topic smf time (seconds since midnight) how to print out and ip addresses in SAS Programming

smf time (seconds since midnight) how to print out and ip addresses

mbieganski — Fri, 03 Dec 2010 15:26:20 GMT

an embarrassing rookie question...new to sas programming.
I'm trying to print out SMF 118 tcpip records and there are two 4 byte bin fields denoting the time of transmission and end of transmission which I believe is in seconds since midnight.
When I code the fields as smfstamp8 I only get a very few times in the reports.
(most just show as dots)
When I code the fields as pib4, all times show on the report (no dots) but appear to be all off.
I've tried:
FORMAT STIME TIME. ETIME TIME. ;
input @57 STARTED PIB4.
@61 ENDED PIB4.
.
STIME = TIMEPART(STARTED);
ETIME = TIMEPART(ENDED);
Any direction on where I've gone south on this?
Thanks!

Re: smf time (seconds since midnight) how to print out and ip addresses

sbb — Fri, 03 Dec 2010 21:40:28 GMT

These fields are "time" not "datetime" so you should not be using the TIMEPART(...) function against them. As read with the INFORMAT PIB4. in your INPUT statement, you will have time-of-day values.

Also, I suggest you migrate to using the now-standard SMF type 119 for TCP/IP statistics.

Scott Barry
SBBWorks, Inc.

Re: smf time (seconds since midnight) how to print out and ip addresses

mbieganski — Mon, 06 Dec 2010 14:24:27 GMT

Perhaps these STARTED and ENDED times are "seconds since midnight" ??? as their PIB4. fields do not show time values when printed:
given:

DATA A;
KEEP FTPCMD RHOST LHOST LOCID STARTED ENDED BYTES DSN;
INFILE SMF;
INPUT @2 REC_TYPE PIB1. @;
IF REC_TYPE NE 118 THEN DELETE;
INPUT @19 SUBTYPE PIB2. @;
IF ((SUBTYPE NE 75)) AND ((SUBTYPE NE 74)) THEN DELETE;
INPUT @21 FTPCMD $4.
@29 RHOST PIB4.
@33 LHOST PIB4.
@45 LOCID $8.
@57 STARTED PIB4.
@61 ENDED PIB4.
@65 BYTES PIB4.
@73 DSN $44.
@;
PROC PRINT;

The STARTED & ENDED times are printing out as shown below:
STARTED ENDED
2411463 2411464
2592137 2592152
2769181 2769186
2772300 2772301
2783348 2783348
.
.

So if timepart is not the function that will format the above to readable times,
(I also could not get
FORMAT STARTED TIME. ENDED TIME. ; to work.
Do I need to put together a formula to convert these values from seconds from midnight to readable times??
thanks for your help

lost

Re: smf time (seconds since midnight) how to print out and ip addresses

sbb — Mon, 06 Dec 2010 15:16:01 GMT

The time-fields are in 1/100th of a second (check the IBM TCP/IP SMF type 118 record source documentation) so you must use PIB4.2, not PIB4. to read those fields. Also, you will likely want to apply some TIMEw.d SAS format.

Do consider that these fields are only the time and if you have a negative difference when computing elapsed time between END-START, then you will need to handle this condition. There is another DATETIME field in the SMF record header which may help with your calculating an accurate "date portion" though.

Scott Barry
SBBWorks, Inc.

Re: smf time (seconds since midnight) how to print out and ip addresses

mbieganski — Tue, 07 Dec 2010 17:49:11 GMT

Thank you Scott...I'll play around with it some
regards!

Re: smf time (seconds since midnight) how to print out and ip addresses

sbb — Wed, 08 Dec 2010 01:29:53 GMT

Also, you may want to check with your SAS administrator and other mainframe SAS uers -- to determine if your site is licensed for MXG from Merrill Consultants http://mxg.com/ which has predefined SAS routines to read up this and many other data sources to build MXG / SAS PDBs (performance data bases).

Scott Barry
SBBWorks, Inc.