








	*SMF Tools*

SMF Type 119 Record - Subtype 2

This table shows the record layout for type 119 SMF records
(TCP/IP Statistics - TCP Connection Termination Record).

List of other SMF record layouts available.
List of sample SMF reports.

Purpose: Transmission Control Protocol/Internet Protocol (TCP/IP) writes type 119 records to collect statistics about Telnet servers and clients, FTP servers and clients, and API activity and stack usage information.

SMF type 119 records contain unique stack identification sections designed to eliminate the confusion of the type 118 records. They provide uniformity of date and time (UTC), common record format (self-defining section and TCP/IP identification section), and support for IPv6 addresses and expanded field sizes (64 bit versus 32 bit) for some counters. The kinds of SMF type 119 records available are:

TCP connection initiation and termination
UDP socket close
TCP/IP, interface and server port statistics
TCP/IP stack start/stop
FTP server transfer completion
FTP server logon failure
FTP client transfer completion
TN3270E Telnet server session initiation and termination
Telnet client connection initiation and termination
IKE tunnel activation, refresh, and expire
Dynamic tunnel activation, refresh, installation, and removal
Manual tunnel activation and deactivation

The SMF type 119 records utilize a common structure. Each record is organized as follows:

SMF header
Self-defining section containing pointers to:
- TCP/IP identification section (identifies system, stack etc)
- Sections containing the data for the record

The Subtype 2 TCP connection termination record is collected whenever a TCP connection is closed or aborted. This record contains all pertinent information about the connection, such as elapsed time, bytes transferred, and so on.

Guidelines:
* Because this information duplicates all of the information contained in the TCP connection initiation record, only collect the TCP connection termination record.
* Because this record is generated for every single TCP connection, this can generate significant load on a server and rapidly fill the SMF data sets. Use care when you use it.

It's easy to report on SMF 119 data! (Jump to sample reports)

We have a low-cost 4GL report writer especially for SMF files. It's called Spectrum SMF Writer.

Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.

Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.

Plus, Spectrum SMF Writer can export SMF data as comma delimited files to use on your PC.

