Explanation: The LOG0116 messages are written when a TCP connection is opened or closed. Message LOG01160005 is written when a connection is opened. The other messages in the set are written when the connection is closed. The messages contain identifying information and statistics for the connection, and optionally include security and telnet information.
Action: None. This is an informational message.
01160000MI TCPIP conn closed: owner lclip..lclpt rmtip..rmtpt rsn rsnc
This message is written when a connection is closed. The name of the owning stack is TCPIP, and the application that opened the socket is identified by owner. Local and remote IP addresses and ports are identified by lclip..lclpt and rmtip..rmtpt. The reason for the close is indicated by rsnc. See below for an explanation of close reason codes.
TCP close reason codes include:
17 (x'11'): Error occurred during a send using FRCA(AFPA), possibly because the stack is terminating.
18 (x'12'): A persistent socket used by FRCA (AFPA) was closed by a FIN.
33 (x'21'): The connection was terminated because the stack was terminating.
34 (x'22'): Last stack that can own the dynamic VIPA bound to the socket is terminating.
49 (x'31'): Intrusion detection found the connection to be malicious and closed the connection.
50 (x'32'): Connection was denied because of a NetAccess rule.
51 (x'33'): ACK received in lastack state.
65 (x'41'): The connection was terminated because of an administrator action (for example, using Netstat DRop/-D command or the NMI API).
66 (x'42'): The connection was terminated because the local IP address bound by the application has been deleted from the stack.
81 (x'51'): The connection from a client was terminated because the application closed the socket before performing an accept().
82 (x'52'): The application using the socket, closed the connection using a close().
83 (x'53'): A pascal routine issued an orderly close request.
84 (x'54'): A pascal routine issued a disconnect.
85 (x'55'): An error occurred during a pascal accept.
97 (x'61'): The connection was terminated because the client sent a reset.
113 (x'71'): The connection was closed because the same packet was being re-transmitted multiple times.
114 (x'72'): The connection was closed because the TCP window the client was reduced to zero and multiple window probes were not acknowledged.
115 (x'73'): The connection was closed because multiple keepalive probes were not acknowledged.
116 (x'74'): The connection was terminated because the stack timed out waiting for a fin in the finwait-2 state.
117 (x'75'): The connection was closed by IDS policy during a TCP send queue size event.
118 (x'76'): The connection was closed by IDS policy during a global TCP stall event.
01160001MI In pkts pkts, bytes bytes, dupacks dupacks
This message is written when a connection is closed. It contains the number of TCP segments (pkts) received, the number of bytes received, and the number of duplicate TCP acknowledgments (dupacks) received from the remote host.
01160002MI Out pkts pkts, bytes bytes, rexmits rexmits
This message is written when a connection is closed. It contains the number of TCP segments (pkts) sent, the number of bytes sent, and the number of TCP segments retransmitted (rexmits) by the local host.
01160003MI TCPIP conn reset by remote host: lclip..lclpt rmtip..rmtpt rsnc
This message is written when a TCP connection is reset by the remote host. TCP reset is a non-negotiable, immediate close of the connection. The reason for the close is indicated by rsnc. See the explanation of close reason codes above.
01160004MI TCPIP conn reset by local host: lcip..lclpt rmtip..rmtpt rsnc
This message is written when a TCP connection is reset by the remote host. TCP reset is a non-negotiable, immediate close of the connection. The reason for the close is indicated by rsnc. See the explanation of close reason codes above.
01160005MI TCPIP conn opened: owner lclip..lclpt rmtip..rmtpt
This message is written when a connection is opened. The name of the owning stack is identified by TCPIP, and the application that opened the socket is identified by owner. Local and remote IP addresses and ports are identified by lclip..lclpt and rmtip..rmtpt.
01160006MI AT-TLS: Status=stat Protocol=proto Cipher=cipher SecurityType=type Partner=partner
This message is written when a connection is closed. It contains information about the AT-TLS security in use for the connection.
