IBM Mainframe Forum Index
 
Log In
 
IBM Mainframe Forum Index Mainframe: Search IBM Mainframe Forum: FAQ Register
 

ICETOOL to Read records SMF CEF it is possible ?


IBM Mainframe Forums -> DFSORT/ICETOOL
Post new topic   Reply to topic
View previous topic :: View next topic  
Author Message
sfreire

New User


Joined: 03 Jul 2010
Posts: 2
Location: Brazil

PostPosted: Tue Feb 07, 2023 12:39 am
Reply with quote

Hi guys,

it is possible read records SMF - CEF with ICETOOL ?

The records has:

- SMF Header Format
- MVS Syslog header Format
- CEF header Format.

I can map SMF header but not map CEF header. Any idea ?
Has anyone worked with SMF - CEF records?

Thanks in advance,
Back to top
View user's profile Send private message
Joerg.Findeisen

Senior Member


Joined: 15 Aug 2015
Posts: 1231
Location: Bamberg, Germany

PostPosted: Tue Feb 07, 2023 1:02 pm
Reply with quote

Please, where to find the record description? What SMF Record number is it?
Back to top
View user's profile Send private message
PeterHolland

Global Moderator


Joined: 27 Oct 2009
Posts: 2481
Location: Netherlands, Amstelveen

PostPosted: Tue Feb 07, 2023 5:49 pm
Reply with quote

Read this :

www.ibm.com/docs/he/szs/2.3.1?topic=arcsight-updating-configuration-file-cef-data-creation
Back to top
View user's profile Send private message
sfreire

New User


Joined: 03 Jul 2010
Posts: 2
Location: Brazil

PostPosted: Tue Feb 07, 2023 6:34 pm
Reply with quote

Hi Joerg,

is record #140, proprietary record.
SMF header is easily mapped,
But I don't know how to map the CEF Header.
Back to top
View user's profile Send private message
Robert Sample

Global Moderator


Joined: 06 Jun 2008
Posts: 8696
Location: Dubuque, Iowa, USA

PostPosted: Tue Feb 07, 2023 8:31 pm
Reply with quote

Quote:
is record #140, proprietary record.
IBM SMF record types are 0 to 127 and (IIRC) 256 to 1151. Record types 128 to 255 and 1152 to 2047 are used by software vendors. So 140 is, by definition, a proprietary record.
Quote:
But I don't know how to map the CEF Header.
Contact the vendor. Since I've never heard of CEF in the context of SMF records, the vendor is most likely your BEST source of information.
Back to top
View user's profile Send private message
View previous topic :: :: View next topic  
Post new topic   Reply to topic View Bookmarks
All times are GMT + 6 Hours
Forum Index -> DFSORT/ICETOOL

 


Similar Topics
Topic Forum Replies
No new posts Error to read log with rexx CLIST & REXX 11
No new posts Compare only first records of the fil... SYNCSORT 7
No new posts Pulling a fixed number of records fro... DB2 2
No new posts Shift left VB record without x00 endi... DFSORT/ICETOOL 11
No new posts Random read in ESDS file by using RBA JCL & VSAM 6
Search our Forums:

Back to Top