SMF Type 119 Record -- TCP/IP Statistics - TCP Connection Termination Record
Offset (Dec.)	Offset (Hex)	Name	Length	Format	Description
0	0	SMF119LEN	2	binary	Record length. This field and the next field (total of four bytes) form the RDW (record descriptor word). See “Standard SMF Record Header” on page 13-1 for a detailed description.
2	2	SMF119SEG	2	binary	Segment descriptor (see record length field).
4	4	SMF119FLG	1	binary	System indicator Bit Meaning When Set 0 New record format 1 Subtypes used 2 Reserved. 3-6 Version indicators* 7 System is running in PR/SM mode.*See “Standard SMF Record Header” on page 13-1 for a detailed description.
5	5	SMF119RTY	1	binary	Record type 119 (X'77').
6	6	SMF119TME	4	binary	Time since midnight, in hundredths of a second, that the record was moved into the SMF buffer.
10	A	SMF119DTE	4	packed	Date when the record was moved into the SMF buffer, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description.
14	E	SMF119SID	4	EBCDIC	System identification (from the SMFPRMxx SID parameter).
18	12	SMF119SSI	4	EBCDIC	Subsystem identification.
22	16	SMF119STY	2	binary	Record subtype.
Self Defining Section
24	18	SMF119TRN	2	binary	Number of triplets in this record. A triplet is a set of three SMF fields (offset/length/number values) that defines a section of the record. The offset is the offset from the RDW.
26	1A	--	2	binary	Reserved.
28	1C	SMF119IDOff	4	binary	Offset to TCP/IP identification section from RDW.
32	20	SMF119IDLen	2	binary	Length of TCP/IP identification section.
34	22	SMF119IDNum	2	binary	Number of TCP/IP identification sections.
36	24	SMF119S1Off	4	Binary	Offset to first data section
40	28	SMF119S1Len	2	Binary	Length of first data section
42	2A	SMF119S1Num	2	Binary	Number of first data sections
44	2C	SMF119S2Off	4	Binary	Offset to 2nd data section
48	30	SMF119S2Len	2	Binary	Length of 2nd data section
50	32	SMF119S2Num	2	Binary	Number of 2nd data sections
52	34	SMF119S3Off	4	Binary	Offset to 3rd data section
56	38	SMF119S3Len	2	Binary	Length of 3rd data section
58	3A	SMF119S3Num	2	Binary	Number of 3rd data sections
60	3C	SMF119S4Off	4	Binary	Offset to 4th data section
64	40	SMF119S4Len	2	Binary	Length of 4th data section
66	42	SMF119S4Num	2	Binary	Number of 4th data sections
TCP/IP Identification Section For the TCP/IP connection termination record, the TCP/IP stack identification section indicates TCP as the subcomponent and X'08' (event record) as the record reason. (Offset from beginning of record: SMF119IDOff)
0	0	SMF119TI_ SYSName	8	EBCDIC	System name from SYSNAME in IEASYSxx
8	8	SMF119TI_ SysplexName	8	EBCDIC	Sysplex name from SYSPLEX in COUPLExx
16	10	SMF119TI_ Stack	8	EBCDIC	TCP/IP stack name
24	18	SMF119TI_ ReleaseID	8	EBCDIC	z/OS Communications Server TCP/IP release identifier
32	20	SMF119TI_ Comp	8	EBCDIC	TCP/IP subcomponent (right padded with blanks): FTPC FTP Client FTPS FTP server IP IP layer STACK Entire TCP/IP stack TCP TCP layer TN3270C TN3270 Client TN3270S TN3270 server UDP UDP layer
40	28	SMF119TI_ ASName	8	EBCDIC	Started task qualifier or address space name of address space that writes this SMF record
48	30	SMF119TI_ UserID	8	EBCDIC	User ID of security context under which this SMF record is written
56	38	--	2	EBCDIC	Reserved
58	3A	SMF119TI_ ASID	2	Binary	ASID of address space that writes this SMF record
60	3C	SMF119TI_ Reason	1	Binary	Reason for writing this SMF record: X'08' Event record X'C0' Interval statistics record, more records follow X'80' Interval statistics record, last record in set X'60' End-of-statistics record, more records follow X'20' End-of-statistics record, last record in set X'50' Shutdown starts record, more records follow X'10' Shutdown starts record, last record in set
61	3D	--	3	EBCDIC	Reserved
Subtype 2 - TCP Connection Termination Section The TCP connection termination record is collected whenever a TCP connection is closed or aborted. This record contains all pertinent information about the connection, such as elapsed time, bytes transferred, and so on. (Offset from beginning of record: SMF119S1Off)
0	0	SMF119AP_ TTRName	8	EBCDIC	TCP socket resource name (Address space name of address space that closed this TCP connection)
8	8	SMF119AP_ TTConnID	4	Binary	TCP socket resource ID (connection ID)
12	C	SMF119AP_ TTTTLSCS	1	Binary	AT-TLS connection status: * x'01': Connection is not secure * x'02': Connection handshake in progress * x'03': Connection is secure
13	D	SMF119AP_ TTTTLSPS	1	Binary	AT-TLS Policy Status: * x'00': Policy status is not known * x'01': AT-TLS function off * x'02': No policy defined for connection * x'03': Policy defined for connection; AT-TLS not enabled * x'04': Policy defined for connection; AT-TLS enabled * x'05': Policy defined for connection; AT-TLS enabled and Application Controlled
14	E	SMF119AP_ TTTermCode	1	Binary	Reason code for connection termination: * x'11': Error occurred during a send using FRCA(AFPA), possibly because the stack is terminating. * x'12': A persistent socket used by FRCA (AFPA) was closed by a FIN. * x'21': The connection was terminated because the stack was terminating. * x'22': Last stack that can own the dynamic VIPA bound to the socket is terminating * x'31': Intrusion detection found the connection to be malicious and closed the connection. * x'32': Connection was denied because of a NetAccess rule. * x'33': ACK received in lastack state. * x'41': The connection was terminated because of an administrator action (for example, using Netstat DRop/-D command or the NMI API). * x'42': The connection was terminated because the local IP address bound by the application has been deleted from the stack. * x'51': The connection from a client was terminated because the application closed the socket before performing an accept(). * x'52': The application using the socket, closed the connection using a close(). * x'53': A pascal routine issued an orderly close request. * x'54': A pascal routine issued a disconnect. * x'55':An error occurred during a pascal accept. * x'61': The connection was terminated because the client sent a reset. * x'71':The connection was closed because the same packet was being re-transmitted multiple times. * x'72': The connection was closed because the TCP window the client was reduced to zero and multiple window probes were not acknowledged. * x'73': The connection was closed because multiple keepalive probes were not acknowledged. * x'74': The connection was terminated because the stack timed out waiting for a fin in the finwait-2 state.
