Inside an SMF record
Every SMF record starts with a standard header: its length, its type, the time and date it was written and the system that wrote it, and usually a subtype. After the header, most records are made of sections, found through triplets that give each section's offset, length and count.
The header
| Field | What it holds |
|---|---|
| Record descriptor word | The record length (SMF records are variable length) |
| Record type | One byte: 30, 80, 110 and so on |
| Time | Time the record was moved to the SMF buffer, in hundredths of a second since midnight |
| Date | Packed decimal 0cyydddF: century flag, year and day of the year |
| System ID | The system (SID) that wrote it, such as MPS1 |
| Subsystem ID and subtype | In most records: which product and which variant, such as type 30 subtype 5 |
Sections and triplets
After the header, many records contain several sections (for example, in type 30: identification, processor accounting, I/O activity). A section can appear any number of times. The header area holds a triplet for each kind of section: its offset from the start of the record, its length, and the number of times it occurs. Programs use the triplets, never fixed positions, so they keep working when IBM adds fields.
Reading records in practice
- Reporting products such as RMF Postprocessor, IBM Z Performance and Capacity Analytics, and SAS-based tools such as MXG turn records into tables and reports.
- Programs in Assembler, COBOL, REXX or Python read the records using the documented layouts.
- Product tools format their own records, such as the Db2 and CICS reporting utilities.
Linking records together
A question often needs more than one type. Records written by the same job share its job name and the job's reader start date and time in their identification fields, so a type 17 delete can be linked to the type 30 records of the job that ran it.
In an SMF record, what three values does a triplet give for a section? (comma separated)
Show a hint
Where it is, how long it is, how many.
Show the solution
Offset, length and number of occurrences.
Common mistakes
Use the triplets to find each section; layouts grow over time.
The header time is when the record was written. Some records, such as type 30, also hold start and end times inside.
The header date is packed 0cyydddF, a Julian day, not month and day.
What you will see at work
- Performance analysts often write small programs or REXX execs to pull one field out of millions of records.
- Mainframe Path's Lab shows packed decimal bytes in its HEX view; the same skill reads SMF dates.
- When a product adds fields in a new release, programs that use triplets keep working.
Key terms
Check your understanding.
Take this lesson's quiz and save your progress. Free.