








	*SMF Tools*

SMF type 119 Record - Subtype 94

This table shows the record layout for type 119 SMF records
(TCP/IP Statistics - OpenSSH Client Connection Started).

List of other SMF record layouts available.
List of sample SMF reports.

Purpose: OpenSSH writes SMF Type 119 records for file transfer activity and login failure information.

The kinds of SMF type 119 records for OpenSSH are:

Subtype 94 - Client connection started
Subtype 95 - Server connection started
Subtype 96 - Server transfer completion record
Subtype 97 - Client transfer completion record
Subtype 98 - Login failure record

Subtype 94 -- Client Connection Started

The SMF type 119 records utilize a common structure. Each record is organized as follows:

SMF header
Self-defining section containing pointers to:
TCP/IP identification section (identifies system, stack etc)
Sections containing the data for the record

It's easy to report on SMF 119 data! (Jump to sample reports)

We have a low-cost 4GL report writer especially for SMF files. It's called Spectrum SMF Writer.

Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.

Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.

Plus, Spectrum SMF Writer can export SMF data as comma delimited files to use on your PC.

SMF Type 119 Record -- TCP/IP Statistics - OpenSSH Client Connection Started
Offset (Dec.)	Offset (Hex)	Name	Length	Format	Description
0	0	SMF119S94_ LEN	2	binary	Record length. This field and the next field (total of four bytes) form the RDW (record descriptor word). See “Standard SMF Record Header” on page 13-1 for a detailed description.
2	2	SMF119S94_ SEG	2	binary	Segment descriptor (see record length field).
4	4	SMF119S94_ FLG	1	binary	System indicator Bit Meaning When Set 0 New record format 1 Subtypes used 2 Reserved. 3-6 Version indicators* 7 System is running in PR/SM mode.*See “Standard SMF Record Header” on page 13-1 for a detailed description.
5	5	SMF119S94_ RTY	1	binary	Record type 119 (X'77').
6	6	SMF119S94_ TME	4	binary	Time since midnight, in hundredths of a second, that the record was moved into the SMF buffer.
10	A	SMF119S94_ DTE	4	packed	Date when the record was moved into the SMF buffer, in the form 0cyydddF. See “Standard SMF Record Header” on page 13-1 for a detailed description.
14	E	SMF119S94_ SID	4	EBCDIC	System identification (from the SMFPRMxx SID parameter).
18	12	SMF119S94_ SSI	4	EBCDIC	Subsystem identification.
22	16	SMF119S94_ STY	2	binary	Record subtype is 94 (x'5E')
Self Defining Section
24	18	SMF119S94_ TRN	2	binary	Number of triplets in this record (3). The third triplet is not used. A triplet is a set of three SMF fields (offset/length/number values) that defines a section of the record. The offset is the offset from the RDW.
26	1A	--	2	binary	Reserved.
28	1C	SMF119S94_ IDOff	4	binary	Offset to TCP/IP identification section from RDW.
32	20	SMF119S94_ IDLen	2	binary	Length of TCP/IP identification section.
34	22	SMF119S94_ IDNum	2	binary	Number of TCP/IP identification sections.
36	24	SMF119S94_ S1Off	4	Binary	Offset to first data section
40	28	SMF119S94_ S1Len	2	Binary	Length of first data section
42	2A	SMF119S94_ S1Num	2	Binary	Number of first data sections
44	2C	SMF119S94_ S2Off	4	Binary	Offset to 2nd data section
48	30	SMF119S94_ S2Len	2	Binary	Length of 2nd data section
50	32	SMF119S94_ S2Num	2	Binary	Number of 2nd data sections
Common TCP/IP Identification Section for OpenSSH Identifies the system and stack information associated with the SMF record. (Offset from beginning of record: SMF119S94_IDOff)
0	0	SMF119S94_ SSH_ TI_ SYSName	8	EBCDIC	System name from SYSNAME in IEASYSxx
8	8	SMF119S94_ SSH_ TI_ SysplexName	8	EBCDIC	Sysplex name from SYSPLEX in COUPLExx
16	10	SMF119S94_ SSH_ TI_ Stack	8	EBCDIC	TCP/IP stack name
24	18	SMF119S94_ SSH_ TI_ ReleaseID	8	EBCDIC	z/OS release identifier
32	20	SMF119S94_ SSH_ TI_ Comp	8	EBCDIC	OpenSSH subcomponent (right-padded with blanks): SFTPS sftp server SFTPC sftp client SCPS scp server SCPC scp client SSHD sshd daemon
40	28	SMF119S94_ SSH_ TI_ ASName	8	EBCDIC	Started task qualifier or address space name of address space that writes this SMF record
48	30	SMF119S94_ SSH_ TI_ UserID	8	EBCDIC	User ID of security context under which this SMF record is written 56 38 Reserved 2 Binary Reserved
58	3A	SMF119S94_ SSH_ TI_ ASID	2	Binary	ASID of address space that writes this SMF record
60	3C	SMF119S94_ SSH_ TI_ Reason	1	Binary	Reason for writing this SMF record x'08' Event record
61	3D	SMF119S94_ SSH_ TI_ RecordID	1	Binary	Record ID
62	3E	--	2	EBCDIC	Reserved
Common Security Section for OpenSSH Identifies the security information associated with the SMF record. When the authentication method being used is Control Socket and the ssh connection information cannot be collected from the control socket, the EBCDIC fields in this section are set to blanks and the binary fields are set to x'0000' Unknown. (Offset from beginning of record: SMF119S94_S1Off)
0	0	SMF119S94_ SSH_ SSHV	16	EBCDIC	OpenSSH version
16	10	SMF119S94_ SSH_ SSLV	32	EBCDIC	OpenSSL version
48	30	SMF119S94_ SSH_ ZlibV	16	EBCDIC	zlib version
64	40	SMF119S94_ SSH_ ProtoV	8	EBCDIC	Protocol version (right-padded with blanks): 'SSHV1' Protocol version 1 'SSHV2' Protocol version 2
72	48	SMF119S94_ SSH_ AuthMethod	2	Binary	Authentication method being used: x'0000' Unknown x'0001' None x'0002' Password x'0003' Public key x'0004' Host-based x'0005' Rhosts x'0006' RhostsRSA x'0007' RSA x'0008' Keyboard-interactive x'0009' Challenge-response x'000A' Control socket 1
74	4A	SMF119S94_ SSH_ Cipher	2	Binary	Cipher type being used: x'0000' Unknown x'0001' None Possible values when protocol version 1: x'0002' 3DES x'0003' Blowfish x'0004' DES Possible values when protocol version 2: x'0005' 3des-cbc x'0006' blowfish-cbc x'0007' cast128-cbc x'0008' arcfour128 x'0009' arcfour256 x'000A' arcfour x'000B' aes128-cbc x'000C' aes192-cbc x'000D' aes256-cbc x'000E' aes128-ctr x'000F' aes192-ctr x'0010' aes256-ctr x'0011' rijndael-cbc@lysator.liu.se x'0012' acss@openssh.org
76	4C	SMF119S94_ SSH_ MAC	2	Binary	MAC algorithm being used: x'0000' Unknown x'0001' None (protocol version 1) x'0002' hmac-md5 x'0003' hmac-sha1 x'0004' umac-64@openssh.com x'0005' hmac-ripemd160 x'0006' hmac-sha1-96 x'0007' hmac-md5-96 x'0008' hmac-ripemd160openssh.com
78	4E	SMF119S94_ SSH_ COMP	2	Binary	Compression method being used: x'0000' Unknown x'0001' None (no) x'0002' zlib (yes) x'0003' zlib@openssh.com (delayed)

