Audit SMF Record Format

Audit SMF records are identified by subtype X'0001' in the SMF header.

This section contains the following topics:

Audit SMF Record Structure

Audit SMF Record Guidelines

SMF Record Identifier (Subtyped)

Self-Defining Section

Audit SMF Record Structure

The Audit SMF record structure is based on the dynamic structure of IBM record 119 or 80. This flexible design provides room for expansion. Each section besides the first one can be repeated many times, up to the maximum length of the SMF record, which is set at 32756 bytes.

The following table lists the fields in this record:

Name	Length (bytes)	Description
Standard header	24	SMF system header.
Self-defining section	36	This section contains information about the number of sections that follow, and their location in the record.
Region section	72	This section contains information about the NetMaster or SOLVE products that produced the record. It is present in any record produced.
Object section	vv	This section contains information about the object of the manipulation described in the User section.
User section	18	This section contains information about the user of the object described. User names can be either the user ID of the operator of the resource, or the name of the system or subsystem performing the automatic action.
Event section	vv	This section contains information about the action performed on the previously described object.

Audit SMF Record Guidelines

Adhere to the following guidelines when using audit SMF records:

SMF record subtypes are treated as binary halfwords.
Variable length fields are always preceded by a 2-byte length indicator.
Fixed length text (EBCDIC) fields are initialized with blanks (x'40').
Other fixed length fields are initialized with nulls (x'00').

SMF Record Identifier (Subtyped)

The SMF record identifier (number) is in the range of 128-255 and is defined during installation. Use Customizer parameter group INTERFACES/SMF to define this number.

More information:

How to Obtain User SMF Record Types

Self-Defining Section

The following table lists the fields in this section of the record:

Offset		Name	Length (bytes)	Format	Description

Dec	Hex		Length (bytes)
00	00	TRIPLNUM	2	BINARY	Number of triplets in this record
02	02	RECLEVEL	2	BINARY	Record generation level, currently 1
04	04	REGNOFF	4	BINARY	Offset to Region section
08	08	REGNLEN	2	BINARY	Binary Length of Region section (always '48'x)
10	0A	REGNNUM	2	BINARY	Number of Region sections (always '1'x)
12	0C	OBJOFF	4	BINARY	Offset to Object identification section
16	10	OBJLEN	2	BINARY	Binary Length of Object section
18	12	OBJNUM	2	BINARY	Number of Object sections (always '1'x)
20	14	USEROFF	4	BINARY	Offset to User section
24	18	USERLEN	2	BINARY	Binary Length of User section (always '12'x)
26	1A	USERNUM	2	BINARY	Number of User sections (always '1'x)
28	1C	EVNTOFF	4	BINARY	Offset to Event section
32	20	EVNTLEN	2	BINARY	Binary Length of Event section
34	22	EVNTNUM	2	BINARY	Number of Event sections (always '1'x)

Region Section

The following table lists the fields in this section of the record:

Offset		Name	Length (bytes)	Format	Description

Dec	Hex		Length (bytes)
00	00	DL	6	EBCDIC	Delivery level, (DDDDSS, '060200')
06	06	PLEXID	8	EBCDIC	Sysplex name
14	0E	SYSNAME	8	EBCDIC	System name
22	16	NETID	8	EBCDIC	VTAM network identifier
30	1E	DMNAME	4	EBCDIC	Product region domain name
34	22	ACBNAME	8	EBCDIC	Product region ACB Name
42	2A	LPARNAME	8	EBCDIC	Product region LPAR name
50	32	JOBID	8	EBCDIC	Product Region job identifier, such as STC15097
58	3A	JOBNAME	8	EBCDIC	Product Region Jobname, such as DENM10
66	42	NUMBER	4	BINARY	Reserved
70	46	ASID	2	BINARY	Product Region ASID number

Object Section

The following table lists the fields in this section of the record:

Offset		Name	Length (bytes)	Format	Description

Dec	Hex		Length (bytes)
00	00	LOCATION	8	EBCDIC	Object location
08	08	CLASS	8	EBCDIC	Object class
16	10	NAMELEN	2	BINARY	Length of object name
18	12	NAME	vv	EBCDIC	Object name
vv		TEXTLEN	2	BINARY	Length of object text
vv		TEXT	vv	EBCDIC	Object text

Note: For information about audited objects, see the online help for the AUDIT parameter group.

User Section

The following table lists the fields in this section of the record:

Offset		Name	Length (bytes)	Format	Description

Dec	Hex		Length (bytes)
00	00	LOCATION	8	EBCDIC	User location
08	08	TYPE	2	BINARY	User type
10	0A	NAME	8	EBCDIC	User name

User Types

The following table lists the user types in the audit SMF record:

Number		Type

Dec	Hex
00	0000	Reserved, do not use
01	0001	NMAOMP
02	0002	NMBLOG
03	0003	NMBMON
04	0004	NMBSVR
05	0005	NMBSYS
06	0006	NMCNMP
07	0007	NMLOGP
08	0008	NMOPER
09	0009	NMPPOP
10	000A	NMUSER
11	000B	SOLVAOMP
12	000C	SOLVBLOG
13	000D	SOLVBMON
14	000E	SOLVBSVR
15	000F	SOLVBSYS
16	0010	SOLVCNMP
17	0011	SOLVLOGP
18	0012	SOLVOPER
19	0013	SOLVPPOP
20	0014	SOLVUSER

Event Section

The following table lists the fields in this section of the record:

Offset		Name	Length (bytes)	Format	Description

Dec	Hex		Length (bytes)
00	00	EVNTTYPE	2	BINARY	Event type
02	02	DATE	8	EBCDIC	UTC date of the event, YYYYMMDD
10	0A	TIME	11	EBCDIC	UTC time of the event, HH:MM:SS:hh
21	15	PERIOD	2	BINARY	Period in minutes
23	17	ACTION	2	BINARY	Action types
25	19	VALUE	8	BINARY	Value of the action, such as number of suppressions
33	21	TXTLEN	2	BINARY	Length of the action text
35	23	TEXT	vv	EBCDIC	Text of action performed, such as command text

Event Types

The following table lists the event type numbers in decimal and hexadecimal:

Number		Descriptions

Dec	Hex	Descriptions
0	0000	Reserved, do not use
1	0001	Access
2	0002	Application
3	0003	Configuration
4	0004	Procedural
5	0005	Serviceability
6	0006	Utilization

Action Types

The following table lists the action type numbers in decimal and hexadecimal:

Number		Type

Dec	Hex	Type
0	0000	Reserved, do not use
1	0001	Action
2	0002	Add
3	0003	Update
4	0004	Delete
5	0005	Command
6	0006	Suppress
7	0007	Enhance
8	0008	State change
9	0009	Load
10	000A	Start
11	000B	Stop
12	000C	Close
13	000D	Reset
14	000E	Modify
15	000F	Reply
16	0010	Issue
17	0011	Trigger
18	0012	Create
19	0013	Set
20	0014	Compile
21	0015	Execute
22–34	0016–0022	Reserved
35	0023	Read
36	0024	Rename
37	0025	Print
38	0026	Submit
39–4095	0027–0FFF	Reserved
4096–65534	1000–FFFE	User-defined
65535	FFFF	User actions not defined

More information:

Define User Actions

Tell Technical Publications how we can improve this information