EVENT IND$FILE fields

SMF202CAT

(EGNX)

Cat

cat

CEF category; not displayed for non-CEF

SMF202DTETME

Timestamp

rt

The SMF record timestamp formatted in accordance with the TIME statement

This field is equivalent to SMFXXDTETME, that is not available for non-SMF events.

SMF202DTETME_L

devTime

The SMF record timestamp formatted in accordance with the TIME statement

This field is intended primarily for use with SIEMtype(LEEf), and is equivalent to SMFXXDTETME_L, that is not available for non-SMF events.

SMF202FN_FNlen

(Integer)

SMF202FN_FNlen

Length of filename

SMF202FN_Member

(EGNX)

Mem

fname

Member name, else zeros

SMF202FN_Name

(EGNX)

DSN

filePath

Data set name

SMF202FN_Name_APF

(Boolean)

APF

APF authorization status of the data set name

For more information, see SMF record enrichment. 

SMF202FN_Name_Encryp

(Boolean)

ENCRYPT

System library status enrichment

SMF202FN_Name_SAFlib

(Boolean)

SAFDSN

SAF data set status enrichment

SMF202FN_Name_Syslib

(Boolean)

SYSLIB

Encryption data set status enrichment

SMF202FN_Type

(Mapped Integer)

Type

fileType

Type of file name

SMF202ID_Build

(EGNX)

SMF202ID_Build

Build number of above in numeric EBCDIC

SMF202ID_CharS

(EGNX)

CharSet

Character Set

SMF202ID_CodePg

(EGNX)

CodePage

Code Page

SMF202ID_Comp

(EGNX)

SMF202ID_Comp

Component that wrote this SMF record. At this time this field will always be recorded as C'CZAWSMFT'

SMF202ID_CVTTZ

(Integer)

CVTTZ

Local time offset from CVTTZ. CVTTZ is the difference between local time and UTC (Coordinated Universal Time) in binary units of 1.048576 seconds.

SMF202ID_ExecSt

RdrTime

rt

Job or session start in TOD format

SMF202ID_Group

(EGNX)

Group

spriv

Group name

SMF202ID_IPv6

RemtIP

c6a2

IPv6 or IPv6-formatted IPv4 Address

SMF202ID_IPv6_L

src

IPv6 or IPv6-formatted IPv4 Address

SMF202ID_IPv6_V4

RemtIP

src

IPv6 or IPv6-formatted IPv4 Address

SMF202ID_JobID

(EGNX)

JobID

JES job number

The first character of SMF202_JobID might be used to determine the type of work: J=JOB, S=STC, T=TSO

SMF202ID_JobNm

(EGNX)

JobNm

sproc

Job, STC or TSO session name

SMF202ID_NetID

(EGNX)

NetID

Network ID

SMF202ID_Port

(Integer)

RemtPort

spt

Port number

SMF202ID_Port_L

(Integer)

srcPort

Port number

SMF202ID_ProcSt

(EGNX)

ProcStep

cs4

Cataloged procedure step name

SMF202ID_RUTKN

SMF202ID_RUTKN

RACF User Token (RUTKN)

SMF202ID_StepNm

(EGNX)

Step

cs3

Job step name

SMF202ID_Term

(EGNX)

TermNm

shost

Terminal name

SMF202ID_TOKGRUP

(EGNX)

SMF202ID_TOKGRUP

Token group 

SMF202ID_TOKPOE

(EGNX)

POE

User information of the caller of IND$FILE: Port of entry(CONS ID,TERM ID-first half of IP value for SERVAUTH)

SMF202ID_TOKPOEX

(Integer)

POEclass

Port of entry class, expressed as an integer: 1 Terminal, 2 Console, 3 JESinput, 4 APPCport, 5 ServAuth

SMF202ID_TOKPOEXD

(Mapped Integer)

POEclass

Port of entry class, expressed as a text string: Terminal, Console

SMF202ID_TOKSTYP

(Integer)

