I decided on method 3.
Created a WRKWCH, looking at joblogs, comparison data "QSH CMD('/QOpenSys/bin/sftp"
I now have a real time, SSH/SFTP monitor, which also writes to a SSH/SFTP log file.
I will be adding another comparison data for FTP.
Info captured thus far, will be adding more.
Job name
Job user
Job number
Job date
Job time
Program name
Location and name of SSH/SFTP script.
SSH/SFTP remote URL
Paul
-----Original Message-----
From: Steinmetz, Paul
Sent: Monday, October 07, 2019 4:30 PM
To: 'Midrange Systems Technical Discussion' <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: SSH / SFTP client log
I'm trying to capture and document all SSH /SFTP connections.
Majority, the Power I is the client, so we are either putting or getting files from 3rd party remotes.
TRCCNN on port 22 is one ugly method, needs a lot of massaging.
A second method could be a scan of all joblogs searching for: "4900 - QSH CMD('/QOpenSys/bin/sftp"
A third method could be WRKWCH - comparison data "4900 - QSH CMD('/QOpenSys/bin/sftp"
Problem with methods 2 and 3, It would only have Job, date, time, no specific SSH/SFTP credentials.
A fourth method would be to add -vvv (verbose trace) to all SSH configs, then dump the output to a file, then filter out what is needed, possible but ugly like method 1.
Is there another cleaner method, that might include Remote IP, SSH/SFTP user, Open SSH details, etc ?
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx
http://www.pencor.com/
midrange.com
