by Robert Sample » Fri Jun 25, 2010 6:28 am
SMF record types 118 and 119 record the sending IP address along with other data about FTP jobs. Contact your site support group to see if they use MICS or MXG or something else to process the daily SMF data. If you're lucky, they already have the 118 and 119 records ready to use.