Request data from SMF type 123 subtype 1 version 1 records

The SMF type 123 subtype 1 version 1 record is used to capture some basic data for individual requests.

You can change your configuration to use the SMF type 123 subtype 1 version 2 records to benefit from the more enhanced data that they provide for API provider requests. See API provider data from SMF type 123 subtype 1 version 2 records.

To configure IBM® z/OS® Connect to capture SMF 123 records, see Configuring the audit interceptor.

SMF type 123 subtype 1 version 1 record structure

The SMF type 123 subtype 1 version 1 record contains the following sections:
  1. Standard SMF header.
  2. SMF type 123 subtype 1 header extension.
  3. Server and User data triplets section.
  4. Server section (one instance).
  5. User data section (one instance).

SMF type 123 subtype 1 version 1 section descriptions

Standard SMF header
Table 1. Standard SMF 123 header fields.
Offset Name Length Data type Data
0 SMF123_LEN 2 BINARY Record length. Maximum size is 32,756.
2 SMF123_SEG 2 BINARY Segment descriptor.
4 SMF123_FLAG 1 BINARY System indicator (0x01011110).
5 SMF123_REC_TYPE 1 BINARY Record type (123 -0x7B).
6 SMF123_TIME 4 TIME (1/100s) Time when record was moved into the SMF buffer, in hundredths of a second since midnight.
10 SMF123_DATE 4 DATE (01YYDDDF) Date when record was moved into the SMF buffer, YY is the current year (0 -99), DDD is the current day (1 -366), and F is the sign.
14 SMF123_SID 4 CHAR System ID from the SID parameter.
18 SMF123_SSI 4 CHAR Subsystem ID. Set to "ZCON".
22 SMF123_SUBTYPE 2 BINARY Record subtype (0x0001 for API provider and 0x0002 for API requester).
Note: The first 4 bytes of the standard SMF header, the record descriptor word (RDW), contains the fields SMFxLEN and SMFxSEG. The SMF offload utility, IFASMFDP, strips the RDW from each record, so offsets for the subsequent header fields must be adjusted.
SMF type 123 subtype 1 version 1 header extension
Table 2. SMF 123 subtype 1 header extension fields.
Offset Name Length Data type Data
0 SUBTYPE_VERSION 4 BINARY Record subtype version. Set to 1.
4 TRIPLET_COUNT 4 BINARY Number of triplets. Defaults to x0002.
8 RECORD_INDEX 4 BINARY Index of this record. Always 0.
12 RECORD_COUNT 4 BINARY Total number of records. Always 1.
16 RECORD_CONT 8 HEX Record continuation token. Always 8 bytes of nulls.
Server and User data triplets section
Table 3. Server and User Data triplets section fields.
Offset Name Length Data type Data
0 SERVER_OFFSET 4 BINARY Server section offset.
4 SERVER_LEN 4 CHAR Server section length.
8 SERVER_COUNT 4 BINARY Server section count.
12 USERDATA_OFFSET 4 BINARY User Data section offset.
16 USERDATA_LEN 4 BINARY User Data section length.
20 USERDATA_COUNT 4 BINARY User Data section count.
Server section
Table 4. Fields in version 1 of the Server data section.
Offset Name Length Data type Data
0 SERVER_SECTION_VER 4 BINARY Version of the server section.
4 SERVER_SYSTEM 8 CHAR System name.
12 SERVER_SYSPLEX 8 CHAR Sysplex name.
20 SERVER_JOBID 8 CHAR Job ID of the server.
28 SERVER_JOBNAME 8 CHAR Job name of the server.
36 SERVER_STOKEN 8 BINARY SToken of the server.
44 RESERVED_01 36 CHAR Reserved.
User data section
Table 5. Fields in version 1 of the User data section header.
Offset Name Length Data type Data
0 USERDATAHD_VER 4 BINARY Version of user data header.

This table maps version 1 of user data.
4 USERDATAHD_TYPE 4 BINARY User data type. The value is 0x66.
8 USERDATAHD_DATALEN 4 BINARY Length of following user data.
12       Data (See Table 6).
Table 6. Fields in version 3 of the User data section body..

Character data is EBCDIC right-padded with blanks.
Offset Name Length Data type Data
0 USERDATA_VER 4 BINARY Version of user data record.

This table maps version 3 of user data.
4 TIME_ZC_ENTRY 8 STCK Arrival date and time.
12 TIME_ZC_EXIT 8 STCK Completion date and time.
20 REQ_TARGET_URI 64   Target URI.
84 REQ_PAYLOAD_LEN 4   Length of the request payload received from the application, in bytes.
88 API_SERVICE_NAME 64 CHAR API or service name.
152 REQ_METHOD 8 CHAR Method (GET/POST/PUT/DELETE).
160 RESP_PAYLOAD_LEN 4 BINARY Length of the response payload returned to the application, in bytes.
164 USER_NAME 64 CHAR One of the following values:
  • If TLS client certificate authentication was used, the authenticated username associated with that certificate.
  • The distributed ID, if one was sent on the request and is mapped to a SAF username.
  • The authenticated username.
  • Available from V3.0.58.0
    • If the request has failed early with an authentication 401 error, the username found in the authorization header.
    • The unauthenticated username.
228 REQ_ID 8 HEX Request ID (simple sequence number).
236 RESERVED_02 15 HEX Unused portion of request ID.
251 RESERVED_03 1 BINARY Reserved for alignment.
252 SERVICE_GROUP 64 CHAR Service grouping (unused).
316 USER_NAME_MAPPED 8 CHAR If a distributed ID was sent on the request and is mapped to a SAF username, then this value is the authenticated SAF username. Otherwise, this value is blank.

Sample JCL to format SMF 123 records

To format the SMF 123 records, use the sample JCL provided. For more information, see Sample JCL to format SMF records.