IBM Security Z Security

 View Only
  • 1.  field "terminal" in SMF newlist

    Posted Thu September 15, 2022 01:33 PM
    I perform some tests with "terminal" field in the SMF newlist regarding SMF record type 80
    I observed that sometimes the field is filled but often it's empty .

    I used the following selection in Carla:

    select type=(80,83) event=(1,2,10,13,17,18)

    with a sortlist statement:

    sortlist ,
    '!' system ,
    '!' date(monthday,2) ! date(month,3) ! date(year,4) ,
    '!' time(8) /,
    '!' event ,
    '!' event(3,num) ,
    '!' eventqual ,
    '!' eventdesc /,
    '!' userid ,
    '!' name ,
    '!' appl ,
    '!' terminal ,

    When is the terminal field filled with an non-empty value at all . Is there a rule/condition for it ?

    Best regards

    Ruediger Lukas

  • 2.  RE: field "terminal" in SMF newlist

    Posted Fri September 16, 2022 03:36 AM
    For SMF 80, TERMINAL is derived from SMF80TRM, see.
    46 2E SMF80TRM 8 EBCDIC Terminal ID of foreground user (zero if not available).

    If RACF filled in the field, CARLa shows it.  That would be for sessions where RACINIT had a TERMINAL value specified, such as for TSO, CICS, OMVS and FTP sesssions.  The former take the LU name while the latter could take the hexadecimal value of the IPv4 IP address.

    For other SMF record types, TERMINAL may be filled in directly from the SMF record, or through a table relating the current job to the user ID assigned to the job, aka job tag cache.

    Rob van Hoboken

  • 3.  RE: field "terminal" in SMF newlist

    Posted Fri September 16, 2022 03:57 AM
    Hello Rob,

    thx for clarification and explanation . This helps me .

    Best Regards

    Ruediger Lukas