TN3270 is what Comm Server calls "Telnet SNA" and is recorded in subtypes 20 and 21.
There are no "files and DS names" involved -- at least not that Comm Server deems worthy of including in SMF. Do you mean files and DS names referenced by the user during his TSO session? Only normal RACF audit and violation events. Do you mean files and DS names for FTP? Recorded in subtypes 3 and 70. Do you mean for TSO IND$FILE transfers? Sorry, no IBM component records any audit information for IND$FILE (other than RACF events as above). My employer's audit product for IND$FILE, IND$defender, is mentioned briefly here: https://www.correlog.com/news-and-events/news2015-SIEM-Agent-IBM-z-OS.html Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Carlos Cordero Sent: Monday, November 09, 2015 1:05 PM To: [email protected] Subject: SMF type 119 to catch TN3270 Hi all, The SMF 119, subtype 20,21,22 and 23 catch events from telnet activitie; but I didn't see wich of these subtypes and theri corresponding offsets can provide me the information of the resource (file/DSN name) involved on the sesión, is this aloowed trough these subtypes?. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
