Re: IND$FILE Resource Log & Monitoring

[Shmuel Metz (Seymour J.)]

In <003001d0a50d$5ff67690$1fe363b0$@mcn.org>, on 06/12/2015
   at 05:43 AM, Charles Mills  said:

>IBM never documented the IND$FILE protocol either.

The added information to 3270 Data streams. t may not be the
comprehensive documentation that we want, but it is documentation.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Shmuel Metz (Seymour J.)]

In
,
on 06/11/2015
   at 02:58 PM, John McKown  said:

>'m a tad confused by this statement.

The fact that you are running in a 3270 dession does not take away TSO
commands. In particular, it doesn't take away FTP.

>The only file transfer that I am aware of over a 3270 data stream

The fact that IND$FILE uses the TSO data stream doesn't mean that
every other file transfer command must do so.

>I guess that my assumption was that the emulator in question in
>"from commands given on emulators" was a 3270 emulator.

You assumed more than that; you assumed that the data transfer was
over the 3270 session. If it's not, than you need additional tracking.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Charles Mills]

I of course meant it as a total compliment. 


CharlesSent from a mobile; please excuse the brevity

 Original message 
From: John McKown  
Date: 06/12/2015  5:57 AM  (GMT-08:00) 
To: IBM-MAIN@LISTSERV.UA.EDU 
Subject: Re: IND$FILE Resource Log & Monitoring 

On Fri, Jun 12, 2015 at 7:43 AM, Charles Mills  wrote:

> @John, you're a hacker, don't let that stop you. Go git 'em! IBM never
> documented the IND$FILE protocol either.
>

​I'll take that as a "white hat" and not "black hat" type hacker.
Unfortunately(?), my current boss has managed to really curb my tendency to
do non-GUPI work any more. I guess that I could see about establishing a
WSA session between z/OS and my Windows 7 desktop, and trace the IP packets
using "tcpdump" on my Linux desktop. I might see something "interesting".​



>
> Charles
>
> -Original Message-
> From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
> Behalf Of John McKown
> Sent: Friday, June 12, 2015 5:27 AM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: IND$FILE Resource Log & Monitoring
>
> On Fri, Jun 12, 2015 at 7:20 AM, Charles Mills  wrote:
>
> > I have never used it. Others? Is it a "popular" solution?
> >
>
> ​It ain't nun too popular with this-here Linux user (slipping into Texan
> speak).​ I wish that IBM would document the protocol so that others could
> use it as a generic(?) interface. But that isn't going to happen. You can't
> make money if you let people out of your silo. IBM, MS, and Apple are all
> very aware of this, and do their best to keep _their_ property (uh,
> customers) from "wandering off". Yea, I'm in a bad mood this morning.
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>



-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Itschak Mugzach]

the way i would protect IND$FILE is by naming a rexx that name. The rexx
will parse the variables, do what you want to do with (check the user has
the appropriate "platform move" authority, report, etc) and then call (the
renamed) IND%FILE.
FTP has exit points (and products that uses them to protect FTP server side
(Z/OS). haven;t look at the ISPF client, but am sure there is a mechanism
to protect platform movements and data leakage in general. BTW, you can
block SMTP attachments as well.

But as others said, there are many way for your data (and code) to leak, so
any product you put in is a subject for leak check.

ITschak

ITschak Mugzach
Z/OS, ISV Products and Application Security & Risk Assessments Professional

On Fri, Jun 12, 2015 at 3:57 PM, John McKown 
wrote:

> On Fri, Jun 12, 2015 at 7:43 AM, Charles Mills  wrote:
>
> > @John, you're a hacker, don't let that stop you. Go git 'em! IBM never
> > documented the IND$FILE protocol either.
> >
>
> ​I'll take that as a "white hat" and not "black hat" type hacker.
> Unfortunately(?), my current boss has managed to really curb my tendency to
> do non-GUPI work any more. I guess that I could see about establishing a
> WSA session between z/OS and my Windows 7 desktop, and trace the IP packets
> using "tcpdump" on my Linux desktop. I might see something "interesting".​
>
>
>
> >
> > Charles
> >
> > -Original Message-
> > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
> > Behalf Of John McKown
> > Sent: Friday, June 12, 2015 5:27 AM
> > To: IBM-MAIN@LISTSERV.UA.EDU
> > Subject: Re: IND$FILE Resource Log & Monitoring
> >
> > On Fri, Jun 12, 2015 at 7:20 AM, Charles Mills  wrote:
> >
> > > I have never used it. Others? Is it a "popular" solution?
> > >
> >
> > ​It ain't nun too popular with this-here Linux user (slipping into Texan
> > speak).​ I wish that IBM would document the protocol so that others could
> > use it as a generic(?) interface. But that isn't going to happen. You
> can't
> > make money if you let people out of your silo. IBM, MS, and Apple are all
> > very aware of this, and do their best to keep _their_ property (uh,
> > customers) from "wandering off". Yea, I'm in a bad mood this morning.
> >
> > --
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> >
>
>
>
> --
> Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.
>
> My sister opened a computer store in Hawaii. She sells C shells down by the
> seashore.
> If someone tell you that nothing is impossible:
> Ask him to dribble a football.
>
> He's about as useful as a wax frying pan.
>
> 10 to the 12th power microphones = 1 Megaphone
>
> Maranatha! <><
> John McKown
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Fri, Jun 12, 2015 at 7:43 AM, Charles Mills  wrote:

> @John, you're a hacker, don't let that stop you. Go git 'em! IBM never
> documented the IND$FILE protocol either.
>

​I'll take that as a "white hat" and not "black hat" type hacker.
Unfortunately(?), my current boss has managed to really curb my tendency to
do non-GUPI work any more. I guess that I could see about establishing a
WSA session between z/OS and my Windows 7 desktop, and trace the IP packets
using "tcpdump" on my Linux desktop. I might see something "interesting".​



>
> Charles
>
> -Original Message-
> From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
> Behalf Of John McKown
> Sent: Friday, June 12, 2015 5:27 AM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: IND$FILE Resource Log & Monitoring
>
> On Fri, Jun 12, 2015 at 7:20 AM, Charles Mills  wrote:
>
> > I have never used it. Others? Is it a "popular" solution?
> >
>
> ​It ain't nun too popular with this-here Linux user (slipping into Texan
> speak).​ I wish that IBM would document the protocol so that others could
> use it as a generic(?) interface. But that isn't going to happen. You can't
> make money if you let people out of your silo. IBM, MS, and Apple are all
> very aware of this, and do their best to keep _their_ property (uh,
> customers) from "wandering off". Yea, I'm in a bad mood this morning.
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>



-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Charles Mills]

@John, you're a hacker, don't let that stop you. Go git 'em! IBM never 
documented the IND$FILE protocol either.

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of John McKown
Sent: Friday, June 12, 2015 5:27 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IND$FILE Resource Log & Monitoring

On Fri, Jun 12, 2015 at 7:20 AM, Charles Mills  wrote:

> I have never used it. Others? Is it a "popular" solution?
>

​It ain't nun too popular with this-here Linux user (slipping into Texan 
speak).​ I wish that IBM would document the protocol so that others could use 
it as a generic(?) interface. But that isn't going to happen. You can't make 
money if you let people out of your silo. IBM, MS, and Apple are all very aware 
of this, and do their best to keep _their_ property (uh,
customers) from "wandering off". Yea, I'm in a bad mood this morning.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Fri, Jun 12, 2015 at 7:20 AM, Charles Mills  wrote:

> I have never used it. Others? Is it a "popular" solution?
>

​It ain't nun too popular with this-here Linux user (slipping into Texan
speak).​ I wish that IBM would document the protocol so that others could
use it as a generic(?) interface. But that isn't going to happen. You can't
make money if you let people out of your silo. IBM, MS, and Apple are all
very aware of this, and do their best to keep _their_ property (uh,
customers) from "wandering off". Yea, I'm in a bad mood this morning.



>
> Charles
>
>
-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Charles Mills]

I have never used it. Others? Is it a "popular" solution?

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Tom Marchant
Sent: Friday, June 12, 2015 5:13 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IND$FILE Resource Log & Monitoring

On Thu, 11 Jun 2015 15:01:22 -0700, Charles Mills wrote:

>FTP transfers are well-auditable via SMF 118/119, unlike IND$FILE. 
>This list of things it won't catch is, after all, nearly infinite. 

One that I didn't see in this thread is the use of the ISPF Workstation Agent. 
It is my tool of choice whenever I need to transfer a file. It is easy, fast 
and supported by an ISPF dialog.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Tom Marchant]

On Thu, 11 Jun 2015 15:01:22 -0700, Charles Mills wrote:

>FTP transfers are well-auditable via SMF 118/119, unlike IND$FILE. 
>This list of things it won't catch is, after all, nearly infinite. 

One that I didn't see in this thread is the use of the ISPF Workstation 
Agent. It is my tool of choice whenever I need to transfer a file. It is 
easy, fast and supported by an ISPF dialog.

-- 
Tom Marchant

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Shmuel Metz (Seymour J.)]

In
,
on 06/11/2015
   at 02:08 PM, John McKown  said:

> Note that it does not _require_ APF authorization to run. You can
>get the logging only by simply linking it into a STEPLIB in a special
>TSO logon proc.

Why not use any of the supported methods for getting a dynamic
TASKLIB?
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Shmuel Metz (Seymour J.)]

In
,
on 06/11/2015
   at 01:31 PM, John McKown  said:

>The IBM IND$FILE function basically runs a TSO command  from the
>READY prompt.

IM has never supported INF$FILE from the READY prompt, only from
applications with supported file transfer using it.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Ted MacNEIL]

It was the TV show.

-
-teD
-
  Original Message  
From: Tony's Outlook via Mozilla
Sent: Thursday, June 11, 2015 22:11
To: IBM-MAIN@LISTSERV.UA.EDU
Reply To: IBM Mainframe Discussion List
Subject: Re: IND$FILE Resource Log & Monitoring

Not wishing to be a Black Hat and not wanting to think like a White Hat, 
let me don my Gray Hat. If I wanted to send a PDS member containing 
source code I'd simply email it. If it were large I'd mail it in pieces.

In the movie Mash, Corporal Radar O'Reilly send a Jeep from Korea to his 
home town in the U.S. in pieces, in small parcels.



On 6/11/2015 12:20 PM, Carlos Cordero wrote:
> Colleagues,
>
> Did somebody has implemented a process for monitor/log IND$FILE command 
> activity focussed on file transmission thru 3270 emulators?, maybe with 
> beta88 software?
>
> Or it must a home-made ad-hoc customization outside of beta88 software?
>
> What I specifically searching for is to detect the file transfer activity 
> executed from commands given on emulators.
>
>
> Many Thanks.
>
>
>
>
>> Date: Sat, 6 Jun 2015 05:59:55 -0400
>> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
>> Subject: Re: Volume consideration and migration for z / OS 2.1
>> To: IBM-MAIN@LISTSERV.UA.EDU
>>
>> Lots of info here:
>> http://www-03.ibm.com/systems/z/os/zos/installation/
>>
>> Couldn't get the Data Sheet to open(404) maybe it's being updated.
>>
>>
>>
>> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time,
>> justmainfra...@gmail.com writes:
>>
>> Any advise on the above would be appreciated.
>>
>>
>> --
>> For IBM-MAIN subscribe / signoff / archive access instructions,
>> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Charles Mills]

Thanks everyone for all of your comments. Let me try to address everything at 
once so as to avoid mailbox clutter.

@John McKown: Yes, to be able to read is ultimately to be able to steal, but we 
want to make it harder for the bad guys. The example I use in presentations is 
the person who has access to the customer list dataset for query purposes. 
Management would like to know if they were downloading the whole file to their 
PC every night.

Thanks also for the kind words. We'd like to think it's good solution. We are 
in contact with the OP. I suspect your price is better but our support is 
probably better. 

@Walt Farrell, right. Fairly simply, if I can browse a (printable character) 
file in ISPF, I can cut and paste it into a file. It would be difficult for a 
many-megabyte file, and it is more likely that someone would use IND$FILE (or 
another tool such as FTP).

@Ed Finnell: I was not aware that some emulators had a built-in FTP capability. 
Makes sense, though. That would be great: FTP is a lot more powerful and writes 
GREAT audit records. Some emulators do not have this capability, including, 
apparently, the emulators in use at several large customers who seem to be 
interested in this capability.

"File transfers from an FTP command in a 3270 session" might also be referring 
to typing TSO FTP 127.1.2.3 ... on the FTP command line to send a file here, 
there or anywhere.

@Shmuel Metz: True, it won't catch FTP transfers. FTP transfers are 
well-auditable via SMF 118/119, unlike IND$FILE. This list of things it won't 
catch is, after all, nearly infinite. 

Charles

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 3:41 PM, Walt Farrell 
wrote:

> On Thu, 11 Jun 2015 16:16:49 -0400, Ed Finnell  wrote:
>
> >Several of the 3270 emulators had a user option for transfer mechanism
> >IND$FILE or FTP. Some had better implementations that others.
>
> And the OP should be aware that it is theoretically possible for a TSO
> user to write his own program (or acquire one elsewhere) that will do data
> transfers via the 3270 data stream, or even to make a copy of IND$FILE and
> change its name to something else if that name is being specifically
> monitored.
>
> Also, monitoring IND$FILE won't stop other mechanisms such as those based
> on screen printing, or TCP/IP communication protocols.
>
> People asking for such monitoring often, in my experience, do not realize
> the other possibilities for data communication. Really, what they should do
> is completely prevent the user from reading the sensitive data. If you let
> a user READ the data and give him access to a TSO or a UNIX session, then
> you should assume that he will be able to transport it elsewhere without
> your knowledge. If you don't want him to be able to do that, you shouldn't
> let him read the data. Monitoring certain easy to use transport mechanisms
> is OK, but it will not catch all the other mechanisms you haven't thought
> about.
>
> --
> Walt
>
>
​As you, and others have said, to be able to READ is to be able to copy
(aka "steal") the data. In my case, the IND$FILE front end was done for two
reason. The first was for performance (compare the start vs. end times) and
some auditing (how much is it used?). The second, the non-swappable, was
due to CPU overload at the time causing "timeouts" on the PC end. IND$FILE
was being used to transfer data even before we had a TCPIP stack on z/OS.
Back them, the 3270 emulation was being done on a Cisco CIP which looked
like a 3174 to z/OS.​


-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Walt Farrell]

On Thu, 11 Jun 2015 16:16:49 -0400, Ed Finnell  wrote:

>Several of the 3270 emulators had a user option for transfer mechanism  
>IND$FILE or FTP. Some had better implementations that others.

And the OP should be aware that it is theoretically possible for a TSO user to 
write his own program (or acquire one elsewhere) that will do data transfers 
via the 3270 data stream, or even to make a copy of IND$FILE and change its 
name to something else if that name is being specifically monitored.

Also, monitoring IND$FILE won't stop other mechanisms such as those based on 
screen printing, or TCP/IP communication protocols.

People asking for such monitoring often, in my experience, do not realize the 
other possibilities for data communication. Really, what they should do is 
completely prevent the user from reading the sensitive data. If you let a user 
READ the data and give him access to a TSO or a UNIX session, then you should 
assume that he will be able to transport it elsewhere without your knowledge. 
If you don't want him to be able to do that, you shouldn't let him read the 
data. Monitoring certain easy to use transport mechanisms is OK, but it will 
not catch all the other mechanisms you haven't thought about.

-- 
Walt

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 3:15 PM, Bob Rutledge 
wrote:

> On 6/11/2015 3:58 PM, John McKown wrote:
>
>> On Thu, Jun 11, 2015 at 2:45 PM, Shmuel Metz (Seymour J.) <
>> shmuel+ibm-m...@patriot.net> wrote:
>>
> ...
>
>> That won't catch file transfers from an FTP command in a 3270 session.
>>>
>>>
>> ​I'm a tad confused by this statement. The only file transfer that I am
>> aware of over a 3270 data stream is via IND$FILE. Is there some other? ​In
>> many (most?) cases, when somebody uses "ftp" by itself, I think of the one
>> for TCP/IP. I am aware that there are other ways to transfer files, such
>> as
>> NJE and AFTP. I guess that my assumption was that the emulator in question
>> in "from commands given on emulators" was a 3270 emulator.
>>
>
> Some TN3270 emulators, WRQ is one, contain FTP client code that they
> optionally use instead of IND$FILE for data transport.
>

​Oh, I think I get it. The ftp is not done via the 3270 data stream. It is
just an easier way to do a "normal" TCP/IP type ftp than bringing up a
command prompt. Maybe a bit like having FileZilla.​



>
> Bob
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>



-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Ed Finnell]

Several of the 3270 emulators had a user option for transfer mechanism  
IND$FILE or FTP. Some had better implementations that others.
 
 
In a message dated 6/11/2015 2:58:19 P.M. Central Daylight Time,  
john.archie.mck...@gmail.com writes:

​I'm a  tad confused by this statement. The only file transfer that I am
aware of  over a 3270 data stream is via IND$FILE. Is there some other? ​In
many  (most?) cases, when somebody uses "ftp" by itself, I think of the one
for  TCP/IP. I am aware that there are other ways to transfer files, such as
NJE  and AFTP. I guess that my assumption was that the emulator in question
in  "from commands given on emulators" was a 3270  emulator.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Bob Rutledge]

On 6/11/2015 3:58 PM, John McKown wrote:

On Thu, Jun 11, 2015 at 2:45 PM, Shmuel Metz (Seymour J.) <
shmuel+ibm-m...@patriot.net> wrote:

...

That won't catch file transfers from an FTP command in a 3270 session.



​I'm a tad confused by this statement. The only file transfer that I am
aware of over a 3270 data stream is via IND$FILE. Is there some other? ​In
many (most?) cases, when somebody uses "ftp" by itself, I think of the one
for TCP/IP. I am aware that there are other ways to transfer files, such as
NJE and AFTP. I guess that my assumption was that the emulator in question
in "from commands given on emulators" was a 3270 emulator.


Some TN3270 emulators, WRQ is one, contain FTP client code that they optionally 
use instead of IND$FILE for data transport.


Bob

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 2:45 PM, Shmuel Metz (Seymour J.) <
shmuel+ibm-m...@patriot.net> wrote:

> In , on 06/11/2015
>at 12:20 PM, Carlos Cordero  said:
>
> >What I specifically searching for is to detect the file transfer
> >activity executed from commands given on emulators.
>
> That won't catch file transfers from an FTP command in a 3270 session.
>

​I'm a tad confused by this statement. The only file transfer that I am
aware of over a 3270 data stream is via IND$FILE. Is there some other? ​In
many (most?) cases, when somebody uses "ftp" by itself, I think of the one
for TCP/IP. I am aware that there are other ways to transfer files, such as
NJE and AFTP. I guess that my assumption was that the emulator in question
in "from commands given on emulators" was a 3270 emulator.



>
> --
>  Shmuel (Seymour J.) Metz, SysProg and JOAT
>

-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Shmuel Metz (Seymour J.)]

In , on 06/11/2015
   at 12:20 PM, Carlos Cordero  said:

>What I specifically searching for is to detect the file transfer
>activity executed from commands given on emulators.

That won't catch file transfers from an FTP command in a 3270 session.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Ted MacNEIL]

What about ftp?

-
-teD
-
  Original Message  
From: Carlos Cordero
Sent: Thursday, June 11, 2015 15:06
To: IBM-MAIN@LISTSERV.UA.EDU
Reply To: IBM Mainframe Discussion List
Subject: Re: IND$FILE Resource Log & Monitoring

Mr. Kolusu, thanks for the info, I will check


Regards

> Date: Thu, 11 Jun 2015 11:20:39 -0700
> From: skol...@us.ibm.com
> Subject: Re: IND$FILE Resource Log & Monitoring
> To: IBM-MAIN@LISTSERV.UA.EDU
> 
> Carlos,
> 
> Here is a link to a previous discussion on IBM-MAIN that might help you. 
> 
> https://groups.google.com/forum/#!topic/bit.listserv.ibm-main/zXHbn7rTp3M
> 
> 
> Thanks,
> Kolusu
> 
> IBM Mainframe Discussion List  wrote on 
> 06/11/2015 11:01:12 AM:
> 
> > From: Carlos Cordero 
> > To: IBM-MAIN@LISTSERV.UA.EDU
> > Date: 06/11/2015 11:03 AM
> > Subject: Re: IND$FILE Resource Log & Monitoring
> > Sent by: IBM Mainframe Discussion List 
> > 
> > Both..
> > 
> > 
> > Thanks
> > 
> > > Date: Thu, 11 Jun 2015 10:58:12 -0700
> > > From: stars...@mindspring.com
> > > Subject: Re: IND$FILE Resource Log & Monitoring
> > > To: IBM-MAIN@LISTSERV.UA.EDU
> > > 
> > > Are you looking for REAL time or after the fact monitoring?
> > > 
> > > Lizette
> > > 
> > > 
> > > -Original Message-
> > > >From: Carlos Cordero 
> > > >Sent: Jun 11, 2015 10:20 AM
> > > >To: IBM-MAIN@LISTSERV.UA.EDU
> > > >Subject: IND$FILE Resource Log & Monitoring
> > > >
> > > >Colleagues,
> > > > 
> > > >Did somebody has implemented a process for monitor/log IND$FILE 
> > command activity focussed on file transmission thru 3270 emulators?,
> > maybe with beta88 software?
> > > > 
> > > >Or it must a home-made ad-hoc customization outside of beta88 
> software?
> > > > 
> > > >What I specifically searching for is to detect the file transfer 
> > activity executed from commands given on emulators.
> > > > 
> > > > 
> > > >Many Thanks.
> > > > 
> > > > 
> > > > 
> > > > 
> > > >> Date: Sat, 6 Jun 2015 05:59:55 -0400
> > > >> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
> > > >> Subject: Re: Volume consideration and migration for z / OS 2.1
> > > >> To: IBM-MAIN@LISTSERV.UA.EDU
> > > >> 
> > > >> Lots of info here:
> > > >> http://www-03.ibm.com/systems/z/os/zos/installation/
> > > >> 
> > > >> Couldn't get the Data Sheet to open(404) maybe it's being updated.
> > > >> 
> > > >> 
> > > >> 
> > > >> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time, 
> > > >> justmainfra...@gmail.com writes:
> > > >> 
> > > >> Any advise on the above would be appreciated.
> > > 
> > > --
> > > For IBM-MAIN subscribe / signoff / archive access instructions,
> > > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > 
> > --
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > 
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 1:54 PM, Carlos Cordero 
wrote:

> John, I very appreciate your help.
>
> If you´re available to share with me your code, ok I can put this on
> development environment and customize it and testing.
>

​The _code_ is available. I'm not. (man am I picky about words!) You, and
anyone else, can give a look at it at:
https://gist.github.com/JohnArchieMckown/2de9d5d8b41095bc5f47​

​Note that it does not _require_ APF authorization to run. You can get the
logging only by simply linking it into a STEPLIB in a special TSO logon
proc. My example links with the name IND@FILE, so you'd need to either
change the NAME card in the link step or rename the module afterwards. If
you don't want the non-swappable, then you can just yank that part of the
code out.

If at all possible, I'd really push for Mr. Mills' product. It sounds to be
a much better way to get this done. But, then, I wrote this code back in
the previous century (created in 1993, last updated in 1998 according to
the ISPF statistics).​



> I´m in touch.
>
>
-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Carlos Cordero]

John, I very appreciate your help. 
 
If you´re available to share with me your code, ok I can put this on 
development environment and customize it and testing.
 
 
 
I´m in touch.
 

 
> Date: Thu, 11 Jun 2015 13:31:47 -0500
> From: john.archie.mck...@gmail.com
> Subject: Re: IND$FILE Resource Log & Monitoring
> To: IBM-MAIN@LISTSERV.UA.EDU
> 
> On Thu, Jun 11, 2015 at 1:01 PM, Carlos Cordero 
> wrote:
> 
> > Both..
> >
> 
> ​I have some code with I can share which _might_ be of some help. But it
> may (most likely _will_) violate your shop's standards. Or cause your boss
> to say "no". The IBM IND$FILE function basically runs a TSO command​ from
> the READY prompt. The 3270 emulator "talks" with this command via the 3270
> data stream, much like a "screen scraping" application. What my code does
> is "front end" the normal IBM code, and simply creates a WTO message to
> send to the z/OS SYSLOG. The WTO contains the TSO id and the TSO command,
> along with a S or E for "Start of transfer" and "End of transfer". This is
> sufficient to tell you who did the transfer and the name of the z/OS data
> set involved.
> 
> It also, if it is APF authorized, makes the TSO session non-swappable.
> 
> Another possibility is to set up RACF auditing on the IND$FILE command, but
> that (in and of itself) will not tell you the name of the DSN involved.
> 
> 
> >
> >
> > Thanks
> >
> >
> -- 
> Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.
> 
> My sister opened a computer store in Hawaii. She sells C shells down by the
> seashore.
> If someone tell you that nothing is impossible:
> Ask him to dribble a football.
> 
> He's about as useful as a wax frying pan.
> 
> 10 to the 12th power microphones = 1 Megaphone
> 
> Maranatha! <><
> John McKown
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
  

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Charles Mills]

CorreLog, my employer, has just started shipping the IND$defender feature
for our SIEM Agent for z/OS. The Agent is described here
https://correlog.com/solutions-and-services/sas-correlog-mainframe.html but
there is AFAIK no information yet on the Web about this particular new
feature. It transparently captures the user ID, direction of transfer,
dataset and member name, the TSO user's logon time, the user's name and
Group, the remote IP address if available, the LU name, and the duration of
the transfer.

We can send this information either through our Agent real-time to the SIEM
of your choice (ArcSight, QRadar, LogRhythm, Splunk, etc.) and/or write it
as a user SMF record, which Dr. Merrill has graciously offered to support in
MXG.

IND$defender is currently offered only as an Agent feature but the SMF
record output is technologically a stand-alone product and I am sure our
sales team would be happy to talk about whatever licensing interested you.

BTW, we do this *without* violating IBM's system integrity guidelines. We do
*not* run IND$FILE APF-authorized, as it was not designed by IBM to be run
authorized.

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
Behalf Of Carlos Cordero
Sent: Thursday, June 11, 2015 10:21 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: IND$FILE Resource Log & Monitoring

Colleagues,
 
Did somebody has implemented a process for monitor/log  IND$FILE command
activity focussed on file transmission thru 3270 emulators?, maybe with
beta88 software?
 
Or it must a home-made ad-hoc customization outside of beta88 software?
 
What I specifically searching for is to detect the file transfer activity
executed from commands given on emulators.
 
 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 12:20 PM, Carlos Cordero 
wrote:

> Colleagues,
>
> Did somebody has implemented a process for monitor/log  IND$FILE command
> activity focussed on file transmission thru 3270 emulators?, maybe with
> beta88 software?
>
> Or it must a home-made ad-hoc customization outside of beta88 software?
>
> What I specifically searching for is to detect the file transfer activity
> executed from commands given on emulators.
>

​If you only need "who did it" and "when did they do it", but not "what did
they do", then you can create a RACF profile for IND$FILE in the PROGRAM
class​ with a UACC(READ) and set

RDEFINE PROGRAM IND$FILE UACC(READ) AUDIT(ALL)

If you need the "what" portion, then you'd need to do some heavy data set
access auditing. And a way to relate the data set access record with the
program access record.

-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 1:27 PM, Tony's Outlook via Mozilla <
tbabo...@outlook.com> wrote:

> Not wishing to be a Black Hat and not wanting to think like a White Hat,
> let me don my Gray Hat.  If I wanted to send a PDS member containing source
> code I'd simply email it.  If it were large I'd mail it in pieces.
>

​I used to do that. Now I just create a GIST on GitHub and share that. What
is nice is that I can direct the "me too" people to the GIST and it doesn't
clog up the email server. Which takes it pretty much out of the normal
monitoring channels. Not that I actually care about that. ​



>
> In the movie Mash, Corporal Radar O'Reilly send a Jeep from Korea to his
> home town in the U.S. in pieces, in small parcels.
>
>
-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[John McKown]

On Thu, Jun 11, 2015 at 1:01 PM, Carlos Cordero 
wrote:

> Both..
>

​I have some code with I can share which _might_ be of some help. But it
may (most likely _will_) violate your shop's standards. Or cause your boss
to say "no". The IBM IND$FILE function basically runs a TSO command​ from
the READY prompt. The 3270 emulator "talks" with this command via the 3270
data stream, much like a "screen scraping" application. What my code does
is "front end" the normal IBM code, and simply creates a WTO message to
send to the z/OS SYSLOG. The WTO contains the TSO id and the TSO command,
along with a S or E for "Start of transfer" and "End of transfer". This is
sufficient to tell you who did the transfer and the name of the z/OS data
set involved.

It also, if it is APF authorized, makes the TSO session non-swappable.

Another possibility is to set up RACF auditing on the IND$FILE command, but
that (in and of itself) will not tell you the name of the DSN involved.


>
>
> Thanks
>
>
-- 
Yoda of Borg, we are. Futile, resistance is, yes. Assimilated, you will be.

My sister opened a computer store in Hawaii. She sells C shells down by the
seashore.
If someone tell you that nothing is impossible:
Ask him to dribble a football.

He's about as useful as a wax frying pan.

10 to the 12th power microphones = 1 Megaphone

Maranatha! <><
John McKown

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Carlos Cordero]

Mr. Kolusu, thanks for the info, I will check
 
 
Regards
 
> Date: Thu, 11 Jun 2015 11:20:39 -0700
> From: skol...@us.ibm.com
> Subject: Re: IND$FILE Resource Log & Monitoring
> To: IBM-MAIN@LISTSERV.UA.EDU
> 
> Carlos,
> 
> Here is a link to a previous discussion on IBM-MAIN that might help you. 
> 
> https://groups.google.com/forum/#!topic/bit.listserv.ibm-main/zXHbn7rTp3M
> 
> 
> Thanks,
> Kolusu
> 
> IBM Mainframe Discussion List  wrote on 
> 06/11/2015 11:01:12 AM:
> 
> > From: Carlos Cordero 
> > To: IBM-MAIN@LISTSERV.UA.EDU
> > Date: 06/11/2015 11:03 AM
> > Subject: Re: IND$FILE Resource Log & Monitoring
> > Sent by: IBM Mainframe Discussion List 
> > 
> > Both..
> > 
> > 
> > Thanks
> > 
> > > Date: Thu, 11 Jun 2015 10:58:12 -0700
> > > From: stars...@mindspring.com
> > > Subject: Re: IND$FILE Resource Log & Monitoring
> > > To: IBM-MAIN@LISTSERV.UA.EDU
> > > 
> > > Are you looking for REAL time or after the fact monitoring?
> > > 
> > > Lizette
> > > 
> > > 
> > > -Original Message-
> > > >From: Carlos Cordero 
> > > >Sent: Jun 11, 2015 10:20 AM
> > > >To: IBM-MAIN@LISTSERV.UA.EDU
> > > >Subject: IND$FILE Resource Log & Monitoring
> > > >
> > > >Colleagues,
> > > > 
> > > >Did somebody has implemented a process for monitor/log  IND$FILE 
> > command activity focussed on file transmission thru 3270 emulators?,
> > maybe with beta88 software?
> > > > 
> > > >Or it must a home-made ad-hoc customization outside of beta88 
> software?
> > > > 
> > > >What I specifically searching for is to detect the file transfer 
> > activity executed from commands given on emulators.
> > > > 
> > > > 
> > > >Many Thanks.
> > > > 
> > > > 
> > > > 
> > > > 
> > > >> Date: Sat, 6 Jun 2015 05:59:55 -0400
> > > >> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
> > > >> Subject: Re: Volume consideration and migration for z / OS 2.1
> > > >> To: IBM-MAIN@LISTSERV.UA.EDU
> > > >> 
> > > >> Lots of info here:
> > > >> http://www-03.ibm.com/systems/z/os/zos/installation/
> > > >> 
> > > >> Couldn't get the Data Sheet to open(404) maybe it's being updated.
> > > >> 
> > > >> 
> > > >> 
> > > >> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time, 
> > > >> justmainfra...@gmail.com writes:
> > > >> 
> > > >> Any  advise on the above would be  appreciated.
> > > 
> > > --
> > > For IBM-MAIN subscribe / signoff / archive access instructions,
> > > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > 
> > --
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > 
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
  
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Tony's Outlook via Mozilla]

Not wishing to be a Black Hat and not wanting to think like a White Hat, 
let me don my Gray Hat.  If I wanted to send a PDS member containing 
source code I'd simply email it.  If it were large I'd mail it in pieces.


In the movie Mash, Corporal Radar O'Reilly send a Jeep from Korea to his 
home town in the U.S. in pieces, in small parcels.




On 6/11/2015 12:20 PM, Carlos Cordero wrote:

Colleagues,

Did somebody has implemented a process for monitor/log  IND$FILE command 
activity focussed on file transmission thru 3270 emulators?, maybe with beta88 
software?

Or it must a home-made ad-hoc customization outside of beta88 software?

What I specifically searching for is to detect the file transfer activity 
executed from commands given on emulators.


Many Thanks.





Date: Sat, 6 Jun 2015 05:59:55 -0400
From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
Subject: Re: Volume consideration and migration for z / OS 2.1
To: IBM-MAIN@LISTSERV.UA.EDU

Lots of info here:
http://www-03.ibm.com/systems/z/os/zos/installation/

Couldn't get the Data Sheet to open(404) maybe it's being updated.



In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time,
justmainfra...@gmail.com writes:

Any  advise on the above would be  appreciated.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Sri h Kolusu]

Carlos,

Here is a link to a previous discussion on IBM-MAIN that might help you. 

https://groups.google.com/forum/#!topic/bit.listserv.ibm-main/zXHbn7rTp3M


Thanks,
Kolusu

IBM Mainframe Discussion List  wrote on 
06/11/2015 11:01:12 AM:

> From: Carlos Cordero 
> To: IBM-MAIN@LISTSERV.UA.EDU
> Date: 06/11/2015 11:03 AM
> Subject: Re: IND$FILE Resource Log & Monitoring
> Sent by: IBM Mainframe Discussion List 
> 
> Both..
> 
> 
> Thanks
> 
> > Date: Thu, 11 Jun 2015 10:58:12 -0700
> > From: stars...@mindspring.com
> > Subject: Re: IND$FILE Resource Log & Monitoring
> > To: IBM-MAIN@LISTSERV.UA.EDU
> > 
> > Are you looking for REAL time or after the fact monitoring?
> > 
> > Lizette
> > 
> > 
> > -Original Message-
> > >From: Carlos Cordero 
> > >Sent: Jun 11, 2015 10:20 AM
> > >To: IBM-MAIN@LISTSERV.UA.EDU
> > >Subject: IND$FILE Resource Log & Monitoring
> > >
> > >Colleagues,
> > > 
> > >Did somebody has implemented a process for monitor/log  IND$FILE 
> command activity focussed on file transmission thru 3270 emulators?,
> maybe with beta88 software?
> > > 
> > >Or it must a home-made ad-hoc customization outside of beta88 
software?
> > > 
> > >What I specifically searching for is to detect the file transfer 
> activity executed from commands given on emulators.
> > > 
> > > 
> > >Many Thanks.
> > > 
> > > 
> > > 
> > > 
> > >> Date: Sat, 6 Jun 2015 05:59:55 -0400
> > >> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
> > >> Subject: Re: Volume consideration and migration for z / OS 2.1
> > >> To: IBM-MAIN@LISTSERV.UA.EDU
> > >> 
> > >> Lots of info here:
> > >> http://www-03.ibm.com/systems/z/os/zos/installation/
> > >> 
> > >> Couldn't get the Data Sheet to open(404) maybe it's being updated.
> > >> 
> > >> 
> > >> 
> > >> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time, 
> > >> justmainfra...@gmail.com writes:
> > >> 
> > >> Any  advise on the above would be  appreciated.
> > 
> > --
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Carlos Cordero]

Both..
 
 
Thanks
 
> Date: Thu, 11 Jun 2015 10:58:12 -0700
> From: stars...@mindspring.com
> Subject: Re: IND$FILE Resource Log & Monitoring
> To: IBM-MAIN@LISTSERV.UA.EDU
> 
> Are you looking for REAL time or after the fact monitoring?
> 
> Lizette
> 
> 
> -Original Message-
> >From: Carlos Cordero 
> >Sent: Jun 11, 2015 10:20 AM
> >To: IBM-MAIN@LISTSERV.UA.EDU
> >Subject: IND$FILE Resource Log & Monitoring
> >
> >Colleagues,
> > 
> >Did somebody has implemented a process for monitor/log  IND$FILE command 
> >activity focussed on file transmission thru 3270 emulators?, maybe with 
> >beta88 software?
> > 
> >Or it must a home-made ad-hoc customization outside of beta88 software?
> > 
> >What I specifically searching for is to detect the file transfer activity 
> >executed from commands given on emulators.
> > 
> > 
> >Many Thanks.
> > 
> > 
> > 
> > 
> >> Date: Sat, 6 Jun 2015 05:59:55 -0400
> >> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
> >> Subject: Re: Volume consideration and migration for z / OS 2.1
> >> To: IBM-MAIN@LISTSERV.UA.EDU
> >> 
> >> Lots of info here:
> >> http://www-03.ibm.com/systems/z/os/zos/installation/
> >>  
> >> Couldn't get the Data Sheet to open(404) maybe it's being updated.
> >>  
> >>  
> >>  
> >> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time,  
> >> justmainfra...@gmail.com writes:
> >> 
> >> Any  advise on the above would be  appreciated.
> 
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
  
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IND$FILE Resource Log & Monitoring

[Lizette Koehler]

Are you looking for REAL time or after the fact monitoring?

Lizette


-Original Message-
>From: Carlos Cordero 
>Sent: Jun 11, 2015 10:20 AM
>To: IBM-MAIN@LISTSERV.UA.EDU
>Subject: IND$FILE Resource Log & Monitoring
>
>Colleagues,
> 
>Did somebody has implemented a process for monitor/log  IND$FILE command 
>activity focussed on file transmission thru 3270 emulators?, maybe with beta88 
>software?
> 
>Or it must a home-made ad-hoc customization outside of beta88 software?
> 
>What I specifically searching for is to detect the file transfer activity 
>executed from commands given on emulators.
> 
> 
>Many Thanks.
> 
> 
> 
> 
>> Date: Sat, 6 Jun 2015 05:59:55 -0400
>> From: 000248cce9f3-dmarc-requ...@listserv.ua.edu
>> Subject: Re: Volume consideration and migration for z / OS 2.1
>> To: IBM-MAIN@LISTSERV.UA.EDU
>> 
>> Lots of info here:
>> http://www-03.ibm.com/systems/z/os/zos/installation/
>>  
>> Couldn't get the Data Sheet to open(404) maybe it's being updated.
>>  
>>  
>>  
>> In a message dated 6/6/2015 2:27:44 A.M. Central Daylight Time,  
>> justmainfra...@gmail.com writes:
>> 
>> Any  advise on the above would be  appreciated.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN