Get specifications

GetDSNSpec(...)

Location of the data set name in the record

Specify any valid Get specification except GNull. The data must either be 44 bytes (or more) long, left-justified, and blank-padded, or GetDSNSpec must be able to return the exact data set name length.

GetVolserSpec(...)

(Optional) Location of the volume serial in the record

Specify any valid Get specification except GNull. The data is assumed to be 6-bytes long.

If you omit the operand, then GApf returns X'80' if any APF-authorized data set with a matching name is found.

countFormat

Format of the count of elements in the array

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for GConst, specify LongLong).

GetCountSpec(...)

Location of the count of elements in the record

Specify any valid Get specification except GNull (including GConst, if appropriate).

GetFirstElementSpec(...)

Location of the first element of the array in the record

Specify any valid Get specification except GNull.

displacement

Displacement of the field in each array element relative to zero

length

Length of each element of the array

Specify a positive integer from 1 to 32767.

displacement

Displacement of the value relative to zero and including the record control word (llbb)

Offset 5, for instance, is the SMF record type field. This is the offset usually given in SMF record documentation and assembly listings.

length

Length of the value

If you omit the operand, the default length is the remainder of the record that is beyond the displacement specified.

type

PERFormance, EXCEPT, or RESource, indicating the type of data record

Do not use PERFormance; instead, use the GCICSmonPerf specification.

displacement

Displacement, base zero, of the field in the data record

length

Length of the value

fieldName

offset

Offset, in the range from -32,767 to +32,767, of the data relative to the named field

If you omit the operand, the default value is zero.

offsetOfTriplet

Offset of the pointer triplet in the current performance data record

displacement

Displacement, base zero, of the field in the section

length

Length of the value

type

FILE, TSQueue, or DPL, indicating the type of section

displacement

Displacement, base zero, of the field in the section

length

Length of the value

FormatLeft

Format of the left-hand operand

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for the result of GConst or GCompute, specify LongLong). 

GetLeft(…)

Location of the left-hand operand

Specify any valid Get specification except GNull.

operation

Arithmetic operation to be performed

For example, the minus sign ( - ) specifies that the right-hand operand is to be subtracted from the left-hand operand.

Specify any of the operators from the Arithmetic operator types table.

FormatRight

Format of the right-hand operand

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for the result of GConst or GCompute, use LongLong).

GetRight(…)

Location of the right-hand operand

Specify any valid Get specification except GNull.

countFormat

Format of the count of elements in the array

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for GConst, specify LongLong).

GetCountSpec(...)

Location of the count of elements in the record

Specify any valid Get specification (including GConst, if appropriate) except GNull.

lengthFormat

Format of the length of each element in the array

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for GConst, specify LongLong).

GetLengthSpec(...)

Location of the length of elements in the record

Specify any valid Get specification (including GConst, if appropriate) except GNull.

offsetFormat

Format of the offset to the first element in the array

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for GConst, specify LongLong).

GetOffsetSpec(...)

Location of the offset to the first element in the array in the record

Specify any valid Get specification (including GConst, if appropriate) except GNull.

displacement

Displacement of the field in each array element relative to zero

condFormat

Format of the conditional of elements in the array

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl (for GConst, specify LongLong).

condDisplacement

Offset of the field to be checked in each array element

The offset is relative to the start of the current array element.

value

Value to which the data in the record is to be compared, in one of the following formats:

secIDNumber

Section identification number

The number is indicated in SMF22ETY for ACTIVATE command record (SMF22IND=09) and at displacement 1, base zero for all others. Valid values are from 1 to 12.

displacement

Displacement, base zero, of the field in the section

integer

Constant integer to be returned

Code an integer between the minimum and the maximum 64-bit signed integer, approximately +/- 18 * 10¹⁸.

charString

0- to 32 characters enclosed in quotation marks

divisor

CPU time divisor

For example, specifying 1 causes GCPUtime to return the CPU time in microseconds. Specifying 1000 causes GCPUtime to return the CPU time in milliseconds.

