








	*SMF Tools*

SMF 123 Record - z/OS Connect EE Audit Interceptor Records V2

This table shows the record layout for type 123 SMF records
(Audit Interceptor).

List of other SMF record layouts available.
List of sample SMF reports.

Purpose: The SMF type 123 subtype 1 version 2 record is used to capture enhanced data for individual API provider requests.

Version 2 of the SMF 123 subtype 1 record has a different structure to the version 1 record after the 4-byte version field in the SMF type 123 subtype 1 header extension section.

The SMF type 123 subtype 2 version 2 record is used to capture enhanced data for individual API requester requests.

It is possible to correlate the SMF 123 subtype 2 record with data from CICS and IMS systems.

For CICS, the data required for correlation can be obtained at runtime using the CEMT INQUIRE TASK system command. CICS also records this information in the RMUOWID, NETUOWPX and NETUOWSX fields of the DFHTASK group in the PERFORMANCE class of SMF 110 SubType 1 records.

For IMS, the recovery token represents the work performed within a commit interval and is available in the IMS log records written to the IMS log.

To configure z/OS Connect EE to capture SMF 123 records, see Configuring the audit interceptor.

You should consider using SMF log streams with compression enabled. For more information, see Setting up and managing SMF recording to logstreams and the COMPRESS parameter in Statements and parameters for SMFPRMxx.

It's easy to report on SMF 123 data!

We have a low-cost 4GL report writer especially for SMF files. It's called Spectrum SMF Writer.

Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.

Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.

Plus, Spectrum SMF Writer can export SMF data as comma delimited files to use on your PC.

