A little follow-up. Verrrry interesting. The record layouts were *formerly* documented in Comm. Server IP Configuration Reference, but they have been removed and don't seem to have surfaced anywhere else. They are in my V1R10 manual but not my V1R13 manual. Anyone know where they went?
There IS a bunch of configuration information in the Config Reference that you are going to have to master if you are going to get TCP/IP to write SMF records. Not the most straightforward configuration, due to changes over the years and backward compatibility. The record sub-type in question is called TN3270E Telnet server SNA session initiation record (subtype 20). In the data section pointed to by the triplet* at offset x'24' you find 0(x'0') SMF119TN_NILU 8 EBCDIC Telnet LU name 20(x'14') SMF119TN_NIRIP 16 Binary Remote IP address *A triplet is a 3-part field consisting of a 32-bit offset, a 16-bit length, and a 16-bit count. There is a discussion in the MVS SMF manual. The manual also says EZASMF77 (physically present in SYS1.MACLIB) produces assembler level DSECTs that can be used to map the various record formats described in this topic. When invoking EZASMF77, the default value creates all the record mappings. Hope this helps. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Charles Mills Sent: Friday, July 12, 2013 9:33 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: SMF record - IPADDR I can give you whatever level of detail you want on this question. The IP address (IPv6, but easy to make into an IPv4 address) is in the Type 119 record, subtype "SNA Initiation." The format is IIRC in one of the Comm Server books. I can find it if you need. The SNA Init record will give you the SNA "virtual terminal" LU name which in turn shows up everywhere else: in the SMF Type 30 TSO session init record, as the "Port of Entry" in various RACF events, and so forth. The Type 119 SNA Init record is the "missing link" between the IP address and everything else. Any recent release of z/OS -- all about the same in this regard. Not sure what level of detail you are looking for or what your level of knowledge is, or whether you are looking for a "solution" or coding tips or what. Please follow up for more information. Write me off-line if you wish. I write code for a vendor. If you would like an out-of-the-box packaged solution that audits logons and a whoooole lot more, take a look at https://correlog.com/solutions-and-services/sas-correlog-mainframe.html. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
