Well, if it is truly MXG/SAS code then there should be a source lib that contains all the different layouts for the SMF records. I would look for a hlq.MXG.SOURCLIB library.
Paul -----Original Message----- From: IBM Mainframe Discussion List <[email protected]> On Behalf Of Grace Godfrey Sent: Wednesday, November 13, 2024 11:18 AM To: [email protected] Subject: MXG, question from new programmer Hi, Does anyone know if MXG ships a map of the field names from SMF 80? Is it available on the web? Backstory A SAS program written long ago reads SMF and writes records to a flat file. The flat file is loaded into Splunk (log lookup tool). The raw SMF 80 record has two dates - the date the SMF record was written, and the date a program entered the system. In this case, the program is the ACS STC whose start date/time predates the SMF record. The SAS program reads SMF 80 to write the flat file, and instead of using the date the SMF record was written, it's using the 2nd date - the ACS STC start date/time, which of course precedes the date the RACF activity took place by many hours/days. This will/is drawing questions from our audit review team as the date in Splunk for the RACF activity does not reflect the date it happened, but instead is several days prior. I've tracked the problem back to SAS code, and see field names for the extract file. I don't have the program where the SMF 80 record is parsed, but suspect it's in MXG shipped assembled code: <hlq>.MXG.FORMATS. I'm trying to figure out if MXG assigned names to the fields in the SMF records, and if so, where can I find the complete list so I can change the SAS program to select the accurate date. Also, if anyone happens to know, is there a 'MXG SAS 101' class? :) Thank you so much! Grace ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
