Considering what you are trying to accomplish, in that you don't care about doing anything about the attempt or connection at the time, then the SMF record should be good for you. You can easily change your daily SMF job to separate out the 119's and then process them at your leisure. You could probably even produce a report that showed where they connected from and to, and how long they were connected if you just subtract the start from the end time.
If you wanted to "do something" then the LU exit would be better. As you only seem to care about CICS and (I think) TSO access, you will only need the LU subtypes, otherwise you should stick with subtypes 1 (&2). Actually it seems kind of interesting to see what the report would show so I might even give this one a shot myself. If you into C programs, there is one that processes the type 119 records on the CBT tape at file 600. Brian On Wed, 21 Mar 2018 07:43:56 -0700, Charles Mills <[email protected]> wrote: >Also > >SMFINIT TYPE119 >SMFTERM TYPE119 > >in the TN3270 profile. > >Sorry -- it's still early here. > >Charles > > >-----Original Message----- >From: IBM Mainframe Discussion List [mailto:[email protected]] On >Behalf Of Charles Mills >Sent: Wednesday, March 21, 2018 7:21 AM >To: [email protected] >Subject: Re: which 3270 terminal > >Replying to both @Gil and @Brian below. > >If reading about this morning's logon tomorrow is good enough, then all you >need is SMF and any one of dozens of SMF reporting options. If you saw Phil >Young's security keynote at SHARE you might not think 24 hours later was soon >enough. > >If you want to go the SMF route, no need to write an exit. SMF Type 119, >subtype 20 contains the remote and local IP addresses and the TN3270 LU name. >Subtype 21 contains the above plus byte counts and some other details. > >You need to turn SMF Type 119 on in two places: the usual SMFPRMxx plus >SMFCONFIG TYPE119 TCPINIT TCPTERM TN3270CLIENT >in your TCP/IP stack profile dataset. > >Charles > > >-----Original Message----- >From: IBM Mainframe Discussion List [mailto:[email protected]] On >Behalf Of Brian Westerman >Sent: Tuesday, March 20, 2018 10:29 PM >To: [email protected] >Subject: Re: which 3270 terminal > >It would depend upon which IP's you are trying to keep track of. You can >control the outside IP's as to which which inside LU's they are allowed to use >and you can assign them one to one if you wish via LUGROUP and LUMAP in your >TN3270 profile. > >If you don't want to "control" who gets what, and only wish to monitor what >incoming IP's are coming in, assuming they are going ot get an LU at some >point (and what LU they get if you want), then you can use the TN3270 LU exit, >which has the incoming IP in Register 1 when the function code in Register 0 >is "01- assign). At that point in time you could generate a WTO of the parts >you're interested in, or generate an SMF record (sort of like FTCHKIP does for >FTP). > >---------------------------------------------------------------------- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to [email protected] with the message: INFO IBM-MAIN > >---------------------------------------------------------------------- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
