMF report below was created with Spectrum SMF Writer, the low-cost 4GL SMF report writer.
In this report, we read as input the SMF file and select just the type 119 subtype 2 TCP Connection Termination records. (See SMF 119 Subtype 2 record layout.) The report shows information about terminated TCP connections, including start time, end time and computed elapsed time. It also shows the total number of bytes sent and received during the connection and the termination code. Our record layout also expands the 1-byte termination code into a readable descriptive text. The report is grouped by TCP/IP Stack and Resource. The report includes subtotals for each Resource.
All of this with just a few lines of code!
Why not install a Spectrum SMF Writer trial right now and start making your own SMF reports!