collect more data for FTP/TN3270 sessions in MONWRITE

We are enabling all FTP and TN3270 in our environment to comply with Payment Card Industry (PCI) standards. With FTP we cannot make it default for the entire environment at this time so we must still allow unsecure FTP to occur. PCI compliance “regulations” allow us to permit unsecure/secure FTP as long as there is a compensating control that identifies if key personnel who MUST use secure methods can be seen as not complying. (per PCI compliance certain individuals are identified that CANNOT use their USERID/PASSWORD in the “clear” – ie SYSTEM administration personnel).

We are also a z/OS shop with the same compliance issues and we leveraged SMF data to identify FTP transactions that were not secure by personnel that should not use unsecure connections. In z/VM we tried to leverage the MONWRITE data in the same way but MONITOR records do not capture the FTP event with the same detail that SMF does (see PMR 02011,082,000).
With SMF data we can see the client/server connections, who did them and whether the connection was secure or not. With z/VM the best granularity we can see is by enabling MONITORRECORDS in the TCP/IP stacks which provides records for opening/closing TCP or UDP connections and the IP address and port.

We are seeking an enhancement that will provide encryption information also for these connections.