Thank you to all who responded!
Diego, thanks for your TRCCNN recommendation! I typically use that when I'm
troubleshooting network issues. I agree that the PCAP files viewed in
Wireshark are extremely helpful, just not what I was aiming for in this
instance.
Stefan, indeed, we are running on V7R4. I have toyed around with the
QSYS2.NETSTAT_INFO view as well, and found similar results. My SQL
programming is lacking, but I agree that would be the foundation.
Sam_L, I have no experience with CL programming. That's where the gotcha
lies. I have experimented with using SQL against the NETSTAT_INFO view.
Kevin! That seems to be what I was looking for - a way to automate the SQL
statement and dump it to a physical file with some CL.
------------
Jacob
------------
date: Tue, 7 Sep 2021 12:41:01 -0500
from: "Diego E. Kesselman" <diegokesselman@xxxxxxxxx>
subject: Re: How to Take Snapshots of TCP/IP Connection Status info at
Predefined Intervals (Monitor TCP/IP Connections)
Have you tried with something like this?
TRCCNN SET(*ON) TRCTYPE(*IP) TRCFULL(*STOPTRC) TRCTBL(IBMi01_TRACE_01)
SIZE(1024 *MB)
TRCCNN SET(*OFF) TRCTBL(IBMi01_TRACE_01) OUTPUT(*STMF)
TOSTMF('/home/USER/ibmi01_trace_01.pcap' *YES)
The .pcap file works with WireShark
Diego E. Kesselman
diegokesselman@xxxxxxxxx
------------------------------
date: Tue, 7 Sep 2021 19:50:08 +0200
from: <stefan@xxxxxxxxxx>
subject: RE: How to Take Snapshots of TCP/IP Connection Status info at
Predefined Intervals (Monitor TCP/IP Connections)
Hi Jacob,
If you are on a recent os-level use can use something like this as a
starting point:
select protocol, connection_type, local_address, tcp_state, count(*) as
"connections"
from qsys2.netstat_info
group by rollup( protocol, connection_type, local_address, tcp_state )
order by protocol, connection_type, local_address, tcp_state;
Best regards
Stefan
--
No trees were killed in the sending of this message, but a large number of
electrons were terribly upset.
Stefan Tageson
+46 732 369934
stefan@xxxxxxxxxx
------------------------------
date: Tue, 7 Sep 2021 14:05:43 -0400
from: Sam_L <lennon_s_j@xxxxxxxxxxx>
subject: Re: How to Take Snapshots of TCP/IP Connection Status info at
Predefined Intervals (Monitor TCP/IP Connections)
If all the info you want is in the QSYS2.NETSTAT_INFO view, it probably
isn't that hard to create a CL program that runs an SQL statement and
inserts the data into a database file every 15 minutes. Provided you know
how to program in CL...
Have you experiments with using SQL against the QSYS2.NETSTAT_INFO view?
Sam
On 9/7/2021 1:38 PM, Jacob Banda wrote:
QSYS2.NETSTAT_INFO view
------------------------------
date: Tue, 7 Sep 2021 18:06:07 +0000
from: Kevin Bucknum <Kevin@xxxxxxxxxxxxxxxxxxx>
subject: Re: How to Take Snapshots of TCP/IP Connection Status info at
Predefined Intervals (Monitor TCP/IP Connections)
netstat_info is the way to go. Here is a simple example of something we were
doing to monitor for connections on port 992.
insert into kevin/ssllog select
SUBSTR(JOB_NAME,LOCATE_IN_STRING(JOB_NAME,'/',-1)+1),
Remote_address, local_address, Authorization_name , now() FROM
qsys2.netstat_job_info WHERE local_port = 992 AND authorization_name IS NOT
NULL AND authorization_name <> 'QTCP' and job_type = 'INTERACTIVE'
This was run from a cl like this.
PGM
RUNSQL: RUNSQLSTM SRCFILE(KEVIN/QSQLSRC) SRCMBR(SSLLOGSQL) +
COMMIT(*NONE) OPTION(*NOLIST)
MONMSG MSGID(CPF0000 SQL0000)
DLYJOB DLY(1800)
GOTO CMDLBL(RUNSQL)
ENDPGM
And for an example of the API, this is some I had laying around. Not sure
what we were doing, but it looks for connections on port 8190 as is. Easy
enough to modify to capture the info you need.
https://code.midrange.com/57c3dc1a60.html
midrange.com