headerType

Type number of a DB2 header such as 1, 2, 4, 8, 16, or 32

displacement

Displacement, base zero, of the field in the specified header

length

Length of the data field

If you omit the operand, GDB2hdr returns the length from displacement to the end of the header. If you specify length and displacement plus length is greater than the length of the header, then the field is treated as not addressable.

sectionType

SMF 14/15 Extended Information Segment section type, which is a number from 1 to 9:

1 COMPRESSED FORMAT D/S
2 SMS CLASS INFORMATION
3 STEP INFORMATION
4 ANSI VERSION 4 CCSID
5 ADDTIONAL DATA SET CHARACTERISTICS
6 PDSE STATISTICS
7 KEK LABEL DATA FOR TAPE HARDWARE ENCRYPTION
8 RAS
9 DASD Data Set Encryption

displacement

Offset within the Extended Information Segment

This offset must include the offset for the 4-byte segment prefix. The first field in the segment begins at offset 4.

length

Length of the fixed-length SMF 14/15 field

displacement

Displacement, base zero, of the field in the address returned by the FFlist field’s Get specification

length

Length of the field

CondSpecification(…)

Name of a Condition specification, and the parameters for that Condition specification

The Condition specification specifies a condition to be tested to determine which of the two Get specifications to invoke.

GetSpecificationA(…)

GetSpecificationB(…)

Names of two Get specifications and the parameters for those Get specifications

The first Get specification specifies where the field data is to be located if the condition is true. The second Get specification specifies where the field data is to be located if the condition is false.

GetSpecification(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location and length of the data, assuming an index of zero.

intFmt

Format of the index

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl.

GetSpecificationIndex(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location and length of the index.

intFmtN

Format of the next index

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl.

GetSpecificationIndexn(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location and length of the next index.

Event_SubType

HOST_CPUID

CPU ID (CPU serial number) as 12 printable characters

HOST_HOSTNAME

TCP/IP hostname as a character field of unknown length, suitable for formatting with FCstring

HOST_IPV4

Primary IPv4 address of the TCP/IP stack as a character field of unknown length, suitable for formatting with FCstring

HOST_IPV6

Primary IPv6 address of the TCP/IP stack of unknown length, suitable for formatting with FCstring

HOST_JESNODE

JES node name as a character field of eight characters

HOST_LPARNAME

LPAR name as a character field of eight characters

HOST_SAF

LPAR security subsystem type, expressed as an integer suitable for formatting with FInt(UChar): 0 = None, 1 = RACF, 2 = CA ACF2, 3 = CA Top Secret (TSS)

HOST_SAFD

LPAR security subsystem type, expressed as text of unknown length, suitable for formatting with FCstring: None, RACF, ACF2, or TSS

HOST_SMFID

SMF ID of the LPAR as a character field of four characters.

HOST_SYSNAME

System name (&SYSNAME as defined in the IEASYSxx or IEASYMxx parmlib member) as a character field of eight characters

IEF_EXIT

Name of the z/OS installation exit or API from which the event record was received: API1, IEFU83, IEFU84, IEFU85, or IEFU86, as a character field of unknown length, suitable for formatting with FCstring

SYSLOG_FACILITY

RFC3164 facility expressed as a number from 0 to 23, suitable for formatting with FInt(Long)For more information, see Syslog-facilities-and-severities.

SYSLOG_FACILITY_D

RFC3164 facility expressed as a character string of unknown length, suitable for formatting with FInt(Long)For more information, see Syslog-facilities-and-severities.

SYSLOG_SEVERITY

RFC3164 severity expressed as a number from 0 to 7, suitable for formatting with FInt(Long)For more information, see Syslog-facilities-and-severities.