The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.

Spectrum SMF Writer - the 4GL SMF Report Writer.

Sample Report from SMF 119 Subtype 2 Records
Showing Information about TCP Connections

The sample SMF report below was created with Spectrum SMF Writer, the low-cost 4GL SMF report writer.

In this report, we read as input the SMF file and select just the type 119 subtype 2 TCP Connection Termination records. (See SMF 119 Subtype 2 record layout.) The report shows information about terminated TCP connections, including start time, end time and computed elapsed time. It also shows the total number of bytes sent and received during the connection and the termination code. Our record layout also expands the 1-byte termination code into a readable descriptive text. The report is grouped by TCP/IP Stack and Resource. The report includes subtotals for each Resource.

All of this with just a few lines of code!
Why not install a Spectrum SMF Writer trial right now and start making your own SMF reports!

These Spectrum SMF Writer Statements:


INPUT:  SMF119 LIST(YES)

INCLUDEIF: SMF119RTY=119 AND SMF119STY=2

COMPUTE: MY_DURATION(2) = #MAKETIME(
               ((#MAKENUM(SMF119AP_TTEDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTETIME))
             - ((#MAKENUM(SMF119AP_TTSDATE) * 86400)
                  + #MAKENUM(SMF119AP_TTSTIME))
                                   )

TITLE: 'Z/OS TCP DAILY CONNECTIONS REPORT'
TITLE: 'SYSTEM:' SMF119TI_SYSNAME
       'SYSPLEX:' SMF119TI_SYSPLEXNAME
       'STACK:' SMF119TI_STACK
TITLE: 'SORTED BY STACK AND RESOURCE NAME'

COLUMNS: SMF119AP_TTRNAME('RESOURCE')
         SMF119AP_TTSDATE('DATE/STARTED')
         SMF119AP_TTSTIME('TIME/STARTED')
         SMF119AP_TTEDATE('DATE/ENDED')
         SMF119AP_TTETIME('TIME/ENDED')
         MY_DURATION('CONNECTION/DURATION/HH:MM:SS.SS' ACCUM
                     TP'ZZ:ZZ:Z9.99')
         SMF119AP_TTINBYTES('INBOUND/BYTES')
         SMF119AP_TTOUTBYTES('OUTBOUND/BYTES')
         SMF119AP_TTTERMCODE(HEX 'TERM/CODE')
         SMF119AP_TTTERMCODE_DESC('TERM CODE DESC')

