Trace Connection (TRCCNN)

The Trace Connection (TRCCNN) command allows the tracing of encrypted data flowing over internet protocol (IP) and Secure Sockets Layer (SSL) connections. Specific types of traces are started and stopped by using this command.

TRCCNN uses the Trace Internal (TRCINT) command to collect the trace records and generate an intermediate spooled file named QPCSMPRT. The QPCSMPRT spooled file data is used to generate a spooled file named QSYSPRT. The user data for the QSYSPRT file is 'TRCCNN'.

You can use also use TRCCNN with a QPCSMPRT spooled file generated by using TRCINT directly. TRCCNN can extract and format the IP and SSL connection-related trace records. This allows you to use TRCINT to collect many types of trace records and then use TRCCNN to format the subset of trace records related to IP or SSL connections.

Restrictions:

To use this command, you must have service (*SERVICE) special authority, or be authorized to the Service Trace function of Operating System through iSeries Navigator's Application Administration support. The Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_SERVICE_TRACE, can also be used to change the list of users that are allowed to perform trace operations.
The following user profiles have private authorities to use the command:
- QSRV
When the Watched job (WCHJOB) parameter is specified, the issuer of the command must be running under a user profile which is the same as the job user identity of the job being watched, or the issuer of the command must be running under a user profile which has job control (*JOBCTL) special authority. Job control (*JOBCTL) special authority is also required if a generic user name is specified for the WCHJOB parameter.
If you specify a generic user name in the WCHJOB parameter, you must have all object (*ALLOBJ) special authority, or be authorized to the Watch Any Job function of Operating System through iSeries Navigator's Application Administration support. The Change Function Usage (CHGFCNUSG) command, with a function ID of QIBM_WATCH_ANY_JOB, can also be used to change the list of users that are allowed to start and end watch operations.
You must have operational (*OBJOPR) and execute (*EXECUTE) authorities to the user exit program if specified in Trace program (TRCPGM) parameter, and execute (*EXECUTE) authority to the library where the program is located.
You must have use (*USE) authority to the message queues specified in Watched message queue (WCHMSGQ) parameter, and use (*USE) authority to the library where the message queue is located.

Parameters

Keyword	Description	Choices	Notes
SET	Trace option setting	ON, OFF, END, FORMAT	Required, Positional 1
TRCTYPE	Trace type	Values (up to 2 repetitions): IP, SSL	Optional
TRCFULL	Trace full	WRAP, STOPTRC	Optional
TRCTBL	Trace table name	Character value, *GEN	Optional
SIZE	Size	Single values: MAX, MIN Other values: Element list	Optional
	Element 1: Number of units	1-998000, 16000
	Element 2: Unit of measure	KB, MB
FMTDTA	Trace data to be formatted	72-99999, *CALC	Optional
CCSID	Coded character set identifier	1-65533, EBCDIC, ASCII	Optional
JOB	Job name	Single values: * Other values: Qualified job name	Optional
	Qualifier 1: Job name	Name
	Qualifier 2: User	Name
	Qualifier 3: Number	000000-999999
SPLNBR	Spooled file number	1-999999, ONLY, LAST	Optional
JOBSYSNAME	Job system name	Name, ONLY, CURRENT, *ANY	Optional
CRTDATE	Spooled file created	Single values: ONLY, LAST Other values: Element list	Optional
	Element 1: Creation date	Date
	Element 2: Creation time	Time, ONLY, LAST
TCPDTA	TCP/IP data	Element list	Optional
	Element 1: Protocol	TCP, UDP, ICMP, IGMP, ARP, ICMP6
	Element 2: Local port	Values (up to 2 repetitions): 1-65535
	Element 3: Remote port	Values (up to 2 repetitions): 1-65535
	Element 4: Local IP address	Character value
	Element 5: Remote IP address	Character value
	Element 6: Line description	Name
WCHMSG	Watch for message	Single values: NONE Other values (up to 5 repetitions): Element list*	Optional
	Element 1: Message identifier	Name
	Element 2: Comparison data	Character value, *NONE
	Element 3: Compare against	MSGDTA, FROMPGM, *TOPGM
WCHMSGQ	Watched message queue	Values (up to 3 repetitions): Element list	Optional
	Element 1: Message queue	Single values: SYSOPR, JOBLOG, HSTLOG Other values: Qualified object name*
	Qualifier 1: Message queue	Name
	Qualifier 2: Library	Name, *LIBL
WCHJOB	Watched job	Single values: * Other values (up to 5 repetitions): Element list	Optional
	Element 1: Job name	Qualified job name
	Qualifier 1: Job name	Generic name, name
	Qualifier 2: User	Generic name, name
	Qualifier 3: Number	000001-999999, *ALL
WCHLICLOG	Watch for LIC log entry	Single values: NONE Other values (up to 5 repetitions): Element list*	Optional
	Element 1: Major code	Character value, *ALL
	Element 2: Minor code	Character value, *ALL
	Element 3: Comparison data	Character value, *NONE
WCHTIMO	Length of time to watch	1-43200, *NOMAX	Optional
TRCPGM	Trace program	Single values: NONE Other values: Qualified object name*	Optional
	Qualifier 1: Trace program	Name
	Qualifier 2: Library	Name, *LIBL
TRCPGMITV	Time interval	1-9999, *NONE	Optional

Top

Trace option setting (SET)

Specifies whether tracing is started, stopped or ended. Also, you can select to format trace record data collected previously using the TRCCNN or TRCINT (Trace Internal) command.

This is a required parameter.

*ON: The collection of internal trace records is started for the trace types specified in the TRCTYPE parameter. If *GEN is specified in the TRCTBL parameter then the trace table name will be QTRCCNNxxxxxx where xxxxxx is the job number of the current job. Otherwise the trace table name will be the name specified on the TRCTBL parameter.
*OFF: Collection of trace records stops. A spooled file named QPCSMPRT is generated by the TRCINT command and contains the collected trace record data. TRCCNN formats this data in a second spooled file named QSYSPRT. The user data for the QSYSPRT spooled file is 'TRCCNN'. The trace table is deleted after the spooled files are generated.
*END: Collection of trace records stops and the trace table is deleted. No spooled output is generated.
*FORMAT: Formats trace data in a QPCSMPRT spooled file created by a previous invocation of TRCCNN or TRCINT. The formatted data is written to a spooled file named QSYSPRT. The user data for the QSYSPRT spooled file is 'TRCCNN'. Use the TRCTYPE parameter to specify which connection-related trace records to format. Use the JOB, SPLNBR, JOBSYSNAME and CRTDATE parameters to identify which QPCSMPRT file to use.

Size (SIZE)

Specifies the size of the trace table. The amount of storage to be allocated can be specified in units of kilobytes (*KB) or megabytes (*MB). If the size is specified in kilobytes, the amount of storage allocated for the table will be rounded up to the nearest megabyte. Valid table size values range from one megabyte to 258048 megabytes.

Note: The amount of storage specified by this parameter is immediately allocated from the system auxiliary storage pool (ASP 1). This storage space is not dynamically allocated as it is needed. This storage space will not be available for use by the system except to record trace-related information. Before specifying a large value on this parameter, the amount of free space in the system ASP should be checked. Use the Work with System Status (WRKSYSSTS) command to determine the amount of available free space in the system ASP. System performance degradation may result if the size of the free space in the system ASP is significantly reduced as a result of the value specified.

Note: If tracing data over a gigabit Ethernet line the trace table size should be greater than 128000 kilobytes or 128 megabytes.

Single values

*MAX: The trace table is set to the maximum size of 258048 megabytes.
*MIN: The trace table is set to the minimum size of one megabyte.

Element 1: Number of units

16000: The trace table size is either 16000 kilobytes or 16000 megabytes, depending on the value specified for the second element of this parameter.
1-998000: Specify the size of the trace table in kilobytes or megabytes.

Element 2: Unit of measure

Specifies whether the value specified for the first element should be treated as number of kilobytes or number of megabytes.

*KB: The trace table size is specified in kilobytes.
*MB: The trace table size is specified in megabytes.

Spooled file created (CRTDATE)

Specifies the date and time the spooled file was created. This parameter is considered after the job name, user name, job number, spooled file name, spooled file number and job system name parameter requirements have been met.

Single values

*ONLY: There is only one spooled file with the specified job name, user name, job number, spooled file name, spooled file number and job system name.
*LAST: The spooled file with the latest creation date and time of the specified job name, user name, job number, spooled file name, spooled file number and job system name is used.

Element 1: Creation date

date: Specify the date the spooled file was created.

Element 2: Creation time

*ONLY: There is only one spooled file with the specified job name, user name, job number, spooled file name, spooled file number, job system name, and spooled file creation date.
*LAST: The spooled file with the latest creation time of the specified job name, user name, job number, spooled file name, spooled file number,job system name, and spooled file creation date is used.
time: Specify the time the spooled file was created.

TCP/IP data (TCPDTA)

Specifies whether a subset of TCP/IP and/or SSL trace data should be collected. Each parameter element is optional; if no element value is specified, no filtering of trace data is done for that element. For example, if *TCP is specified for element 1, only trace records where the TCP protocol is used are collected. If no value is specified for element 1, trace records using all TCP/IP protocols are collected.

