








	*SMF Tools*

SMF 123 Record - z/OS Connect EE Audit Interceptor Records V2

This table shows the record layout for type 123 SMF records
(Audit Interceptor).

List of other SMF record layouts available.
List of sample SMF reports.

Purpose: The SMF type 123 subtype 1 version 2 record is used to capture enhanced data for individual API provider requests.

Version 2 of the SMF 123 subtype 1 record has a different structure to the version 1 record after the 4-byte version field in the SMF type 123 subtype 1 header extension section.

To configure z/OS Connect EE to capture SMF 123 records, see Configuring the audit interceptor.

You should consider using SMF log streams with compression enabled. For more information, see Setting up and managing SMF recording to logstreams and the COMPRESS parameter in Statements and parameters for SMFPRMxx.

It's easy to report on SMF 123 data!

We have a low-cost 4GL report writer especially for SMF files. It's called Spectrum SMF Writer.

Spectrum SMF Writer handles the difficult SMF record parsing for you automatically. You just specify which fields you want to see.

Spectrum SMF Writer also converts the arcane date and time fields and reformats them into an attractive report.

Plus, Spectrum SMF Writer can export SMF data as comma delimited files to use on your PC.

SMF Type 123 Record -- Audit Interceptor
Offset (Dec.)	Offset (Hex)	Name	Length	Format	Description
0	0	SMF123LEN	2	binary	Record length of the entire SMF record.
2	2	SMF123SEG	2	binary	Segment descriptor.
4	4	SMF123FLG	1	binary	System indicator.
5	5	SMF123RTY	1	binary	Record type 123 (X'7B').
6	6	SMF123TME	4	binary	Time since midnight
10	A	SMF123DTE	4	packed	Date record was moved to SMF.
14	E	SMF123SID	4	EBCDIC	System identification.
18	12	SMF123SSI	4	EBCDIC	Subsystem identification.
22	16	SMF123STY	2	binary	Record subtype. (1)
SMF type 123 subtype 1 version 2 header extension
24	18	SMF123S1_ SUBTYPE_ VERSION	4	Binary	Subtype version number. Set to 2.
28	1C	SMF123S1_ TRIPLET_ COUNT	1	BINARY	Number of triplets in this record. Default is x0002.
29	1D	SMF123S1_ TRIPLET_ OFFSET	1	BINARY	Triplet section offset.
30	1E	SMF123S1_ RESERVED_ 01	2	BINARY	RESERVED
32	20	SMF123S1_ DATETIME_ OFFSET	8	BINARY	Local date/time offset (CVTLDTO).
Triplet Section There is only one triplet section.(Offset from beginning of record: SMF123S1_TRIPLET_OFFSET)
0	0	SMF123S1_ SERVER_ OFFSET	4	BINARY	Server ID section offset.
4	4	SMF123S1_ SERVER_ LEN	2	BINARY	Server ID section length.
6	6	SMF123S1_ SERVER_ COUNT	2	BINARY	Server ID section count.
8	8	SMF123S1_ REQ_ DATA_ OFFSET	4	BINARY	Request data section offset.
12	C	SMF123S1_ REQ_ DATA_ LEN	2	BINARY	Request data section length.
14	E	SMF123S1_ REQ_ DATA_ COUNT	2	BINARY	Request data section count.
Server ID Section There is only one Server ID section.(Offset from beginning of record: SMF123S1_SERVER_OFFSET)
0	0	SMF123_ SERVER_ SECT_ VERSION	1	BINARY	Version of the server section.
1	1	SMF123_ RESERVED_ 02	3	binary	Reserved.
4	4	SMF123_ SERVER_ SYSTEM	8	CHAR	System name (CVTSNAME).
12	C	SMF123_ SERVER_ SYSPLEX	8	CHAR	Sysplex name (ECVTSPLX).
20	14	SMF123_ SERVER_ JOBID	8	CHAR	Job ID of the server (JSABJBID).
28	1C	SMF123_ SERVER_ JOBNAME	8	CHAR	Job name of the server (JSABJBNM).
36	24	SMF123_ SERVER_ STOKEN	8	BINARY	(HEX) SToken of the server (ASS-BSTKN).
44	2C	SMF123_ SERVER_ CONFIG_ DIR	128	CHAR	The path to where server.xml for the server is located, this includes the server name.
172	A2	SMF123_ SERVER_ VERSION	16	CHAR	Version of the server .
