Condition specifications
Condition specifications are optional. They specify the conditions under which a field is valid or is to be formatted. Condition specifications return a value of true or false. The field is formatted only if any specified condition specification returns true.
CAnd
CAnd(condSpecification(…) …)
CAnd returns true only if its subordinate condition specifications all return true.
Operand | Description |
|---|---|
condSpecification(…) … | Two or more valid condition specifications |
CExt
CExt(intType getSpecification(…) [mask] relationshipType value)
CExt returns true if the specified relationship of the data from the current event record to the value specified is true.
Operand | Description | ||||||
|---|---|---|---|---|---|---|---|
intType | Integer type from the table Integer Types except UCharUChar and UNiblUNibl | ||||||
getSpecification(…) | Valid Get specification If the Get specification is repetitive (such as a GTriplet specifying a triplet with more than one occurrence), only the first occurrence is compared. | ||||||
mask | Mask to be logically joined with AND to the data in the record before the comparison The record itself is not modified. If you omit the operand, the data in the record is compared unmodified. | ||||||
relationshipType | Comparison relationship type from the table in General-type-specifiers-for-definition-statements | ||||||
value | Value to which the data in the record is to be compared in one of the following two formats:
|
COr
COr(condSpecification(…) …)
COr returns true if any of its subordinate condition specifications return true.
Operand | Description |
|---|---|
condSpecification(…) … | Two or more valid condition specifications |
CSubTp
CSubTp(relationshipType subtype) or CSubTp(IN|NI subtype ...)
CSubTp returns true if the specified relationship of the subtype of the current event record to the value specified is true. For most SMF record types, the field checked by CSubTp is the true SMF subtype, a 16-bit field at offset 22 (X'16'). For SMF Type 80 records, the subtype is the RACF Event number only (without the qualifier). For ACF2 records, the subtype is the alphabetic subtype at offset 44 (X'2A'). For DB2 SMF records, the subtype is the IFCID number.
Operand | Description | ||||||
|---|---|---|---|---|---|---|---|
relationshipType | Comparison relationship type from the table in General-type-specifiers-for-definition-statements | ||||||
IN|NI | IN and NI (not in) are not case sensitive; you can use upper, lower, or mixed case. You can specify any number of literals, including zero.
| ||||||
subtype | SMF record subtype in one of the following formats:
|
CSubTpByLoc
CSubTpByLoc(getSpecification (…) relationshipType subtype) or CSubTpByLoc(IN|NI subtype ...)
CSubTpByLoc returns true if the specified relationship of the subtype of the current event record to the value specified is true. This condition is useful when the subtype is NOT located at the standard offset 22 (X'16').
Operand | Description | ||||||
|---|---|---|---|---|---|---|---|
getSpecification(…) | Valid Get specification If the Get specification is repetitive (such as a GTriplet specifying a triplet with more than one occurrence), only the first occurrence is compared. | ||||||
relationshipType | Comparison relationship type from the table in General-type-specifiers-for-definition-statements | ||||||
IN|NI | IN and NI (not in) are not case sensitive; you can use upper, lower, or mixed case. You can specify any number of literals, including zero.
| ||||||
subtype | Record subtype in one of the following formats:
|
CSwitch
CSwitch(siemType…)
CSwitch returns true if it matches with the SIEM in effect using OPTIONS SIEMtype(…) statement.
Operand | Description |
|---|---|
siemType | One or more of the following SIEM types:
To suppress the field for a specific SIEM, specify -siemtype |
Related topics