TCP TR detail (-T -D) report

This report is displayed when both the -T and -D options are specified with the trmdstat command. It displays the contents of individual TCP TR records. The information displayed in this report is derived from EZZ9317I, EZZ9318I, EZZ9319I, EZZ9320I, EZZ9321I, EZZ9322I, EZZ9323I, and EZZ9324I types of syslog messages. Information is grouped and sorted by local host.

>trmdstat -TD /tmp/tstlog.log
trmdstat for z/OS CS V2R1  Wed Dec 14 09:01:38 2011                                                              
                                                                                                                  
Command Entered     : trmdstat -TD /tmp/tstlog.log                                     
Log Time Interval   : May 28 20:40:53  - May 28 21:26:23                                                          
Stack Time Interval : May 28 20:40:48  - May 28 21:26:02                                                          
TRM Records Scanned : 86                                                                                          
                                                                                                                  
                                         TCP TR Events                                                            
                                                                                                                  
                                         Events Limited                                                           
                                                                                                                  
Local Host: ::                                                                                                    
                                                                                                                  
    Date and Time/     Local Rec Cns      Connections                Policy                                       
      Source Host      Port  Typ Typ  Current   Available  Total Conn Pct Qos Limit  Correlator ProbeID           
---------------------- ----- --- --- ---------- ---------- ---------- --- ---------- ---------- --------          
05/28/2011 20:40:48.88   345  Q               3          7         10  50         10          1  1004014          
  10.42.105.25                                                                                                    
05/28/2011 20:41:49.14   345  Q               4          6         10  50         10          1  1004014          
  10.42.105.25                                                                                                    
05/28/2011 20:59:08.62   345  S   E           0          1         10  50          0          3  1004400          
  2001:db8::9:42:105:25                                                                                           
05/28/2011 21:01:26.98   345  C               4          1         10  50          0          2  1004044          
  2001:db8::9:42:105:25                                                                                           
05/28/2011 21:05:23.97   345  C               1          0         10  50          0          3  1004048          
  10.42.105.135                                                                                                   
05/28/2011 21:26:02.29   345  S   X           0          2         10  50          0          3  1002400          
  2001:db8::9:42:105:25                                                                                           
                                                                                                                  
No TypeActions LOG records to display

The following information describes the areas of the TCP TR detail report:

Events Limited | Logged

For each Local Host the report is first generated for ports with a policy that specifies both an action of LIMIT and an action of LOG and then for ports that specify only an action of LOG.

Local Host

If the policy was configured to limit by all sockets (also known as limit by port), this is either 255.255.255.255 or ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff. If the policy was configured to limit by each socket (also known as limit by port instance), this is the IP address bound to by the local listener applications. The value 0.0.0.0 indicates that the application bound to INADDR_ANY. The value :: indicates that the application bound to in6addr_any.

Date and Time

The stack date and time the event occurred.

Local Port

The port bound to by a local listener application.

Source Host

The source host associated with the event.

Rec Typ

The record type of the event. Possible values are:

C - Connection refused or would have been refused events
Q - Connection allowed due to QoS exception events. The QOS policy guarantees a higher number of connections to this port than would be allowed by the TCP TR policy
S - Port entered or exited constraint events

Cns Typ

Constraint event type:

E - Entered
X - Exited

Connections Current

The number of connections that were active on this port at the time of this event and that were established while policy was in effect.

Connections Available

The remaining number of connections available to this port at the time of this event.

Policy Total Conn

The total number of connections allowed for this port.

Policy Pct

The percentage of total connections that can be used by a single IP address for this port.

Policy QoS Limit

The maximum number of connections specified in the QoS policy for this source host and this port.

Correlator

The trace correlator for this event.

ProbeID

The IDS probeID that generated this event.

messages suppressed

The number of TCP TR messages suppressed with date and time, type of suppressed TCP connections, local IP address, local listening port, and the reason that the log records were suppressed. This data comes from an EZZ8660I or EZZ8661I message. See in The trmdstat report general concept for a detailed description.