Hi
USS SMF records have some self-defining sections. ICETOOL needs fix offsets,
therefore I use REXX.
Here the SMF recordtype 92 subtype 14 report extract:
vbsbytes= 4
/* ------------ */
process_record:
/* ------------ */
/* SMF Record Type 92 Subtype 14 */
/* Record Header Section */
smf92sid = substr(smf_record,14-vbsbytes+1,4) /* System ID */
smf92wid = substr(smf_record,18-vbsbytes+1,4) /* Subsystem ID */
/* Time field in hundredths of a second format */
/* is the number of seconds after midnight */
s92_tme = c2d(substr(smf_record,6-vbsbytes+1,4))
s92_hh = right(s92_tme % 360000,2,'0') /* integer divide */
s92_hhr = s92_tme // 360000 /* remainder */
s92_mm = right(s92_hhr % 6000,2,'0')
s92_mmr = s92_hhr // 6000
s92_ss = right(s92_mmr // 100,2,'0')
smf92tme = s92_hh!!'.'!!s92_mm!!'.'!!s92_hh
/* Date the record was written in the form 0cyydddF, (where c is */
/* 0 for 19xx and 1 for 20xx, yy is the current year (0-99), ddd is */
/* the current day (1-366), and F is the sign for a packed field). */
s92_dte = c2x(substr(smf_record,10-vbsbytes+1,4))
/* convert julian to standard */
smf92dte = date('S',substr(s92_dte,3,5),'J')
/* Offset to subsys section */
smf92sof = c2d(substr(smf_record,28-vbsbytes+1,4))
/* Offset to ident. section */
smf92iof = c2d(substr(smf_record,36-vbsbytes+1,4))
offset_id = smf92iof - vbsbytes
r = ident_section()
/* Offset to data section */
smf92dof = c2d(substr(smf_record,44-vbsbytes+1,4))
offset_data = smf92dof - vbsbytes
r = data_section()
if r = zero then r = write_record()
return(r)
/* ----------- */
ident_section:
/* ----------- */
/* Identification Section */
smf92jbn = substr(smf_record,offset_id+1,8) /* Jobname */
smf92stm = substr(smf_record,offset_id+16+1,8) /* Stepname */
smf92rud = substr(smf_record,offset_id+32+1,8) /* User ID */
return(r)
/* ---------- */
data_section:
/* ---------- */
/* Subtype 14 */
smf92dfn = substr(smf_record,offset_data+72+1,64) /* delete fn */
return(r)
HTH
If you need the whole part please contact me offline
Albert
-----Ursprüngliche Nachricht-----
Von: IBM Mainframe Discussion List [mailto:[email protected]] Im Auftrag
von sunil mirchandani
Gesendet: Mittwoch, 23. Januar 2013 16:39
An: [email protected]
Betreff: Reg: OMVS deleted files/directories.
Hello Team,
Can any one help to find out who has deleted particular files/directories
under OMVS.
Do we have any command to check or any other way( Any utility/job which
takes SMF data as a input and generate some report to find the user who has
deleted).
Any help much appreciated.
Thanks & Regards:
Sunil Mirchandani
9742433311
"Yesterday I dared to struggle. Today I dare to win"
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
VERLAGSGRUPPE WELTBILD GMBH
Sitz der Gesellschaft: Augsburg
Handelsregister Augsburg HRB 6035
Ust-ID-Nr: DE 127501299
Geschäftsführung:
Carel Halff (Vorsitzender), Dr. Martin Beer
Vorsitzender des Aufsichtsrats:
Generalvikar DDr. Peter Beer
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
