5. DATABASE FILES › 5.4 TCP Information Area › 5.4.6 FTP Login Failure File (TCPFLF) › 5.4.6.3 Usage Considerations

5.4.6.3 Usage Considerations

This section identifies special considerations or techniques
related to using the TCPFLF File.  In addition, several
retrieval examples are provided to facilitate the use of this
file.


In the examples, a SAS macro variable is used to specify the
DDname part of the CA MICS file name. These macro variables
are a standard part of CA MICS and are available for all
files. The macro variable name has the form &diiit, where d
is the database identifier, iii is the information area
name, and t is the timespan.  For the examples, a database
identifier of P is used.  The identifier is installation
dependent, so you should find out what the identifiers are at
your installation.

Special Considerations/Techniques

1. The FTP Login Failure File (TCPFLF) is built by selecting
   data from SMF record type 119 subtype 72 (FTP Server login
   failure record).

2. Care must be exercised in using the special date and time
   data elements contained in each CA MICS file. As file
   granularity increases in higher timespans, the following
   fields lose significance and should not be used:

   o HOUR should not be used in MONTHS.

   o DAY and DAYNAME should not be used in WEEKS or MONTHS.

   o WEEKS should not be used in MONTHS.

3. The following data elements are user-defined.  The value
   in each depends on user-selected options or user-supplied
   SAS code:

   o NETWRKID - Network Identifier.  A one to eight-character
     descriptive name for each network represented in the
     data.  NETWRKID is set in the Network Identifier Exit
     Routine, SNTNIDRT, discussed in Chapter 7.

   o TMOFFSET - Time Offset.  TIME OFFSET applied to the data
     in the file.  The user can associate a TIME OFFSET with
     each unique NETWRKID/SYSID combination.  This offset is
     used to adjust data times when data from multiple time
     zones is brought together in the CA MICS database. To
     determine the original time the data was recorded,
     subtract TMOFFSET from the value.  TIME OFFSET is
     assigned in the SNTOPS member of prefix.MICS.PARMS,
     discussed in Chapter 7.

4. The following data elements lose significance after
   summarization has been performed.  These data elements
   should be referenced only when the last observed value in
   a summarization interval is significant.

   TCPRPORT - Remote Port Number (Data Connection)
   TCPLPORT - Local Port Number (Data Connection)
   TCPRADDR - Remote IP Address (Data Connection)
   TCPLADDR - Local IP Address (Data Connection)
   TCPSTACK - TCP/IP Stack Name
   TCPSOCID - TCP Socket Resource ID
   TCPSOCNM - TCP Socket Resource Name
   TCPVRRL  - z/OS CS TCP/IP Version/Rel.
   TCPUID   - User ID
   FTPFSCS  - Cipher Specification for AT-TLS
   FTPFSPBS - Negotiated Protection Buffer Size
   FTPFSCP  - Control Connection Protection Level
   FTPFSDP  - Data Connection Protection Level

Retrieval Example

Print the complete listing of today's logon failures.  Use
yesterday's data.

   PROC PRINT DATA=&PTCPD..TCPFLF01;
    BY SYSID;
    ID SYSID;
   RUN;