SMF Type 123 Record -- Audit Interceptor
Offset (Dec.)	Offset (Hex)	Name	Length	Format	Description
0	0	SMF123LEN	2	binary	Record length of the entire SMF record.
2	2	SMF123SEG	2	binary	Segment descriptor.
4	4	SMF123FLG	1	binary	System indicator.
5	5	SMF123RTY	1	binary	Record type 123 (X'7B').
6	6	SMF123TME	4	binary	Time since midnight
10	A	SMF123DTE	4	packed	Date record was moved to SMF.
14	E	SMF123SID	4	EBCDIC	System identification.
18	12	SMF123SSI	4	EBCDIC	Subsystem identification.
22	16	SMF123STY	2	binary	Record subtype. (1)
SMF type 123 subtype 1 version 2 header extension
24	18	SMF123S1_ SUBTYPE_ VERSION	4	Binary	Subtype version number. Set to 2.
28	1C	SMF123S1_ TRIPLET_ COUNT	1	BINARY	Number of triplets in this record. Default is x0002.
29	1D	SMF123S1_ TRIPLET_ OFFSET	1	BINARY	Triplet section offset.
30	1E	SMF123S1_ RESERVED_ 01	2	BINARY	RESERVED
32	20	SMF123S1_ DATETIME_ OFFSET	8	BINARY	Local date/time offset (CVTLDTO).
Triplet Section There is only one triplet section.(Offset from beginning of record: SMF123S1_TRIPLET_OFFSET)
0	0	SMF123S1_ SERVER_ OFFSET	4	BINARY	Server ID section offset.
4	4	SMF123S1_ SERVER_ LEN	2	BINARY	Server ID section length.
6	6	SMF123S1_ SERVER_ COUNT	2	BINARY	Server ID section count.
8	8	SMF123S1_ REQ_ DATA_ OFFSET	4	BINARY	Request data section offset.
12	C	SMF123S1_ REQ_ DATA_ LEN	2	BINARY	Request data section length.
14	E	SMF123S1_ REQ_ DATA_ COUNT	2	BINARY	Request data section count.
Server ID Section There is only one Server ID section.(Offset from beginning of record: SMF123S1_SERVER_OFFSET)
0	0	SMF123_ SERVER_ SECT_ VERSION	1	BINARY	Version of the server section.
1	1	SMF123_ RESERVED_ 02	3	binary	Reserved.
4	4	SMF123_ SERVER_ SYSTEM	8	CHAR	System name (CVTSNAME).
12	C	SMF123_ SERVER_ SYSPLEX	8	CHAR	Sysplex name (ECVTSPLX).
20	14	SMF123_ SERVER_ JOBID	8	CHAR	Job ID of the server (JSABJBID).
28	1C	SMF123_ SERVER_ JOBNAME	8	CHAR	Job name of the server (JSABJBNM).
36	24	SMF123_ SERVER_ STOKEN	8	BINARY	(HEX) SToken of the server (ASS-BSTKN).
44	2C	SMF123_ SERVER_ CONFIG_ DIR	128	CHAR	The path to where server.xml for the server is located, this includes the server name.
172	A2	SMF123_ SERVER_ VERSION	16	CHAR	Version of the server .
Request Data Section - Subtype 1 Records There may be multiple sections(Offset from beginning of record: SMF123S1_REQ_DATA_OFFSET)
0	0	SMF123S1_ REQ_ DATA_ VERSION	1	BINARY	Version of request data record. Set to 1.
1	1	SMF123S1_ REQ_ TYPE	1	BINARY	Request type: 0 = Unknown 1 = API 2 = Service 3 = Admin
2	2	SMF123S1_ HTTP_ RESP_ CODE	2	BINARY	HTTP response code.
4	4	SMF123S1_ RESP_ FLAGS	1	BINARY	Response flags. (BIT 0): SMF123S1_REQ_TIMED_OUT - Request timed out indicator. (BITS 1- 7): SMF123S1_RESERVED_03 - Reserved.
5	5	SMF123S1_ RESERVED_ 04	3	binary	Reserved.
8	8	SMF123S1_ USER_ NAME	64	CHAR	Username, a distributed or a SAF identity.
72	48	SMF123S1_ USER_ NAME_ MAPPED	8	CHAR	SAF mapped username.
80	50	SMF123S1_ CLIENT_ IP_ ADDR	48	CHAR	Client IP address.
128	80	SMF123S1_ API_ NAME	64	CHAR	API name.
192	C0	SMF123S1_ API_ VERSION	8	CHAR	API version.
200	C8	SMF123S1_ SERVICE_ NAME	64	CHAR	Service name.
264	108	SMF123S1_ SERVICE_ VERSION	8	CHAR	Service version.
272	110	SMF123S1_ REQ_ METHOD	8	CHAR	Method GET/POST/PUT/DELETE.
280	118	SMF123S1_ REQ_ QUERY_ STR	128	CHAR	Query string.
408	198	SMF123S1_ REQ_ TARGET_ URI	256	CHAR	Target URI.
664	298	SMF123S1_ REQ_ PAYLOAD_ LEN	4	BINARY	Request payload length in bytes.
668	29C	SMF123S1_ RESP_ PAYLOAD_ LEN	4	BINARY	Response payload length in bytes.
672	2A0	SMF123S1_ TIME_ ZC_ ENTRY_ RAW	16	BINARY	Time the request was received by the z/OS Connect EE server.
688	2B0	SMF123S1_ TIME_ ZC_ EXIT_ RAW	16	BINARY	Time the response was ready to be sent to the HTTP client.