15	F	SMF119AP_ TTRsv2	1	Binary	Reserved
16	10	SMF119AP_ TTSubtask	4	Binary	Subtask Name (Address of MVS™ TCB for the task that owns this connection. This is not the subtask value specified on an INITAPI call.)
20	14	SMF119AP_ TTSTime	4	Binary	Time of connection establishment
24	18	SMF119AP_ TTSDate	4	Packed	Date of connection establishment
28	1C	SMF119AP_ TTETime	4	Binary	Time connection entered TIMEWAIT or LASTACK state.
32	20	SMF119AP_ TTEDate	4	Packed	Date connection entered TIMEWAIT or LASTACK state.
36	24	SMF119AP_ TTRIP	16	Binary	Remote IP address at time of connection close.
52	34	SMF119AP_ TTLIP	16	Binary	Local IP address at time of connection close.
68	44	SMF119AP_ TTRPort	2	Binary	Remote port number at time of connection close.
70	46	SMF119AP_ TTLPort	2	Binary	Local port number at time of connection close.
72	48	SMF119AP_ TTInBytes	8	Binary	Inbound byte count.
80	50	SMF119AP_ TTOutBytes	8	Binary	Outbound byte count.
88	58	SMF119AP_ TTSWS	4	Binary	Send window size at time of connection close.
92	5C	SMF119AP_ TTMSWS	4	Binary	Maximum send window size.
96	60	SMF119AP_ TTCWS	4	Binary	Congestion window size at time of connection close.
100	64	SMF119AP_ TTSMS	4	Binary	Send segment size at time of connection close.
104	68	SMF119AP_ TTRTT	4	Binary	Round trip time in milliseconds at time of connection close.`
108	6C	SMF119AP_ TTRVA	4	Binary	Round trip time variance estimator at time of connection close, in milliseconds.
112	70	SMF119AP_ TTStatus	1	Binary	Socket status: * x'00': Passive Open (this is a server socket) * x'01': Active Open (this is a client socket)
113	71	SMF119AP_ TTTOS	1	Binary	Type of Service (ToS) used by this connection.
114	72	SMF119AP_ TTXRT	2	Binary	Number of times retransmission was required for this connection.
116	74	SMF119AP_ TTProf	32	EBCDIC	Service profile name.
148	94	SMF119AP_ TTPol	32	EBCDIC	Service Policy name at the time of connection close.
180	B4	SMF119AP_ TTInSeg	8	Binary	Inbound segment count.
188	BC	SMF119AP_ TTOutSeg	8	Binary	Outbound segment count.
196	C4	SMF119AP_ TTSSTCK_ D	8	Binary	MVS TOD clock value at time of connection establishment.
196	C4	SMF119AP_ TTSSTCK_ T	8	Binary	MVS TOD clock value at time of connection establishment.
204	CC	SMF119AP_ TTESTCK_ D	8	Binary	MVS TOD clock value at time connection entered TIMEWAIT or LASTACK state.
204	CC	SMF119AP_ TTESTCK_ T	8	Binary	MVS TOD clock value at time connection entered TIMEWAIT or LASTACK state.
212	D4	SMF119AP_ TTDupAcksRcvd	4	Binary	Total Number of DUP ACKs received on the connection.
Subtype 2 - TCP Conn. Termination Telnet Specific Section This section is present only when the given TCP connection represented a TN3270 Telnet connection. (Offset from beginning of record: SMF119S2Off)
0	0	SMF119AP_ TTTelLUName	8	EBCDIC	LU name
8	8	SMF119AP_ TTTelAppl	8	EBCDIC	Target application name
16	10	SMF119AP_ TTTelLogmode	8	EBCDIC	Logmode name
24	18	SMF119AP_ TTTelStatus	4	Binary	Status word: * x80000000 Definite response mode * x40000000 The connection is being performance monitored * x00000004 TN3270E mode * x00000002 TN3270 mode * x00000001 Line mode
28	1c	SMF119AP_ TTTelTermCode	1	Binary	Reason code for closing connection. The socket must be accessible to the TN3270 server to record a reason. (for example, SMF119AP_TTTermCode for this record is x'52'.) See the description of EZZ6034I for a list of reason codes and their descriptions.
29	1D	SMF119AP_ TTTelRsv	3	Binary	Reserved
Subtype 2 - TCP Conn. Termination AT-TLS-Specific Section This section is present only when the given TCP connection was secured by AT-TLS (SMF119AP-TTTTLSCS is X'03'). (Offset from beginning of record: SMF119S3Off)
0	0	SMF119AP_ TTTTLSSP	2	Binary	AT-TLS SSL Protocol: * x'0200': SSL Version 2 * x'0300': SSL Version 3 * x'0301': AT-TLS Version 1
2	2	SMF119AP_ TTTTLSNC	2	EBCDIC	AT-TLS Negotiated Cipher
4	4	SMF119AP_ TTTTLSST	1	Binary	AT-TLS Security Type: * x'01': Client * x'02': Server * x'03': Server with client authentication, ClientAuthType = PassThru * x'04': Server with client authentication, ClientAuthType = Full * x'05': Server with client authentication, ClientAuthType = Required * x'06': Server with client authentication, ClientAuthType = SAFCheck
5	5	SMF119AP_ TTTTLSRSV1	3	Binary	Reserved
8	8	SMF119AP_ TTTTLSUID	8	EBCDIC	AT-TLS Partner UserID
Subtype 2 - TCP Conn. Termination Application-Specific Section This section provides the application-specific information that is associated with a TCP connection. This section is present only when the given TCP connection has application data associated with it. The content of this field is determined by the application that owns the connection. See the documentation that is supplied by the application. This field typically contains all printable EBCDIC characters, although some applications might include some binary data. (Offset from beginning of record: SMF119S4Off)
0	0	SMF119AP_ TTAPPLDATA	40	EBCDIC	For z/OS Communications Server applications, see Appendix E. Application data for an explanation of the layout, format, and meaning of \|this field. For other applications, see the documentation that is supplied \|by the application.

