Not sure about subtype 4, but yes, sure, lots of information is available in lots of subtypes. My question is what is the value of subtypes 94 and 95? There is no way to correlate them with any other subtype, and by themselves they don't seem terribly useful.
Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of patrickfalcone7 Sent: Tuesday, July 17, 2018 10:42 AM To: [email protected] Subject: Re: Am I missing something in SMF 119 SSH subtypes 94 and 95? Think some of this is in subtype 4 Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Charles Mills <[email protected]> Date: 07/17/2018 1:09 PM (GMT-05:00) To: [email protected] Subject: Am I missing something in SMF 119 SSH subtypes 94 and 95? I am looking at SMF 119 subtypes 94 and 95 and they appear to me to be darned near useless. Someone please tell me that I am missing something. Sure, there are all the characteristics of the SSH security. But there is no IP address, no (useful) userid, and no session correlator of any kind. So you know that someone used SSH to do something using particular encryption. But you don't know who, where they connected from or to, or what they did. What is the value? Am I missing something? (Yes, I know about subtypes 96 - 98. I'm not talking about them. I'm asking the value of subtypes 94 and 95.) Charles ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
