DATA Step, Macro, Functions and more

smf time (seconds since midnight) how to print out and ip addresses

Reply
Occasional Contributor
Posts: 7

smf time (seconds since midnight) how to print out and ip addresses

an embarrassing rookie question...new to sas programming.
I'm trying to print out SMF 118 tcpip records and there are two 4 byte bin fields denoting the time of transmission and end of transmission which I believe is in seconds since midnight.
When I code the fields as smfstamp8 I only get a very few times in the reports.
(most just show as dots)
When I code the fields as pib4, all times show on the report (no dots) but appear to be all off.
I've tried:
FORMAT STIME TIME. ETIME TIME. ;
input @57 STARTED PIB4.
@61 ENDED PIB4.
.
STIME = TIMEPART(STARTED);
ETIME = TIMEPART(ENDED);
Any direction on where I've gone south on this?
Thanks!
Super Contributor
Super Contributor
Posts: 3,174

Re: smf time (seconds since midnight) how to print out and ip addresses

Posted in reply to mbieganski
These fields are "time" not "datetime" so you should not be using the TIMEPART(...) function against them. As read with the INFORMAT PIB4. in your INPUT statement, you will have time-of-day values.

Also, I suggest you migrate to using the now-standard SMF type 119 for TCP/IP statistics.

Scott Barry
SBBWorks, Inc.
Occasional Contributor
Posts: 7

Re: smf time (seconds since midnight) how to print out and ip addresses

Perhaps these STARTED and ENDED times are "seconds since midnight" ??? as their PIB4. fields do not show time values when printed:
given:

DATA A;
KEEP FTPCMD RHOST LHOST LOCID STARTED ENDED BYTES DSN;
INFILE SMF;
INPUT @2 REC_TYPE PIB1. @;
IF REC_TYPE NE 118 THEN DELETE;
INPUT @19 SUBTYPE PIB2. @;
IF ((SUBTYPE NE 75)) AND ((SUBTYPE NE 74)) THEN DELETE;
INPUT @21 FTPCMD $4.
@29 RHOST PIB4.
@33 LHOST PIB4.
@45 LOCID $8.
@57 STARTED PIB4.
@61 ENDED PIB4.
@65 BYTES PIB4.
@73 DSN $44.
@;
PROC PRINT;

The STARTED & ENDED times are printing out as shown below:
STARTED ENDED
2411463 2411464
2592137 2592152
2769181 2769186
2772300 2772301
2783348 2783348
.
.

So if timepart is not the function that will format the above to readable times,
(I also could not get
FORMAT STARTED TIME. ENDED TIME. ; to work.
Do I need to put together a formula to convert these values from seconds from midnight to readable times??
thanks for your help

lost
Super Contributor
Super Contributor
Posts: 3,174

Re: smf time (seconds since midnight) how to print out and ip addresses

Posted in reply to mbieganski
The time-fields are in 1/100th of a second (check the IBM TCP/IP SMF type 118 record source documentation) so you must use PIB4.2, not PIB4. to read those fields. Also, you will likely want to apply some TIMEw.d SAS format.

Do consider that these fields are only the time and if you have a negative difference when computing elapsed time between END-START, then you will need to handle this condition. There is another DATETIME field in the SMF record header which may help with your calculating an accurate "date portion" though.

Scott Barry
SBBWorks, Inc.
Occasional Contributor
Posts: 7

Re: smf time (seconds since midnight) how to print out and ip addresses

Thank you Scott...I'll play around with it some
regards!
Super Contributor
Super Contributor
Posts: 3,174

Re: smf time (seconds since midnight) how to print out and ip addresses

Posted in reply to mbieganski
Also, you may want to check with your SAS administrator and other mainframe SAS uers -- to determine if your site is licensed for MXG from Merrill Consultants http://mxg.com/ which has predefined SAS routines to read up this and many other data sources to build MXG / SAS PDBs (performance data bases).

Scott Barry
SBBWorks, Inc.
Ask a Question
Discussion stats
  • 5 replies
  • 327 views
  • 0 likes
  • 2 in conversation