Element 1: Protocol

Specify a TCP/IP protocol to be traced.

*TCP: Enable trace for transmission control protocol.
*UDP: Enable trace for user datagram protocol.
*ICMP: Enable trace for internet control message protocol.
*IGMP: Enable trace for internet group management protocol
*ARP: Enable trace for address resolution protocol. This will only apply for TCP/IP.
*ICMP6: Enable trace for internet control message protocol version 6.

Element 2: Local port

1-65535: Specify one or two local port numbers for which trace data is collected.

Element 3: Remote port

1-65535: Specify one or two remote port numbers for which trace data is collected

Element 4: Local IP address

character-value: Specify a local internet protocol address.

Element 5: Remote IP address

character-value: Specify a remote internet protocol address.

Element 6: Line description

name: Specify the name of a line description for which TCP/IP trace data is to be collected.

Watch for message (WCHMSG)

Specifies up to five message identifiers which are to be watched for. If a value other than *NONE is specified, you must specify where to watch for the message on the WCHMSGQ parameter. When the watched for message is added to the specified message queue or log, the trace exit program is called; if no trace exit program is defined, the trace stops.

Single values

*NONE: No messages will be watched for.

Element 1: Message identifier

name: Specify the 7-character message identifier to be watched for.

Element 2: Comparison data

Specify comparison data to be used if a message matching the specified message ID is added to the specified message queue or log. If the message data, the "From program" or the "To program" includes the specified text, the watched for condition is true. If the message data, the "From program" or the "To program" does not contain the specified text, the trace function continues.

*NONE: No comparison data is specified. If a message matching the specified message ID is added to the specified message queue or log, the watched for condition is true.
character-value: Specify the text string used to compare against the message data, the "From program" or the "To program" of the watched for message. This text is case sensitive and can be quoted in order to specify imbedded or trailing blanks.

Element 3: Compare against

Specify which part of the message the comparison data specified for element 2 is to be compared against.

*MSGDATA: The comparison data will be compared against the message replacement data.
*FROMPGM: The comparison data will be compared against the name of the program sending the message, or the name of the ILE program that contains the procedure sending the message.
*TOPGM: The comparison data will be compared against the name of the program the message was sent to, or the name of the ILE program that contains the procedure the message was sent to.

Watched message queue (WCHMSGQ)

Specifies where to watch for the message identifiers specified on the WCHMSG parameter. You can specify to watch the message being added to the system operator message queue, the history log, other message queues, and job logs. Up to three message queues or special values can be specified.

Element 1: Message queue

Single values

*SYSOPR: Watch messages added to the system operator message queue (QSYSOPR message queue in library QSYS).
*JOBLOG: Watch messages added to the job logs of the jobs specified for the Watched job (WCHJOB) parameter.
*HSTLOG: Watch messages added to the history log (QHST message queue in library QSYS).

Qualifier 1: Message queue

name: Specify the name of the message queue to watch.

Qualifier 2: Library

*LIBL: All libraries in the library list for the current thread are searched until the first match is found.

name: Specify the name of the library where the message queue is located.

Watched job (WCHJOB)

Specifies the job whose job log is watched for the messages specified on the WCHMSG parameter. The specified job will only be watched if *JOBLOG is specified on the WCHMSGQ parameter. Up to five job names may be specified.

Single values

*: Only the job log of the job that issued this trace command is watched.

Element 1: Job name

Qualifier 1: Job name

generic-name: Specify the generic name of the job to be watched. A generic name is a character string of one or more characters followed by an asterisk (*); for example, ABC*. The asterisk substitutes for any valid characters. A generic job name specifies all jobs with job names that begin with the generic prefix.
name: Specify the name of the job to be watched.

Qualifier 2: User

generic-name: Specify the generic name of the user name of the job to be watched. A generic name is a character string of one or more characters followed by an asterisk (*); for example, ABC*. The asterisk substitutes for any valid characters. A generic user name specifies all jobs with the specified job name and with user names that begin with the generic prefix.
name: Specify the user name of the job to be watched.

Qualifier 3: Number

*ALL: All jobs with the specified job name and user name are watched.
000001-999999: Specify the job number to further qualify the job name and user name. You cannot specify a job number if a generic job name or a generic user name qualifier is specified.

Watch for LIC log entry (WCHLICLOG)

Specifies up to five licensed internal code (LIC) log entry identifiers which are to be watched for. Each LIC log entry contains a major and a minor code. The watched for condition will be met if a LIC log entry is added that matches the specified major and minor codes and any comparison data specified. When the watched for log entry is added to the LIC log, the trace exit program is called, even when the comparison data specified does not match; if no trace exit program is defined, the trace stops.

Single values

*NONE: No LIC log entries will be watched for.

Element 1: Major code

*ALL: Any LIC log entry major code will be considered to be a match. If *ALL is specified for the major code, you cannot specify *ALL for the LIC log entry minor code.
character-value: Specify the LIC log major code to be watched for. You can specify either a hexadecimal digit or a question mark for each character in the four-digit code. A question mark is a wildcard character that will match any digit in that position. Up to three wildcard characters can be specified.

Element 2: Minor code

*ALL: Any LIC log entry minor code will be considered to be a match. If *ALL is specified for the minor code, you cannot specify *ALL for the LIC log entry major code.
character-value: Specify the LIC log minor code to be watched for. You can specify either a hexadecimal digit or a question mark for each character in the four-digit code. A question mark is a wildcard character that will match any digit in that position. Up to three wildcard characters can be specified.

Element 3: Comparison data

Specify comparison data to be used if a log entry matching the specified major and minor codes is added to the licensed internal code (LIC) log. If this text is found in the LIC log entry data fields of the watched for log entry, the watched for condition is true. If this text is not found in the LIC log entry data fields of the watched for log entry and no exit program is specified on the TRCPGM parameter, the trace function continues. If the log entry matches the specified major and minor codes and an exit program is specified on the TRCPGM parameter, but the entry data does not contain the specified text, the exit program is called to determine if the trace should continue or stop.

*NONE: No comparison data is specified. If a LIC log entry matching the specified major and minor codes is added to the LIC log, the watched for condition is true.
character-value: Specify the text string used to compare against the entry data of the watched for log entry. If this text is found in the LIC log entry data fields compared of a watched for log entry, the watch condition is considered to be true. This text is case sensitive. The LIC log fields which can be compared are TDE number, task name, server type, job name, user ID, job number, thread ID, exception ID, LIC module compile timestamp, LIC module offset, LIC module RU name, LIC module name, LIC module entry point name. The comparison data cannot be used to match across two fields, and can match an entire field or a substring of any field.
When watching for an exception ID, all four hexadecimal digits of the exception ID must be specified. Also, the prefix MCH may be specified if you want to compare only against the exception ID field and avoid possible substring matches with the other fields.

Trace program (TRCPGM)

Specifies the program to be called for user-defined trace commands and procedures.

The trace program will be called:

Before the application trace starts.
After a match of a message identifier specified for the WCHMSG parameter, or a match of a Licensed Internal Code (LIC) log entry specified for the WCHLICLOG parameter occurs.
When the time interval specified on the TRCPGMITV parameter is reached.
When the length of time to watch specified on WCHTIMO parameter is reached.

There are three input parameters and one output parameter associated with the trace program. The four parameters are required:

1   Trace option setting   Input    Char(10)
2   Reserved               Input    Char(10)
3   Error detected         Output   Char(10)
4   Comparison data        Input    Char(*)

Allowed values for the "Trace option setting" parameter are:

*ON: The watch for trace facility is starting when the collection of trace information is started.
*MSGID: A match on a message id specified on WCHMSG parameter occurred.
*LICLOG: A match on a LIC log specified on the WCHLICLOG parameter occurred.
*CMPDATA: The major and minor code of a LIC log matched, but the comparison data did not.
*INTVAL: The time interval specified on TRCPGMITV parameter is elapsed.
*WCHTIMO: The length of time to watch specified on WCHTIMO parameter is elapsed.

The "Reserved" parameter must be set to blanks.

Allowed values for the "Error detected" parameter are:

*CONTINUE: The trace and the watch for trace event facility will continue running.
*STOP: The trace and the watch for trace event facility will be ended.
*ERROR: Error detected by customer trace program.

Allowed values for the "Comparison data" parameter when *MSGID is specified for the "Trace option setting" parameter will be the following structure:

OFFSET     TYPE         FIELD
Dec Hex
 0   0     BINARY(4)    Length of trace information
 4   4     CHAR(7)      Message ID
11   B     CHAR(9)      Reserved
20  14     BINARY(4)    Offset to comparison data
24  18     BINARY(4)    Length of comparison data
 *   *     CHAR(*)      Message comparison data

Allowed values for the "Comparison data" parameter when *LICLOG or *CMPDATA is specified for the "Trace option setting" parameter will be the following structure:

OFFSET     TYPE         FIELD
Dec Hex
 0   0     BINARY(4)    Length of trace information
 4   4     CHAR(4)      LIC Log major code
 8   8     CHAR(4)      LIC Log minor code
12   C     CHAR(8)      LIC Log identifier
20  14     BINARY(4)    Offset to comparison data
24  18     BINARY(4)    Length of comparison data
 *   *     CHAR(*)      LIC log comparison data

Allowed values for the "Comparison data" parameter when *ON, *INTVAL or *WCHTIMO is specified for the "Trace option setting" parameter will be the following structure:

OFFSET     TYPE         FIELD
Dec Hex
 0   0     BINARY(4)    Length of trace information (always 4).

