IBM Support

TRCCNN - When to Use It, How to Start It, How to End It, and How to Know If It Is Active

Technote (troubleshooting)


TRCCNN collects all of the information that a communications trace collects. Unlike the communications trace, TRCCNN does not drop frames on high speed adapters. In addition, TRCCNN can be used without entering SST.

Resolving the problem

When to Use TRCCNN

Use of the TRCCNN command is preferable to using a communications trace. It collects all of the valid frames of information that a communications trace collects. Unlike the communications trace, TRCCNN does not drop frames on high speed adapters and it does not log malformed frames of information (note that this can make this tool a poor choice if there is a problem with corrupted or damaged frames). TRCCNN can be used without entering SST (if a user does not know the SST user ID and password); however, the user must have still have all of the special authorities required to take traces.

How to Start TRCCNN


Use one of the following commands:

Note: TRCCNN SET(*ON) might take a long time to run, this time is the time taken to create the LIC trace table. It might keep the emulation session input inhibited for several seconds.

Example 1:

MyTraceCNN is the name given to the trace table, the LIC table that the trace data is saved in. The trace is filtered for the TCP/IP address of a PC at This example traces all line descriptions and all interfaces on the iSeries system.



1. The amount of storage specified by SIZE parameter is immediately allocated from the system auxiliary storage pool (ASP 1). This storage space is not dynamically allocated as it is needed. This storage space will not be available for use by the system except to record trace-related information. Because the maximum trace size is 258048 megabytes, the *MAX setting should be used with care (or better yet, not used at all). Before specifying *MAX or any other large value on this parameter, the amount of free space in the system ASP should be checked. Use the Work with System Status (WRKSYSSTS) command to determine the amount of available free space in the system ASP. System performance degradation can result if the size of the free space in the system ASP is significantly reduced as a result of the value specified.

After the trace is complete and the user that started the trace logs off of the emulation session, the trace table is removed. However, it is unknown (at this time) if all of the allocated space is freed up or not. If storage does not appear to have been freed up at all, it is possible that the trace table was not deleted. SST, Option 1 (Start a service tool), and Option 2 (Trace Licensed Internal Code) can be used to manually delete the trace table. This will free up at least some of the allocated storage. It can take several minutes to delete the trace, and users appear to be unable to access the WRKSYSSTS screen while the trace is being deleted.
2. 1 Gig should be sufficient in nearly every situation.

Example 2:

The second example is similar to Example 1 but shows the trace size set to 500 Meg and the trace filtered for only the ETHLINE line description.


NOTE: Specifying a line description can cause the resulting trace to only show 1/2 of the connection. If the system has multiple network adapters which are connected to the same network, the system will typically send on one adapter and receive on the other, so specifying a line description causes the trace to only capture sends or receives, not both, this renders the trace useless.

Example 3:

This example will trace all activity over all TCP/IP addresses. It will trace all active line descriptions and interfaces on the system.


Example 4:

This example shows how to trace TCP activity over loopback. It is useful for tracing IBM® Toolbox for Java™ activity running on OS/400 or i5/OS.


Example 5:

This example shows how to trace TCP for one IP address and have the trace stop and print when a predefined message is logged to the specified message queue. In this example the trace will stop as soon as the message SQL7008 is logged in any QZDASOINIT job. Note that if the message SQL7008 appears in ANY QZDASOINIT job, this trace will stop and print.


If it is necessary to only have the trace stop when the message occurs in a job that is servicing a connection from a specific IP address that can be done but there would be some additional setup. First a custom subsystem needs to be created and the system configured so that connections from our target IP address are serviced by jobs in the custom subsystem rather than the default. To follow this example using the database host server, the QZDASOINIT prestart job entry in that custom subsystem could be changed so that the job name is something other than QZDASOINIT. For example I created a copy of QUSRWRK and called it ODBCWRK. I then modify the prestart job entry so that the job name will be ODBCSOINIT: CHGPJE SBSD(ODBCWRK) PGM(QZDASOINIT) JOB(ODBCSOINIT) Then any user that is routed to that subsystem will have their database host server jobs serviced by ODBCSOINIT jobs. See Rochester Support Center knowledgebase document N1014359 for details on how to set up an environment where you route connections from one IP address to their own subsystem. The trace command above is modified now so that the job name is now ODBCSOINIT instead of QZDASOINIT:


Example 6:

This example shows how to trace secure connections which are using TLS (Transaction Layer Security), formerly known as SSL (Secure Socket Layer). The only real difference here is that the trace type is set to *SSL instead of *IP so that the unencrypted data are traced.