The TTLS Connection Status is indicated by stat. Possible values include:
X'01' - Not secure
X'02' - HS in progress
X'03' - Secure
The TTLS SSL Protocol is indicated by proto. Possible values include:
X'0000' - Not Applicable
X'0200' - SSL Version 2
X'0300' - SSL Version 3
X'0301' - TLS Version 1
X'0302' - TLS Version 1.1
X'0303' - TLS Version 1.2
The TTLS Negotiated cipher suite is indicated by cipher. SSL Version 2 cipher suite values include:
X'0001' - TLS_RC4_128_WITH_MD5
X'0002' - TLS_RC4_128_EXPORT40_WITH_MD5
X'0003' - TLS_RC2_CBC_128_CBC_WITH_MD5
X'0004' - TLS_RC2_CBC_128_CBC_EXPORT40_WITH_MD5
X'0006' - TLS_DES_64_CBC_WITH_MD5
X'0007' - TLS_DES_192_EDE3_CBC_WITH_MD5
SSL Version 3, TLS Version 1.0, TLS Version 1.1, or TLS Version 1.2 cipher suite values include:
X'0000' - TLS_NULL_WITH_NULL_NULL
X'0001' - TLS_RSA_WITH_NULL_MD5
X'0002' - TLS_RSA_WITH_NULL_SHA
X'0003' - TLS_RSA_EXPORT_WITH_RC4_40_MD5
X'0004' - TLS_RSA_WITH_RC4_128_MD5
X'0005' - TLS_RSA_WITH_RC4_128_SHA
X'0006' - TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
X'0009' - TLS_RSA_WITH_DES_CBC_SHA
X'000A' - TLS_RSA_WITH_3DES_EDE_CBC_SHA
X'000C' - TLS_DH_DSS_WITH_DES_CBC_SHA
X'000D' - TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
X'000F' - TLS_DH_RSA_WITH_DES_CBC_SHA
X'0010' - TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
X'0012' - TLS_DHE_DSS_WITH_DES_CBC_SHA
X'0013' - TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
X'0015' - TLS_DHE_RSA_WITH_DES_CBC_SHA
X'0016' - TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
X'002F' - TLS_RSA_WITH_AES_128_CBC_SHA
X'0030' - TLS_DH_DSS_WITH_AES_128_CBC_SHA
X'0031' - TLS_DH_RSA_WITH_AES_128_CBC_SHA
X'0032' - TLS_DHE_DSS_WITH_AES_128_CBC_SHA
X'0033' - TLS_DHE_RSA_WITH_AES_128_CBC_SHA
X'0035' - TLS_RSA_WITH_AES_256_CBC_SHA
X'0036' - TLS_DH_DSS_WITH_AES_256_CBC_SHA
X'0037' - TLS_DH_RSA_WITH_AES_256_CBC_SHA
X'0038' - TLS_DHE_DSS_WITH_AES_256_CBC_SHA
X'0039' - TLS_DHE_RSA_WITH_AES_256_CBC_SHA
X'003B' - TLS_RSA_WITH_NULL_SHA256
X'003C' - TLS_RSA_WITH_AES_128_CBC_SHA256
X'003D' - TLS_RSA_WITH_AES_256_CBC_SHA256
X'003E' - TLS_DH_DSS_WITH_AES_128_CBC_SHA256
X'003F' - TLS_DH_RSA_WITH_AES_128_CBC_SHA256
X'0040' - TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
X'0067' - TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
X'0068' - TLS_DH_DSS_WITH_AES_256_CBC_SHA256
X'0069' - TLS_DH_RSA_WITH_AES_256_CBC_SHA256
X'006A' - TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
X'006B' - TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
The TTLS Security type is indicated by type. Possible values include:
X'00' - Not Applicable
X'01' - Client
X'02' - Server
X'03' - Server, Client Auth, Passthru
X'04' - Server, Client Auth, Full
X'05' - Server, Client Auth, Reqd
X'06' - Server, Client Auth, Safchk
The TTLS Partner UserID is indicated by partner.
01160007MI Telnet LU=luname Appl=applname Logmode=logmode Rsn=reason
This message is written when a connection is closed. It contains information about a telnet connection.
The telnet LU name is provided by luname. The telnet application name is given by applname. The telnet logmode name is given by logmode. The reason for the telnet session end, if available, is given by reason as a character representation of the telnet termination code documented for message EZZ6034I.
The telnet termination code may be one of the following values:
Unbind
ClientDisc
Inact_sess
Inact_Prnt
Inact_keep
TimeMark
NSexit
TPend
Error
TKO
TKOR
Abend
Unknown
Unbind02
UnbindQS
CloseErr
USSLogoff
StopPort
StopTran
TranClose
ASCDrop
Syslogoff