SessType

Session type, expressed as an integer: 1 System Address Space, 2 Command, 3 Console Operator, 4 Started Procedure, 5 Mount, 6 TSO Logon, 7 Internal Reader Batch Job, 8 Internal Reader Execution Batch Monitor, 9 RJE Operator, 10 NJE Operator, 11 VERIFYX Unknown User ID token, 12 External Reader Batch Job, 13 RJE Batch Job, 14 NJE Batch Job, 15 NJE SYSOUT, 16 External XBM, 17 RJE XBM, 18 NJE XBM, 19 APPC Session, 20 OMVSSRV Session, 21 IP Session

SMF202ID_TOKSTYPD

(Mapped Integer)

SessType

Session type, expressed as a text string: System Address Space, Command, Console Operator

SMF202ID_TOKSURR

(EGNX)

SurrogateFor

Submitting userid

SMF202ID_TOKSUSR

(EGNX)

TokSUser

Surrogate userid

SMF202ID_TOKUSER

(EGNX)

SMF202ID_TOKUSER

Token user

SMF202ID_UserID

(EGNX)

UserID

suid

User ID

SMF202ID_UserID_L

(EGNX)

usrName

User ID

SMF202ID_UsrNm

(EGNX)

Name

User name from ACEEUNAM

SMF202ID_UsrNm_L

(EGNX)

accountName

User name from ACEEUNAM

SMF202PI_AvBlk

(Integer)

AvBlk

AVBLOCK(value) as specified, else zero

SMF202PI_BlkSi

(Integer)

BlkSize

BLKSIZE as specified, else zero

SMF202PI_Cmd

(EGNX)

Cmd

Actual command used by TSO users

SMF202PI_Dir

(Mapped Integer)

SubCmd

cs1

Direction of file transfer: GET = download; PUT = upload

SMF202PI_Dur

Dur

Duration in hundredths of a second

SMF202PI_LRECL

(Integer)

LRECL

LRECL as specified, else zero

SMF202PI_Opt

Options

Various bit-mapped options

SMF202PI_Opt_Append

(Boolean)

Options_Append

Append specified by user

SMF202PI_Opt_ASCII

(Boolean)

Options_ASCII

ASCII specified by user

SMF202PI_Opt_Blank

(Boolean)

Options_Blank

BLANK specified

SMF202PI_Opt_CRLF

(Boolean)

Options_CRLF

CRLF specified by user

SMF202PI_Opt_JISCII

(Boolean)

Options_JISCII

JISCII specified

SMF202PI_Opt_New

(Boolean)

Options_New

New specified by user

SMF202PI_Opt_NOSO

(Boolean)

Options_NOSO

NOSO specified

SMF202PI_Opt_NoTrunc

(Boolean)

Options_NoTrunc

NoTrunc specified by user

SMF202PI_Opt_SO

(Boolean)

Options_SO

SO specified

SMF202PI_Opt_User

(Boolean)

Options_User

USER specified

SMF202PI_OptAPVU

OptAPVU

Various bit-mapped APVUFILE options

SMF202PI_Prim

(Integer)

Prim

SPACE Primary as specified, else zero

SMF202PI_RECFM

(EGNX)

RECFM

RECFM specified by user

SMF202PI_RECFMD

(Mapped Integer)

RECFM

RECFM specified by user

SMF202PI_RetCd

(Integer)

RC

outcome

Return code from IND$FILE

SMF202PI_Sec

(Integer)

Sec

SPACE Secondary as specified, else zero

SMF202PI_Space

(Mapped Integer)

Space

SPACE specification

SMF202PR_Build

(EGNX)

SMF202PR_Build

Build number of above in numeric EBCDIC

SMF202PR_Prod

(EGNX)

Prod

Product to which this section applies For subtype 1 this field will be recorded as C'CZAIND$D'

SMF202SID

(EGNX)

SID

The SMF system ID

SMF202STP

(Integer)

SubT

Record subtype expressed as an integer

SMF202STPD

(Mapped Integer)

SubT

Record subtype expressed as a textual description