SORT:    SMF119TI_STACK
         SMF119AP_TTRNAME
         SMF119AP_TTSDATE
         SMF119AP_TTSTIME

BREAK:   SMF119AP_TTRNAME

Produce This SMF Report:


                                              Z/OS TCP DAILY CONNECTIONS REPORT
                                    SYSTEM: ST1      SYSPLEX: SYPROD    STACK: S01QDAS
                                             SORTED BY STACK AND RESOURCE NAME

                                                    CONNECTION
            DATE      TIME       DATE      TIME      DURATION      INBOUND        OUTBOUND    TERM
 RESOURCE STARTED    STARTED    ENDED      ENDED    HH:MM:SS.SS     BYTES          BYTES      CODE     TERM CODE DESC
 ________ ________ ___________ ________ ___________ ___________ ______________ ______________ ____ _______________________

 FTPTA5   03/21/09 14:04:06.81 03/21/09 14:04:07.46        0.65        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:05:35.59 03/21/09 14:05:45.67       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 14:12:13.81 03/21/09 14:12:14.51        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 14:12:27.35 03/21/09 14:12:37.42       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA5   03/21/09 15:30:34.96 03/21/09 15:30:35.64        0.68        257,537          3,052  61  CLIENT SENT RESET
 FTPTA5   03/21/09 15:35:13.92 03/21/09 15:35:24.00       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA5   (    6 ITEMS)                     32.26        853,740         10,143
 
 FTPTA6   03/21/09 14:05:38.03 03/21/09 14:05:38.70        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:07:23.60 03/21/09 14:07:33.68       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 14:12:29.83 03/21/09 14:12:30.50        0.67        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 14:17:10.02 03/21/09 14:17:20.16       10.14         27,043            329  52  APPL ISSUED CLOSE
 FTPTA6   03/21/09 15:35:16.45 03/21/09 15:35:17.21        0.76        257,537          3,052  61  CLIENT SENT RESET
 FTPTA6   03/21/09 15:36:15.10 03/21/09 15:36:25.18       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA6   (    6 ITEMS)                     32.40        853,740         10,143
 
 FTPTA7   03/21/09 14:07:26.16 03/21/09 14:07:26.86        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:08:24.36 03/21/09 14:08:34.50       10.14             70            507  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 14:17:12.60 03/21/09 14:17:13.31        0.71        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 14:21:40.01 03/21/09 14:21:50.08       10.07         27,043            329  52  APPL ISSUED CLOSE
 FTPTA7   03/21/09 15:36:17.53 03/21/09 15:36:18.17        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA7   03/21/09 15:37:11.45 03/21/09 15:37:21.53       10.08         27,043            329  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA7   (    6 ITEMS)                     32.34        826,767         10,321
 
 FTPTA8   03/21/09 08:09:32.96 03/21/09 15:29:02.41  7:19:29.45        274,763         15,912  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 13:17:39.42 03/21/09 14:42:50.82  1:25:11.40         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:42:57.42 03/21/09 14:43:21.38       23.96         45,921          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:43:26.45 03/21/09 15:28:27.01    45:00.56         47,498          2,291  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:50:01.00 03/21/09 15:28:26.10    38:25.10         35,513          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:51:01.03 03/21/09 14:52:28.82     1:27.79         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:05.50 03/21/09 15:28:22.53    35:17.03         33,273            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:53:51.74 03/21/09 14:55:51.42     1:59.68         35,306          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 14:56:05.98 03/21/09 15:11:31.19    15:25.21         33,066            875  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:12:01.80 03/21/09 15:13:30.66     1:28.86         35,266          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:13:45.48 03/21/09 15:17:09.41     3:23.93         38,223          2,199  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:18:54.59 03/21/09 15:20:07.26     1:12.67         34,273          1,537  52  APPL ISSUED CLOSE
 FTPTA8   03/21/09 15:20:22.01 03/21/09 15:28:20.73     7:58.72         33,118            875  52  APPL ISSUED CLOSE
 *** TOTAL FOR FTPTA8   (   13 ITEMS)               11:16:44.36        726,991         34,632

 
 FTPTA9   03/21/09 14:09:28.52 03/21/09 14:09:29.22        0.70        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 14:10:24.02 03/21/09 14:10:34.10       10.08         27,043            329  52  APPL ISSUED CLOSE
 FTPTA9   03/21/09 15:01:06.82 03/21/09 15:01:07.46        0.64        257,537          3,052  61  CLIENT SENT RESET
 FTPTA9   03/21/09 15:13:52.13 03/21/09 15:14:02.53       10.40         27,043            329  52  APPL ISSUED CLOSE

 ...

See other sample SMF reports.