Hopefully Barry will respond to you
Sent from my iPhone No one said I could type with one thumb > On Nov 13, 2024, at 11:17, Grace Godfrey > <[email protected]> wrote: > > Hi, > > Does anyone know if MXG ships a map of the field names from SMF 80? Is it > available on the web? > > Backstory > A SAS program written long ago reads SMF and writes records to a flat file. > The flat file is loaded into Splunk (log lookup tool). > > The raw SMF 80 record has two dates - the date the SMF record was written, > and the date a program entered the system. In this case, the program is > the ACS STC whose start date/time predates the SMF record. > > The SAS program reads SMF 80 to write the flat file, and instead of using > the date the SMF record was written, it's using the 2nd date - the ACS STC > start date/time, which of course precedes the date the RACF activity took > place by many hours/days. > > This will/is drawing questions from our audit review team as the date in > Splunk > for the RACF activity does not reflect the date it happened, but instead is > several > days prior. > > I've tracked the problem back to SAS code, and see field names for the extract > file. I don't have the program where the SMF 80 record is parsed, but suspect > it's in MXG shipped assembled code: <hlq>.MXG.FORMATS. > > I'm trying to figure out if MXG assigned names to the fields in the SMF > records, > and if so, where can I find the complete list so I can change the SAS program > to > select the accurate date. > > Also, if anyone happens to know, is there a 'MXG SAS 101' class? :) Thank > you so much! > > Grace > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
