Universal fields
You can specify these fields in the FIELDS parameter of any EVENT or SMF statement.
Name | Tag | Description |
|---|---|---|
CURRENT_TIME | Time | Current date and time formatted in accordance with the TIME statement |
CURRENT_TIME_J | Time | Current date and time formatted in accordance with the TIME statement. This field’s formatting is conditioned on the software switch JSON |
CURRENT_TIME_L | devTime | Current date and time formatted in accordance with the TIME statement. This field’s formatting is conditioned on the software switch LEEF |
Event_SubType | SubT | Event subtype as determined by BMC AMI Datastream This field is generally the same value as SMFXXSTY, but differs for events such as DB2 and SMF 90 that have subtypes in a non-standard location. BMC AMI Datastream assigns a subtype of -1 to events without a defined subtype. |
EVENTCAT | Cat | Event category such as Internal, DS_Output, and Rename |
EventMajor | Major | Major event type-CZAPI1CB for values |
EventOUCBDLYB | OUCBDLYB | Delayed by RTO on out queue |
EventOUCBGOB | OUCBGOB | Transitioning between states |
EventOUCBGOI | OUCBGOI | Transitioning into core |
EventOUCBGOO | OUCBGOO | Being swapped or logically swapped |
EventOUCBLSW | OUCBLSW | Logically swapped |
EventOUCBOFF | OUCBOFF | Requesting enter wait state |
EventOUCBOUT | OUCBOUT | Requesting enter out state |
EventOUCBQFL | OUCBQFL | Flag for state at time of enqueue Bits for above |
EventOUCBQSFL | OUCBQSFL | QSCEFL recursion flag |
EventQueueDepth | QueueDepth | Queue depth at time of enqueue |
EventSMFexit | SMFexit | SMF exit used |
FILTER_TRACE | FilterTrace | See Troubleshooting in section: Filtering Events with FILTER and MATCH |
IEF_EXIT | Exit | Name of the z/OS installation exit or API from which the event record is received: API1, IEFU83, IEFU84, IEFU85 or IEFU86 |
HOST_CPUID (EGNX) | HostCPU | CPU ID (CPU serial number) |
HOST_HOSTNAME | HostName | TCP/IP hostname |
HOST_HOSTNAME_CJ | HostName | TCP/IP hostname This field’s formatting is conditioned on the software switch CEF or JSON. |
HOST_IPV4 | HostIPv4 | Primary IPv4 address of the TCP/IP stack |
HOST_IPV6 | HostIPv6 | Primary IPv6 address of the TCP/IP stack |
HOST_JESNODE | HostJes | JES node name |
HOST_LPARNAME | HostLPAR | LPAR name |
HOST_SAF | SAF | LPAR security subsystem type, expressed as an integer: 0 = None, 1 = RACF, 2 = CA ACF2, 3 = CA Top Secret (TSS) |
HOST_SAFD | SAF | LPAR security subsystem type, expressed as text: None, RACF, ACF2 or TSS |
HOST_SMFID | HostSMFID | SMF ID of the LPAR |
HOST_SYSNAME | HostSysNm | System name (&SYSNAME as defined in the IEASYSxx or IEASYMxx parmlib member) |
Instance_Name | InstNm | Name of the currently running instance For more information, see INSTName under The OPTIONS Statement. |
Instance_Number | Inst# | Number of the currently running instance For more information, see START-command. |
QUEUE_DEPTH_OUT | Q_Out | Number of SMF records in the record queue when this SMF record was selected for formatting Primarily intended for diagnostic purposes. For more information, see Determining-the-QUEUE64-size. |
Queue_Size | QSize | Configured size of the queue in bytes |
SMFXXCAT | cat | Event category such as Internal, DS_Output, Rename Despite the name, SMFXXCAT is a Universal field, not an SMF Common field. |
SMFXXCAT_L | cat | LEEF event category such as Internal, DS_Output, Rename This field’s formatting is conditioned on the software switch LEEF. (Despite the name, SMFXXCAT_L is a Universal field, not an SMF Common field.) |
SYSLOG_FACILITY | Facility | RFC3164 facility expressed as a number from 0 to 23 For more information, see Syslog-facilities-and-severities. |
SYSLOG_FACILITY_D | Facility | RFC3164 facility expressed as a character string For more information, see Syslog-facilities-and-severities. |
SYSLOG_SEVERITY | Severity | RFC3164 severity expressed as a number from 0 to 7 For more information, see Syslog-facilities-and-severities. |
SYSLOG_SEVERITY_D | Severity | RFC3164 severity expressed as a character string For more information, see Syslog-facilities-and-severities. |
SYSLOG_SEVERITY_D_JS | Severity | RFC3164 severity expressed as a character string For more information, see Syslog-facilities-and-severities. This field’s formatting is conditioned on the software switch JSON or Splunk. |
SYSLOG_SEVERITY_L | sev | LEEF severity expressed as an integer from 0 to 10. This field’s formatting is conditioned on the software switch LEEF |
TimeFormat_L | devTimeFormat | Constant MMM dd yyyy HH:mm:ss.SSS z. This field’s formatting is conditioned on the software switch LEEF |
Datastream_Parms | Parms | Member name of current parameter file |
Datastream_SiemType | SiemType | SIEM Type: RFC3164, CEF, Splunk, LEEF, DAM/DAMVISualizer or JSON |
Datastream_Version | Version | BMC AMI Datastream version in format v.r.m |
Related topic