IBM Security Z Security

 View Only
Expand all | Collapse all

get EXCP-Cnt field in SMF 14

  • 1.  get EXCP-Cnt field in SMF 14

    Posted Tue February 01, 2022 03:58 PM
    Hi All
    i got request today that the database group notice that the field EXCP-Cnt for the broker address space is counting to much and they want to know which modules being loaded, datasets been referenced, so i tried to generate a report like

    s type=14
    sortlist DATASET MEMBER PROGRAM JOBNAME STEPNAME

    but i cant find any filed for EXCP-Cnt , it should be SMF14EXCP in smf 14 i tried to use smf_section and use 45 or 46 as offset but no luck
    so can you please advise how i can get EXCP-Cnt
    also should i use type 14 only or i should consider other types

    thanks





    ------------------------------
    Mohammed Ibrahem
    ------------------------------


  • 2.  RE: get EXCP-Cnt field in SMF 14

    Posted Wed February 02, 2022 04:39 AM
    Edited by Jeroen Tiggelman Wed February 02, 2022 04:39 AM

    Hi Mohammed,

    The SMF_SECTION function works on "standard triples" for data with variable offsets, as documented in the book.

    Unfortunately, SMF 14 has data at variable offsets but uses a different mechanism to describe their location, so this function cannot be used.

    SMF 14 starts with a fixed data section, then has one DCB/DEB section (size is in SMF14SDC, which is a byte at offset 44), and then has a variable number of UCB sections (size in SMF14SUC at offset 46 and number in SMF14NUC at offset 45).

    The best we can do to extract data from there with current CARLa, is to assume that the size in SMF14SDC is a constant, and so the first UCB section starts at a fixed offset 272. The EXCP count is at offset 16 within the UCB section. So then the first EXCP count is at offset 288, and you could use SMF_FIELD to address that.

    If you actually have multiple possible values in SMF14SDC, then you could code multiple newlists selecting on the value in that field and using the appropriate offset to address the data there. (And potentially generate a single report from them with MERGELIST.)

    If you also want to look at a second UCB section, you could use a DEFINE with a WHERE clause to check that SMF14NUC is greater than 1 [making the result missing otherwise] and then reading out the next value (assuming a fixed size of the UCB sections--which you could address with splitting queries in a similar fashion as above if that is worth it.)

    I hope this begins to help.

    Regards,



    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------