BookmarkSubscribeRSS Feed
mbieganski
Calcite | Level 5
an embarrassing rookie question...new to sas programming.
I'm trying to print out SMF 118 tcpip records and there are two 4 byte bin fields denoting the time of transmission and end of transmission which I believe is in seconds since midnight.
When I code the fields as smfstamp8 I only get a very few times in the reports.
(most just show as dots)
When I code the fields as pib4, all times show on the report (no dots) but appear to be all off.
I've tried:
FORMAT STIME TIME. ETIME TIME. ;
input @57 STARTED PIB4.
@61 ENDED PIB4.
.
STIME = TIMEPART(STARTED);
ETIME = TIMEPART(ENDED);
Any direction on where I've gone south on this?
Thanks!
5 REPLIES 5
sbb
Lapis Lazuli | Level 10 sbb
Lapis Lazuli | Level 10
These fields are "time" not "datetime" so you should not be using the TIMEPART(...) function against them. As read with the INFORMAT PIB4. in your INPUT statement, you will have time-of-day values.

Also, I suggest you migrate to using the now-standard SMF type 119 for TCP/IP statistics.

Scott Barry
SBBWorks, Inc.
mbieganski
Calcite | Level 5
Perhaps these STARTED and ENDED times are "seconds since midnight" ??? as their PIB4. fields do not show time values when printed:
given:

DATA A;
KEEP FTPCMD RHOST LHOST LOCID STARTED ENDED BYTES DSN;
INFILE SMF;
INPUT @2 REC_TYPE PIB1. @;
IF REC_TYPE NE 118 THEN DELETE;
INPUT @19 SUBTYPE PIB2. @;
IF ((SUBTYPE NE 75)) AND ((SUBTYPE NE 74)) THEN DELETE;
INPUT @21 FTPCMD $4.
@29 RHOST PIB4.
@33 LHOST PIB4.
@45 LOCID $8.
@57 STARTED PIB4.
@61 ENDED PIB4.
@65 BYTES PIB4.
@73 DSN $44.
@;
PROC PRINT;

The STARTED & ENDED times are printing out as shown below:
STARTED ENDED
2411463 2411464
2592137 2592152
2769181 2769186
2772300 2772301
2783348 2783348
.
.

So if timepart is not the function that will format the above to readable times,
(I also could not get
FORMAT STARTED TIME. ENDED TIME. ; to work.
Do I need to put together a formula to convert these values from seconds from midnight to readable times??
thanks for your help

lost
sbb
Lapis Lazuli | Level 10 sbb
Lapis Lazuli | Level 10
The time-fields are in 1/100th of a second (check the IBM TCP/IP SMF type 118 record source documentation) so you must use PIB4.2, not PIB4. to read those fields. Also, you will likely want to apply some TIMEw.d SAS format.

Do consider that these fields are only the time and if you have a negative difference when computing elapsed time between END-START, then you will need to handle this condition. There is another DATETIME field in the SMF record header which may help with your calculating an accurate "date portion" though.

Scott Barry
SBBWorks, Inc.
mbieganski
Calcite | Level 5
Thank you Scott...I'll play around with it some
regards!
sbb
Lapis Lazuli | Level 10 sbb
Lapis Lazuli | Level 10
Also, you may want to check with your SAS administrator and other mainframe SAS uers -- to determine if your site is licensed for MXG from Merrill Consultants http://mxg.com/ which has predefined SAS routines to read up this and many other data sources to build MXG / SAS PDBs (performance data bases).

Scott Barry
SBBWorks, Inc.

sas-innovate-2024.png

Join us for SAS Innovate April 16-19 at the Aria in Las Vegas. Bring the team and save big with our group pricing for a limited time only.

Pre-conference courses and tutorials are filling up fast and are always a sellout. Register today to reserve your seat.

 

Register now!

How to Concatenate Values

Learn how use the CAT functions in SAS to join values from multiple variables into a single value.

Find more tutorials on the SAS Users YouTube channel.

Click image to register for webinarClick image to register for webinar

Classroom Training Available!

Select SAS Training centers are offering in-person courses. View upcoming courses for:

View all other training opportunities.

Discussion stats
  • 5 replies
  • 1402 views
  • 0 likes
  • 2 in conversation