SMF 119 record subtypes
TCP/IP collects SMF information about certain Telnet, FTP, TCP/IP stack, IKE daemon, CSSMTP, or VTAM® 3270 Intrusion Detection activity. These records can be generated by the TCP/IP stack, the FTP and Telnet clients and server, the IKE daemon, the CSSMTP client, or VTAM. You can control the collection of some of these records by using the SMFCONFIG statements in PROFILE.TCPIP, or by using statements in the various application's configuration files. For more information about those statements, see z/OS Communications Server: IP Configuration Reference.
All the records described in this topic are written using record type 119 (X'77'), and standard subtype values, at offset 22 (X'16') in SMF record header, are used to uniquely identify the type of record being collected. Table 1 correlates the subtype information to the type of record being produced.
- The TCP/IP component indicated is the one reported in the TCP/IP identification section for each record (see the following sections).
- The Reason indicated determines whether each record is an event record (it is flagged with a reason code of X'08'; in the TCP/IP identification section) or an interval record (it is flagged with one of the six interval reason codes in the TCP/IP identification section).
- The OpenSSH element of z/OS® also creates SMF 119 records with subtypes of 94 through 98. For a description of these records, see z/OS OpenSSH User's Guide.
- VTAM also creates SMF 119 records with a subtype of 81.