Starting in 7.1, the TRCCNN command has an option to create its output in a stream file in a packet capture format which can be read using Wireshark and similar tools. Be certain that PTFs MF59955 for 7.1 or MF59962 for 7.2 are applied to the system before dumping the trace this way or record may be missing from the trace. This output is smaller, more portable and should be the preferred method for any system that is not running 6.1 or earlier. Here is how to stop the trace and create the packet capture (PCAP) output:


This will create a file in the root of the IFS named trccnn.pcap and the *YES option will cause the file to be overwritten if it already existed. This stream file can be copied to a PC using a mapped network drive, System i Navigator, or ftp.

On older releases of IBM i, the output of the TRCCNN is to print and this creates larger files and takes considerably longer to complete. Here are some examples of how to stop the trace and create printed output:


TRCCNN *OFF produces two spooled files. The first spooled file is named QPCSMPRT and contains the LIC Trace data. The second spooled file is named QSYSPRT, has User data of TRCCNN, and is formatted similar to a communications trace. Both formats can be used by IBM support but QPCSMPRT is preferred because it includes the TDE information. Unless otherwise instructed, both spooled files should be sent to IBM support.

If TRCCNN is taken between the IBM System i products system and an ASCII device (such as a printer) it should be ended as follows so that the formatted version of the trace has the eyecatcher information formatted as ASCII (note this makes no difference if you are using CTT to examine the traces):


1. Specify FMTDTA *CALC. This appears to format all data.
2. TRCCNN SET(*OFF) takes a very long time to run. It may keep the emulation session input inhibited for several minutes. You may want to submit the job to end the trace to prevent locking up your interactive session.
3. If the trace is formatted with the incorrect CCSID option, an IBM internal tool such as CTT or SPTLIB can be used to convert the eyecatcher to the appropriate code page.

Creating a Packet Capture Stream File From Printed TRCCNN Output

In the event that you have a spooled file as the output of the TRCCNN command, the QSYSPRT spooled file can be used to create a packet capture format stream file using the CVTTRCCNN command which is part of the IBM i support library which can be obtained as a save file from here:
To use that tool, first add QSPTLIB to your library list: ADDLIBLE QSPTLIB
Then enter the command CVTTRCCNN and prompt it using the F4 key to provide the details. The simplest case where you started and stopped the trace in the same job and only have one QSYSPRT spooled file would be: CVTTRCCNN SPLF(QSYSPRT) OUTF('/trccnn.pcap')

Determining If a TRCCNN Is Active on the System

The easiest way to determine if a trace is active is simply to use the command WRKTRC *LIC; however, that command is new in V5R4. On older releases, it is necessary to go into SST and check for the LIC trace. Do the following:
1. On the operating system command line, type the following:


Press the Enter key.
2. Type the SST user ID and password at the prompt.
3. Select Option 1, Start a Service Tool, and press the Enter key.
4. Select Option 2, Trace Licensed Internal Code, and press the Enter key.
5. Look for a trace by the same name as the TRCTBL setting that was used when you ran the TRCCNN *ON (in the example above, TRCTBL(MyTraceCNN). If the status of the LIC trace entitled MyTraceCNN is ACTIVE, the TRCCNN is still running (unless, of course, you or someone else came into SST and specifically activated a LIC trace by the name of MyTraceCNN). If the MyTraceCNN Trace is in some status other than ACTIVE, it is still in the process of being started or of being stopped. Once TRCCNN *OFF completes, the MyTraceCNN Trace will disappear from the list of LIC Traces.
Tracing Multiple clients with TRCCNN

To trace multiple clients with TRCCNN you need to run multiple traces, you cannot filter the trace for more than one remote IP address.



A unique trace table will be generated for each SST for each session.

Delivering the Trace to IBM

If you created a stream file from the TRCCNN, simply copy it to a PC using a mapped drive, System i Navigator or ftp. Then upload it to the Enhanced Customer Data Repository (ECUREP) using the Web tool at

The spooled files can be transferred to the PC as text files (do not convert them to PDF format) through System i Navigator:
  1. Open System i Navigator.
  2. Expand your system.
  3. Expand Basic Operations and click on Printer Output.
  4. If you are not signed on to System i Access with the same profile that was used to collect the traces, press the F11 key and change the value in "Users:" from "Current user" to the user profile that ran the TRCCNN command.
  5. If you click on the "Created" column two times, it will sort the most recently created spooled files to the top of the list, making them easier to find.
  6. Drag and drop the QPCSMPRT file directly to your PC or right-click on the spooled file and select Export to copy the file to your PC.

Or you can copy the output queue to your PC in a save file format using the information in the following document:

N1015044: Saving an Output Queue with SPLFDTA(*ALL) to Send Spooled Files to Software Support

Once you have the data on a PC, you can upload it to the Enhanced Customer Data Repository (ECUREP) using the Web tool at

Historical Number


Document information

More support for: IBM i
Host Servers

Software version: Version Independent

Operating system(s): IBM i

Reference #: N1019273

Modified date: 25 June 2013

Translate this page: