Hi Igor,
Thanks for your query.
The FLAGS field in the FILEDET record can show multiple flags, so it would be possible to have 'OC' in there for an open, corrupt file. Thus if you wanted to alert on closed corrupt files, you could use a where clause of FLAGS CONTAINS "C" AND FLAGS NOT CONTAINS "O".
There's only a slight limitation with this approach; the FILEDET record is collected progressively over the DISC interval, and there's no way of telling at which point in that interval any particular file will be sampled. So it's possible that the file could be opened when sampled (and so would show the O flag) but closed by the end of the interval. Conversely, it could be closed when sampled, but opened before or after the sampling - but it would show without the O flag.
Depending on the nature of the files and the problem you are detecting, then this is perhaps not an issue, but it's something to keep in mind.
I hope this information helps.
Cheers,
Mick Dean