The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.

Spectrum SMF Writer - the 4GL SMF Report Writer.

Sample Report from SMF 119 Subtype 2 Records
Showing Information about TCP Connections

The sample SMF report below was created with Spectrum SMF Writer, the low-cost 4GL SMF report writer.

In this report, we read as input the SMF file and select just the type 119 subtype 2 TCP Connection Termination records. (See SMF 119 Subtype 2 record layout.) The report shows information about terminated TCP connections, including start time, end time and computed elapsed time. It also shows the total number of bytes sent and received during the connection and the termination code. Our record layout also expands the 1-byte termination code into a readable descriptive text. The report is grouped by TCP/IP Stack and Resource. The report includes subtotals for each Resource.

All of this with just a few lines of code!
Why not install a Spectrum SMF Writer trial right now and start making your own SMF reports!

These Spectrum SMF Writer Statements:


INPUT:  SMF119 LIST(YES)

INCLUDEIF: SMF119RTY=119 AND SMF119STY=2

COMPUTE: MY_DURATION(2) = #MAKETIME(
               ((#MAKENUM(SMF119AP_TTEDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTETIME))
             - ((#MAKENUM(SMF119AP_TTSDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTSTIME))
                                   )

TITLE: 'Z/OS TCP DAILY CONNECTIONS REPORT'
TITLE: 'SYSTEM:' SMF119TI_SYSNAME
       'SYSPLEX:' SMF119TI_SYSPLEXNAME
       'STACK:' SMF119TI_STACK
TITLE: 'SORTED BY STACK AND RESOURCE NAME'

COLUMNS: SMF119AP_TTRNAME('RESOURCE')
         SMF119AP_TTSDATE('DATE/STARTED')
         SMF119AP_TTSTIME('TIME/STARTED')
         SMF119AP_TTEDATE('DATE/ENDED')
         SMF119AP_TTETIME('TIME/ENDED')
         MY_DURATION('CONNECTION/DURATION/HH:MM:SS.SS' ACCUM
                     TP'ZZ:ZZ:Z9.99')
         SMF119AP_TTINBYTES('INBOUND/BYTES')
         SMF119AP_TTOUTBYTES('OUTBOUND/BYTES')
         SMF119AP_TTTERMCODE(HEX 'TERM/CODE')
         SMF119AP_TTTERMCODE_DESC('TERM CODE DESC')

SORT:    SMF119TI_STACK
         SMF119AP_TTRNAME
         SMF119AP_TTSDATE
         SMF119AP_TTSTIME

BREAK:   SMF119AP_TTRNAME

Produce This SMF Report:


                                              Z/OS TCP DAILY CONNECTIONS REPORT
                                    SYSTEM: ST1      SYSPLEX: SYPROD    STACK: S01QDAS
                                             SORTED BY STACK AND RESOURCE NAME

                                                    CONNECTION
            DATE      TIME       DATE      TIME      DURATION      INBOUND        OUTBOUND    TERM
 RESOURCE STARTED    STARTED    ENDED      ENDED    HH:MM:SS.SS     BYTES          BYTES      CODE     TERM CODE DESC
 ________ ________ ___________ ________ ___________ ___________ ______________ ______________ ____ _______________________

 FTPTA5   03/21/09 14:04:06.81 03/21/09 14:04:07.46        0.65        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:05:35.59 03/21/09 14:05:45.67       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 14:12:13.81 03/21/09 14:12:14.51        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:12:27.35 03/21/09 14:12:37.42       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 15:30:34.96 03/21/09 15:30:35.64        0.68        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 15:35:13.92 03/21/09 15:35:24.00       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA5   (    6 ITEMS)                     32.26        853,740         10,143
 
 FTPTA6   03/21/09 14:05:38.03 03/21/09 14:05:38.70        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:07:23.60 03/21/09 14:07:33.68       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 14:12:29.83 03/21/09 14:12:30.50        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:17:10.02 03/21/09 14:17:20.16       10.14         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 15:35:16.45 03/21/09 15:35:17.21        0.76        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 15:36:15.10 03/21/09 15:36:25.18       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA6   (    6 ITEMS)                     32.40        853,740         10,143
 
 FTPTA7   03/21/09 14:07:26.16 03/21/09 14:07:26.86        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:08:24.36 03/21/09 14:08:34.50       10.14             70            507  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 14:17:12.60 03/21/09 14:17:13.31        0.71        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:21:40.01 03/21/09 14:21:50.08       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 15:36:17.53 03/21/09 15:36:18.17        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 15:37:11.45 03/21/09 15:37:21.53       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA7   (    6 ITEMS)                     32.34        826,767         10,321
 
 FTPTA8   03/21/09 08:09:32.96 03/21/09 15:29:02.41  7:19:29.45        274,763         15,912  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 13:17:39.42 03/21/09 14:42:50.82  1:25:11.40         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:42:57.42 03/21/09 14:43:21.38       23.96         45,921          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:43:26.45 03/21/09 15:28:27.01    45:00.56         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:50:01.00 03/21/09 15:28:26.10    38:25.10         35,513          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:51:01.03 03/21/09 14:52:28.82     1:27.79         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:05.50 03/21/09 15:28:22.53    35:17.03         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:51.74 03/21/09 14:55:51.42     1:59.68         35,306          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:56:05.98 03/21/09 15:11:31.19    15:25.21         33,066            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:12:01.80 03/21/09 15:13:30.66     1:28.86         35,266          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:13:45.48 03/21/09 15:17:09.41     3:23.93         38,223          2,199  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:18:54.59 03/21/09 15:20:07.26     1:12.67         34,273          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:20:22.01 03/21/09 15:28:20.73     7:58.72         33,118            875  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA8   (   13 ITEMS)               11:16:44.36        726,991         34,632

 
 FTPTA9   03/21/09 14:09:28.52 03/21/09 14:09:29.22        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 14:10:24.02 03/21/09 14:10:34.10       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA9   03/21/09 15:01:06.82 03/21/09 15:01:07.46        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 15:13:52.13 03/21/09 15:14:02.53       10.40         27,043            329  52  APPL ISSUED CLOSE

 ...

See other sample SMF reports.