704	2C0	SMF123S1_ TIME_ SOR_ SENT_ RAW	16	BINARY	Time the request was sent to the system of record.
720	2D0	SMF123S1_ TIME_ SOR_ RECV_ RAW	16	BINARY	Time the response was received from the system of record.
736	2E0	SMF123S1_ SP_ NAME	16	CHAR	Service provider name. Value of com.ibm.zosconnect.spi.Data.SERVICE_PROVIDER_NAME.
752	2F0	SMF123S1_ SOR_ REFERENCE	32	CHAR	Reference to the element in server.xml that identifies the connection to the system of record. Value of com.ibm.zosconnect.spi.Data.SOR_REFERENCE.
784	310	SMF123S1_ SOR_ IDENTIFIER	64	CHAR	System of record identifier. Value of com.ibm.zosconnect.spi.Data.SOR_IDENTIFIER.
848	350	SMF123S1_ SOR_ RESOURCE	128	CHAR	System of record resource. Value of com.ibm.zosconnect.spi.Data.SOR_RESOURCE.
976	3D0	SMF123S1_ REQ_ ID	8	BINARY	Request identifier that is unique within a z/OS Connect EE server instance.
984	3D8	SMF123S1_ TRACKING_ TOKEN	64	BINARY	(HEX) Tracking token. For more information, see Tracking selected requests.
1048	418	SMF123S1_ REQ_ HDR1	64	CHAR	Request header. header1name:header1value
1112	458	SMF123S1_ REQ_ HDR2	64	CHAR	Request header. header2name:header2value
1176	498	SMF123S1_ REQ_ HDR3	64	CHAR	Request header. header3name:header3value
1240	4D8	SMF123S1_ REQ_ HDR4	64	CHAR	Request header. header4name:header4value
1304	518	SMF123S1_ RESP_ HDR1	64	CHAR	Mapped response header. header1name:header1value
1368	558	SMF123S1_ RESP_ HDR2	64	CHAR	Mapped response header. header2name:header2value
1432	598	SMF123S1_ RESP_ HDR3	64	CHAR	Mapped response header. header3name:header3value
1496	5D8	SMF123S1_ RESP_ HDR4	64	CHAR	Mapped response header. header4name:header4value
Request Data Section - Subtype 2 Records There may be multiple sections(Offset from beginning of record: SMF123S2_REQ_DATA_OFFSET)
0	0	SMF123S2_ REQ_ DATA_ VERSION	1	BINARY	Version of request data record. Set to 1.
1	1	SMF123S2_ REQ_ APP_ TYPE	1	BINARy	Request application type: 1 = CICS 2 = IMS 3 = ZOS
2	2	SMF123S2_ HTTP_ RESP_ CODE	2	BINARY	HTTP response code returned from the API endpoint.
4	2	SMF123S2_ REQ_ STATUS_ CODE	2	BINARY	HTTP status code returned to the z/OS application.
6	6	SMF123S2_ RESP_ FLAGS	1	BINARY	Response flags. (BIT 0): SMF123S2_REQ_RETRIED BIT Set if the request to the API endpoint was retried after a 401 authentication failure. (BITS 1- 7): SMF123S2_RESERVED_03 - Reserved.
7	7	SMF123S2_ RESERVED_ 04	5	binary	Reserved.
12	C	SMF123S2_ REQ_ PAYLOAD_ LEN	4	BINARY	Length of the request payload sent to the API endpoint, in bytes.
16	10	SMF123S2_ RESP_ PAYLOAD_ LEN	4	BINARY	Length of the response payload received from the API endpoint, in bytes.
20	14	SMF123S2_ USER_ NAME	64	CHAR	One of the following values: if TLS client certificate authentication was used, the authenticated username associated with that certificate. The distributed ID, if one was sent on the request and is mapped to a SAF username. The authenticated username.
84	54	SMF123S2_ USER_ NAME_ MAPPED	8	CHAR	If a distributed ID was sent on the request and is mapped to a SAF username, then this value is the authenticated SAF username. Otherwise, this value is blank.
92	5C	SMF123S2_ USER_ NAME_ ASSERTED	8	CHAR	z/OS application asserted user ID.
100	64	SMF123S2_ API_ REQ_ NAME	64	CHAR	API requester name.
164	A4	SMF123S2_ API_ REQ_ VERSION	8	CHAR	API requester version.
172	AC	SMF123S2_ ENDPOINT_ REFERENCE	32	CHAR	Reference to the element in server.xml that identifies the connection to the API endpoint.
204	CC	SMF123S2_ ENDPOINT_ HOST	128	CHAR	The value of the host property of the API endpoint.
332	14C	SMF123S2_ ENDPOINT_ PORT	2	BINARY	The value of the port property of the API endpoint.
334	14E	SMF123S2_ ENDPOINT_ FULL_ PATH	256	CHAR	The full path invoked on the API endpoint.
590	24E	SMF123S2_ ENDPOINT_ METHOD	8	CHAR	The method used on the API endpoint.
598	256	SMF123S2_ ENDPOINT_ QUERY_ STRING	128	CHAR	The query string that is passed to the API endpoint.
726	2D6	SMF123S2_ TIME_ STUB_ SENT_ RAW	16	CHAR	Time the request left the calling application.
742	2E6	SMF123S2_ TIME_ ZC_ ENTRY_ RAW	16	CHAR	Time of z/OS Connect EE Entry.
758	2F6	SMF123S2_ TIME_ ZC_ EXIT_ RAW	16	CHAR	Time of z/OS Connect EE Exit.
774	306	SMF123S2_ TIME_ TOKEN_ GET_ START_ RAW	16	CHAR	Time z/OS Connect EE started to obtain one or more access tokens.
790	316	SMF123S2_ TIME_ TOKEN_ GET_ FINISH_ RAW	16	CHAR	Time z/OS Connect EE completed obtaining the access token(s).
806	326	SMF123S2_ TIME_ ENDPOINT_ SENT_ RAW	16	CHAR	Time z/OS Connect EE sent the request to the endpoint.
822	336	SMF123S2_ TIME_ ENDPOINT_ RECEIVED_ RAW	16	CHAR	Time z/OS Connect EE received a response from the endpoint.
838	346	SMF123S2_ MVS_ JOBNAME	8	CHAR	MVS Job Name of the calling application (JSAB -> JSABJBNM).
846	34E	SMF123S2_ MVS_ JOBID	8	CHAR	MVS Job ID of the calling application (JSAB -> JSABJBID).
854	356	SMF123S2_ MVS_ SYSNAME	8	CHAR	MVS System Name of the calling application (CVT -> CVTSNAME).
862	35E	SMF123S2_ MVS_ ASID	2	BINARY	MVS ASID of the calling application (ASCB -> ASCBASID).
864	360	SMF123S2_ MVS_ SID	4	CHAR	MVS SID of the calling application (SMCA -> SMCASID).
868	364	SMF123S2_ CICS_ APPLID	8	CHAR	The APPLID of the CICS region.
876	36C	SMF123S2_ CICS_ TASK_ NUMBER	4	BINARY	The CICS task number of the calling application.
880	370	SMF123S2_ CICS_ TRANSID	4	CHAR	The CICS transaction ID of the calling application.
884	374	SMF123S2_ CICS_ RMUOWID	8	BINARY	The CICS Recovery Manager UOW ID of the calling application. For correlation with CICS see Note.
892	37C	SMF123S2_ CICS_ NETUOW_ PX	20	BINARY	CICS Network UOW Prefix of the calling application. For correlation with CICS see Note.
912	390	SMF123S2_ CICS_ NETUOW_ SX	8	BINARY	CICS Network UOW Suffix of the calling application. For correlation with CICS see Note.
920	398	SMF123S2_ RESERVED_ 05	4	binary	Reserved.
924	39C	SMF123S2_ IMS_ IDENTIFIER	8	CHAR	The identifier from the execution parameters of the calling application.
932	3A4	SMF123S2_ IMS_ REGION_ ID	4	BINARY	The region identifier of the calling application.
936	3A8	SMF123S2_ IMS_ TRANSNAME	8	CHAR	The transaction name of the calling application.
944	3B0	SMF123S2_ IMS_ APPNAME	8	CHAR	The name of the application.
952	3B8	SMF123S2_ IMS_ PSBNAME	8	CHAR	The name of the PSB.
960	3C0	SMF123S2_ IMS_ RECOVERY_ TOKEN	16	BINARY	The recovery token for the UOW of the calling application. For correlation with IMS see Note.
976	3D0	SMF123S2_ REQ_ ID	8	BINARY	Request identifier that is unique within a z/OS Connect EE server instance.
984	3D8	SMF123S2_ TRACKING_ TOKEN	64	BINARY	Tracking token.
1048	418	SMF123S2_ REQ_ HDR1	64	CHAR	Request header. header1name:header1value
1112	458	SMF123S2_ REQ_ HDR2	64	CHAR	Request header. header2name:header2value
1176	498	SMF123S2_ REQ_ HDR3	64	CHAR	Request header. header3name:header3value
1240	4D8	SMF123S2_ REQ_ HDR4	64	CHAR	Request header. header4name:header4value
1304	518	SMF123S2_ RESP_ HDR1	64	CHAR	Response header. header1name:header1value
1368	558	SMF123S2_ RESP_ HDR2	64	CHAR	Response header. header2name:header2value
1432	598	SMF123S2_ RESP_ HDR3	64	CHAR	Response header. header3name:header3value
1496	5D8	SMF123S2_ RESP_ HDR4	64	CHAR	Response header. header4name:header4value

The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.

Spectrum SMF Writer - the 4GL SMF Report Writer.

SMF 123 Record - z/OS Connect EE Audit Interceptor Records V2

This table shows the record layout for type 123 SMF records (Audit Interceptor).

It's easy to report on SMF 123 data!

This table shows the record layout for type 123 SMF records
(Audit Interceptor).