Replying to both @Gil and @Brian below. If reading about this morning's logon tomorrow is good enough, then all you need is SMF and any one of dozens of SMF reporting options. If you saw Phil Young's security keynote at SHARE you might not think 24 hours later was soon enough.
If you want to go the SMF route, no need to write an exit. SMF Type 119, subtype 20 contains the remote and local IP addresses and the TN3270 LU name. Subtype 21 contains the above plus byte counts and some other details. You need to turn SMF Type 119 on in two places: the usual SMFPRMxx plus SMFCONFIG TYPE119 TCPINIT TCPTERM TN3270CLIENT in your TCP/IP stack profile dataset. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Brian Westerman Sent: Tuesday, March 20, 2018 10:29 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: which 3270 terminal It would depend upon which IP's you are trying to keep track of. You can control the outside IP's as to which which inside LU's they are allowed to use and you can assign them one to one if you wish via LUGROUP and LUMAP in your TN3270 profile. If you don't want to "control" who gets what, and only wish to monitor what incoming IP's are coming in, assuming they are going ot get an LU at some point (and what LU they get if you want), then you can use the TN3270 LU exit, which has the incoming IP in Register 1 when the function code in Register 0 is "01- assign). At that point in time you could generate a WTO of the parts you're interested in, or generate an SMF record (sort of like FTCHKIP does for FTP). ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