SYSLOG_SEVERITY_D

RFC3164 severity expressed as a character stringFor more information, see Syslog-facilities-and-severities.

zDefender_Parms

Member name of current parameter file, expressed as a character field of unknown length, suitable for formatting with FCstring

zDefender_SiemType

SIEM Type: RFC3164, CEF, Splunk, LEEF, DAM/DAMVISualizer, or JSON, expressed as a character field of unknown length, suitable for formatting with FCstring

ZDefender_Version

GetSpecification(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies where the IP address data in character form is located.

typeNumber

Specifies the entry type number as follows:

8: Descriptor section
7: Events section
6: Actuals section
5: JES2 network section
4: JES2 routing section
3: Print section
1: Triplet section

displacement

Displacement, base zero, of the field in the section

recordNumber

Specifies the entry record number as follows:

X’00’ = Startup record
X’01’ = Shutdown record
X’02’ = Entry validation record
X’E0’ = CL/SuperSession user logon
X’E1’ = CL/SuperSession user logoff
X’E2’ = CL/SuperSession terminal logon
X’E3’ = CL/SuperSession terminal logoff
X’F0’ = CL/SuperSession logon
X’F1’ = CL/SuperSession logoff
X’F3’ = Gateway limit reached
X’F4’ = CL/SuperSession SINGLE start
X’F5’ = CL/SuperSession SINGLE stop
X’C0’ = Super Session user record layout

displacement

Displacement, base zero, of the field in the section

firstOuterTripletDisplacement

Offset to the first triplet in the table of triplets

The offset is relative to the start of the event record (RDW).

outerTripletCountDisplacement

Offset to the event record field that contains the number of triplets

This must be the offset to a fullword data element. This offset is relative to the start of the event record (RDW).

firstInnerTripletDisplacement

Offset to the first subordinate (or inner) triplet in a table of triplets

The offset is relative to the data section pointed to by the outer triplet.

innerTripletCountDisplacement

Offset to the event record field that contains the number of triplets

This must be the offset to a fullword data element. This offset is relative to the data section pointed to by the outer triplet.

dataFieldDisplacement

Offset from the inner data section, pointed to by the inner triplet to the data element being selected

outerTripletCountAdjustment

Outer triplet count within the event record, which can include other triplets within the record

You can use this is a numeric count field to deduct from the total number of triplets store in the record (pointed to by outerTripletCountDisplacement).

GetSpecification(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location of the Event record segment containing the pointer, length, and data.

displacement

Offset of the displacement pointer from the address returned by the Get specification, base 0

lengthAdjustment

Adjustment to be made to the length value in the record

For example, some length values include their own size, so a length_adjustment of -2 would be appropriate.

offsetOfPointer

Offset, base zero, into the base of an Event record, of a 16-bit displacement to the structure containing the field value

offsetOfData

Offset, base zero, of the data value into the structure pointed to by the displacement value

length

Length of the field

If you omit the operand, you must have a format type that indicates the length. For information about format types, see Format-specifications.

offsetOfPointer

Offset, base zero, into the base of an Event record, of an 8-bit displacement to the structure containing the field value

offsetOfData

Offset, base zero, of the data value into the structure pointed to by the displacement value

length

Length of the field

If you omit the operand, you must have a format type that indicates the length. For information about format types, see Format-specifications.

displacement

Displacement of the value relative to zero and including the record control word (llbb)

length

Length of the value

‘ ’

Not a privileged userBecause the value is blank, it is normally suppresses and is not transmitted (assuming OPTions FORMAT(ERGO)

‘E’

Escalated privilegesThis user ID was last seen as unprivileged or with lesser privileges, but has now escalated privileges.

‘K’

Known privileged userThis user ID has been seen before, and the last time it was seen, it had the same privileges as now.

‘P’

typeNumber

Relocate section type number

You can specify a nonextended-length relocate section (type numbers less than 256) or an extended-length relocate section (type numbers 256 and above).

Specify a number from 1 to 999. (As of RACF V2R1, the maximum IBM-defined Extended Relocate type is 429.)

displacement

Displacement, base zero, of the field in the relocate section

GetSpecification(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location of the first element of the repeating data.

lengthEach

Length of each field or set of fields in the series of repetitions

maxCount

Maximum number of repetitions per section

Specify a number from 1 to 65535.

If you omit the operand, the default value is unlimited, and the number of fields or sets of fields is limited only by the length of the containing section.

offsetOfTriplet

Offset of the pointer triplet in the base of the Event record

Specify a number in Signed Extended Numeric Format between the minimum and maximum permitted triplet offsets for the event (for more information, see TYPE-and-RETYPE-statements). Either offset_of_triplet or GetSpecTriplet(…) is required.

GetSpecTriplet()

Specify a Get specification for the location of the triplet

Specify any valid Get specification except GNull. Any length returned by the Get specification is ignored; a triplet length of 8 is assumed. Either offset_of_triplet or GetSpecTriplet(…) is required

displacement

Displacement, base zero, of the field in the section

OCCURrence(occurrence)

Specifies that GTriplet is to return only a single specified occurrence of the triplet record sections

Specify an occurrence number from 1 to 32767 inclusive. If the specified number is greater than the number of occurrences indicated by the triplet in the record, then GTriplet returns not present for the field.

If you omit the operand, then all occurrences are returned in succession.

offsetOfTriplet

Offset of the pointer triplet in the base of the Event record

GetSpecTriplet()

Specify a Get specification for the location of the triplet

Specify any valid Get specification except GNull. Any length returned by the Get specification is ignored; a triplet length of 8 is assumed. Either offset_of_triplet or GetSpecTriplet(…) is required.

displacement

Displacement, base zero, of the first field of the array in the section

offsetOfTriplet

Offset of the pointer triplet in the base of the Event record

displacement

Displacement, base zero, of the field in the section

length

Length of the field

If you omit the operand, you must have a format type that indicates the length. For information about format types, see Format-specifications.

If you specify the length only as a placeholder for length_adjust, then specify 32767.

lengthAdjust

Specify any adjustment to be made to the length value in the record for Db2 variable-length segments where the length in the triplet is zero

For example, some length values include their own size, so a length_adjustment of -2 would be appropriate.

If you omit the operand, the default value is zero, meaning that the length in the length value is the exact length of the data without the length field.

firstTripletDisplacement

Offset to the first triplet in the table of triplets

The offset is relative to the start of the event record (RDW).

tripletCountDisplacement

Offset to the event record field that contains the number of triplets

This must be the offset to a fullword data element. The offset is relative to the start of the event record (RDW).

dataFieldDisplacement

Offset from the inner data section, pointed to by the triplet to the data element being selected

tripletCountAdjustment

Triplet count within the event record can include other triplets within the record

This is a numeric count field that can be used to deduct from the total number of triplets stored in the record (pointed to by tripletCountDisplacement).

offsetOfTriplet

Offset of the pointer triplet in the base of the Event record

displacementOfLength

Displacement, base zero, of the length halfword in the section

displacementOfField

Displacement, base zero, of the field in the section

lengthAdjustment

An adjustment to be applied to the length to obtain the actual length of the field

If you omit the operand, the length in the Event record is used directly as the length of the field.

GetSection(…)

Name of a Get specification and the parameters for that Get specification

The Get specification specifies the location of the Event record segment containing the length and data fields. GetSection would typically be GBase or GTripletDB2.

displacementOfFixed

Displacement, base zero, of the fixed-length field

length

Length of the fixed-length field

displacementOfPointer

Displacement, base zero, of a 16-bit pointer containing the offset from the base of the section to the variable-length field

Displacement is assumed to begin with a 16-bit length field preceding the actual data.

GetUserId(...)

Location of the user ID in the record

Specify any valid Get specification except GNull.

FieldNum

Specify any value from 1 to 3

1 = Terminal ID

2 = User ID

3 = Group ID

GetTokenArea(...)

Location of the user token in the record

Specify any valid Get specification except GNull.

GetSpecificationOffset(…)

Name of a Get specification that specifies the offset or location of the data field and the parameters for that Get specification

intFmt

Format of the index

Specify any integer type from the Integer types table except UCharUChar and UNiblUNibl.

GetSpecificationLength(…)

Name of a Get specification that specifies the offset or location of the explicit length field and the parameters for that Get specification

lengthAdjustment

Adjustment to be applied to the length to obtain the actual length of the field

If you omit the operand, the length in the Event record is used directly as the length of the field.