I've created an FTP client report in comma-delimited format from SMF 118s (yes,
I know they should be capturing 119s but they aren't yet, and this isn't about
that).
To make the IP address readable, I used an edit on each byte of the address and
the SQZ function to put them back together. However, to do this I had to do
the edit on an INREC statement, and then treat the four edited fields as one on
an OUTFIL statement. Here are the control statements, sorry for the length but
it's more readable this way:
===============================================
OPTION VLSHRT,VLSCMP
INCLUDE COND=(6,1,BI,EQ,118,
AND,23,2,BI,EQ,3)
INREC FIELDS=(1,24,
37,1,BI,M10,LENGTH=4,
38,1,BI,M10,LENGTH=4,
39,1,BI,M10,LENGTH=4,
40,1,BI,M10,LENGTH=4,
189,8,
25,4,
49,8,
X'00000001')
SORT FIELDS=(25,16,CH,A,41,8,CH,A,49,4,CH,A,53,8,CH,A)
SUM FIELDS=(61,4,BI)
OUTFIL FNAMES=REPORT,
REMOVECC,
HEADER1=(C'IP,Local ID,Command,Remote ID,Count'),
BUILD=(1,4,
25,16,SQZ=(SHIFT=LEFT,MID=C'.'),
C',',
41,8,
C',',
49,4,
C',',
53,8,
C',',
61,4,BI,M10,LENGTH=6)
=====================================================
Given that this could have as input millions of records depending upon how long
you want to summarize, I'd like to be able to use the 4-byte IP address in the
sort, and _then_ make it readable. Is there a way for SQZ to work on a group
of fields? I'm envisioning something like this where the grouping of fields in
parenthesis before the SQZ function means sort does those actions, then applies
SQZ to the entire result...
===============================================
OPTION VLSHRT,VLSCMP
INCLUDE COND=(6,1,BI,EQ,118,
AND,23,2,BI,EQ,3)
INREC FIELDS=(1,24,
37,4,
189,8,
25,4,
49,8,
X'00000001')
SORT FIELDS=(25,4,CH,A,29,8,CH,A,37,4,CH,A,41,8,CH,A)
SUM FIELDS=(49,4,BI)
OUTFIL FNAMES=REPORT,
REMOVECC,
HEADER1=(C'IP,Local ID,Command,Remote ID,Count'),
BUILD=(1,4,
(25,1,BI,M10,LENGTH=4,26,1,BI,M10,LENGTH=4,27,1,BI,M10,LENGTH=4,28,1,BI,M10,LENGTH=4),SQZ=(SHIFT=LEFT,MID=C'.'),
C',',
29,8,
C',',
37,4,
C',',
41,8,
C',',
49,4,BI,M10,LENGTH=6)
=====================================================
Seems like it would be a performance improvement for this use case anyway...
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
