I can give you whatever level of detail you want on this question. The IP address (IPv6, but easy to make into an IPv4 address) is in the Type 119 record, subtype "SNA Initiation." The format is IIRC in one of the Comm Server books. I can find it if you need.
The SNA Init record will give you the SNA "virtual terminal" LU name which in turn shows up everywhere else: in the SMF Type 30 TSO session init record, as the "Port of Entry" in various RACF events, and so forth. The Type 119 SNA Init record is the "missing link" between the IP address and everything else. Any recent release of z/OS -- all about the same in this regard. Not sure what level of detail you are looking for or what your level of knowledge is, or whether you are looking for a "solution" or coding tips or what. Please follow up for more information. Write me off-line if you wish. I write code for a vendor. If you would like an out-of-the-box packaged solution that audits logons and a whoooole lot more, take a look at https://correlog.com/solutions-and-services/sas-correlog-mainframe.html. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of mf db Sent: Friday, July 12, 2013 8:53 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: SMF record - IPADDR Hello, Apology if this was question was repetitive. Is it possible to fetch Users Logon detail based on IPADDR from SMF ? IPADDR is the source IP from where the users open up the IBM 3270 emulator. The objective is for User logon id audit. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