Request Data Section There may be multiple sections(Offset from beginning of record: SMF123S1_REQ_DATA_OFFSET)
0	0	SMF123_ REQ_ DATA_ VERSION	1	BINARY	Version of request data record. Set to 1.
1	1	SMF123S1_ REQ_ TYPE	1	BINARY	Request type: 0 = Unknown 1 = API 2 = Service 3 = Admin
2	2	SMF123S1_ HTTP_ RESP_ CODE	2	BINARY	HTTP response code.
4	4	SMF123S1_ RESP_ FLAGS	1	BINARY	Response flags. (BIT 0): SMF123S1_REQ_TIMED_OUT - Request timed out indicator. (BITS 1- 7): SMF123S1_RESERVED_03 - Reserved.
5	5	SMF123S1_ RESERVED_ 04	3	binary	Reserved.
8	8	SMF123S1_ USER_ NAME	64	CHAR	Username, a distributed or a SAF identity.
72	48	SMF123S1_ USER_ NAME_ MAPPED	8	CHAR	SAF mapped username.
80	50	SMF123S1_ CLIENT_ IP_ ADDR	48	CHAR	Client IP address.
128	80	SMF123S1_ API_ NAME	64	CHAR	API name.
192	C0	SMF123S1_ API_ VERSION	8	CHAR	API version.
200	C8	SMF123S1_ SERVICE_ NAME	64	CHAR	Service name.
264	108	SMF123S1_ SERVICE_ VERSION	8	CHAR	Service version.
272	110	SMF123S1_ REQ_ METHOD	8	CHAR	Method GET/POST/PUT/DELETE.
280	118	SMF123S1_ REQ_ QUERY_ STR	128	CHAR	Query string.
408	198	SMF123S1_ REQ_ TARGET_ URI	256	CHAR	Target URI.
664	298	SMF123S1_ REQ_ PAYLOAD_ LEN	4	BINARY	Request payload length in bytes.
668	29C	SMF123S1_ RESP_ PAYLOAD_ LEN	4	BINARY	Response payload length in bytes.
672	2A0	SMF123S1_ TIME_ ZC_ ENTRY_ RAW	16	BINARY	Time the request was received by the z/OS Connect EE server.
688	2B0	SMF123S1_ TIME_ ZC_ EXIT_ RAW	16	BINARY	Time the response was ready to be sent to the HTTP client.
704	2C0	SMF123S1_ TIME_ SOR_ SENT_ RAW	16	BINARY	Time the request was sent to the system of record.
720	2D0	SMF123S1_ TIME_ SOR_ RECV_ RAW	16	BINARY	Time the response was received from the system of record.
736	2E0	SMF123S1_ SP_ NAME	16	CHAR	Service provider name. Value of com.ibm.zosconnect.spi.Data.SERVICE_PROVIDER_NAME.
752	2F0	SMF123S1_ SOR_ REFERENCE	32	CHAR	Reference to the element in server.xml that identifies the connection to the system of record. Value of com.ibm.zosconnect.spi.Data.SOR_REFERENCE.
784	310	SMF123S1_ SOR_ IDENTIFIER	64	CHAR	System of record identifier. Value of com.ibm.zosconnect.spi.Data.SOR_IDENTIFIER.
848	350	SMF123S1_ SOR_ RESOURCE	128	CHAR	System of record resource. Value of com.ibm.zosconnect.spi.Data.SOR_RESOURCE.
976	3D0	SMF123S1_ REQ_ ID	8	BINARY	Request identifier that is unique within a z/OS Connect EE server instance.
984	3D8	SMF123S1_ TRACKING_ TOKEN	64	BINARY	(HEX) Tracking token. For more information, see Tracking selected requests.
1048	418	SMF123S1_ REQ_ HDR1	64	CHAR	Request header. header1name:header1value
1112	458	SMF123S1_ REQ_ HDR2	64	CHAR	Request header. header2name:header2value
1176	498	SMF123S1_ REQ_ HDR3	64	CHAR	Request header. header3name:header3value
1240	4D8	SMF123S1_ REQ_ HDR4	64	CHAR	Request header. header4name:header4value
1304	518	SMF123S1_ RESP_ HDR1	64	CHAR	Mapped response header. header1name:header1value
1368	558	SMF123S1_ RESP_ HDR2	64	CHAR	Mapped response header. header2name:header2value
1432	598	SMF123S1_ RESP_ HDR3	64	CHAR	Mapped response header. header3name:header3value
1496	5D8	SMF123S1_ RESP_ HDR4	64	CHAR	Mapped response header. header4name:header4value

The table above is based on the description provided by IBM in its "MVS Systems Management Facilities (SMF)" manual.

Spectrum SMF Writer - the 4GL SMF Report Writer.

SMF 123 Record - z/OS Connect EE Audit Interceptor Records V2

This table shows the record layout for type 123 SMF records (Audit Interceptor).

It's easy to report on SMF 123 data!

This table shows the record layout for type 123 SMF records
(Audit Interceptor).