For more information on the trace exit program interface, refer to the System API Reference information in the iSeries Information Center at http://www.iseries.ibm.com/infocenter .

Single values

*NONE: No trace exit program is defined. If a watched for message or licensed internal code (LIC) log entry is added, or if the specified watch time limit is exceeded, the trace function ends.

Qualifier 1: Trace program

name: Specify the name of the trace exit program.

Qualifier 2: Library

*LIBL: All libraries in the job's library list are searched until the first match is found.
name: Specify the name of the library where the user exit program is located.

Examples

Example 1: Starting SSL Traces

TRCCNN   SET(*ON)  TRCTYPE(*SSL)

This command starts tracing for Secure Sockets Layer (SSL) connections.

Example 2: Starting IP Traces

TRCCNN   SET(*ON)  TRCTYPE(*IP)

This command starts tracing for connections at the internet protocol (IP) level.

Example 3: Stopping Traces and Clearing Trace Storage

TRCCNN   SET(*END)

This command stops all traces and deletes the trace table. No spooled output is generated.

Example 4: Printing Traces

TRCCNN   SET(*OFF)

This command stops all traces and generates a spooled file (QPCSMTRC) that contains the trace records collected by the TRCINT (Trace Internal) command, and a spooled file (QSYSPRT) that contains the formatted trace data.

Example 5: Formatting Trace Data from TRCINT Command

TRCINT   SET(*ON)  TRCTYPE(*SCK)
TRCINT   SET(*OFF)
TRCCNN   SET(*FORMAT)  TRCTYPE(*SSL)  JOB(*)  SPLNBR(*LAST)

The TRCINT (Trace Internal) commands are used to start collecting trace records related to all usage of sockets, and to stop collecting trace records and create a spooled file named QPCSMPRT. The TRCCNN command will use the trace information in the last spooled file named QPCSMPRT for the current job, and format the trace records related to SSL (Secure Sockets Layer) in a spooled file named QSYSPRT.

Example 6: Specifying a Trace Table

TRCCNN   SET(*ON)  TRCTYPE(*IP)  TRCTBL(USER)

This command starts tracing for connections at the internet protocol (IP) level and stores the trace data in the USER trace table.

Example 7: Specifying a Trace Table Size in Megabytes

TRCCNN   SET(*ON)  TRCTYPE(*IP)  SIZE(20000 *MB)

This command starts tracing for connections at the internet protocol (IP) level and stores the data in a 20000-megabyte trace table.

Example 8: Specifying a CCSID for Trace Data

TRCCNN   SET(*OFF)  CCSID(*ASCII)

This command stops all traces and generates a spooled file (QSYSPRT). ASCII (819) CCSID will be used when formatting the trace data.

Example 9: Start a Trace and Watch for a Message to End the Trace

TRCCNN   SET(*ON) TRCTYPE(*IP)  WCHMSG((MCH2804))
         WCHMSGQ((*SYSOPR) (*JOBLOG))
         WCHJOB((*ALL/MYUSER/MYJOBNAME))
         TRCPGM(MYLIB/TRCEXTPGM)

This command starts tracing for connections at the internet protocol (IP) level. The trace will be ended when MCH2804 message is found on the System Operator message queue or within the *ALL/MYUSER/MYJOBNAME job log. Also, MYLIB/TRCEXTPGM is specified as a trace exit program.

Example 10: Start a Trace and Watch for a LIC Log Entry to End the Trace

TRCCNN   SET(*ON) TRCTYPE(*IP)
         WCHLICLOG(('99??' 9932 MYJOBNAME))
         WCHTIMO(*NOMAX)

This command starts tracing for connections at the internet protocol (IP) level. The trace will be ended when a Licensed Internal Code (LIC) log entry that has a major code starting with 99 and a minor code of 9932 is generated on the system. Also, the LIC log information should contain the text "MYJOBNAME". *NOMAX on WCHTIMO parameter indicates that the trace will be active until the event occurs or TRCCNN command is issued manually to end the trace.