---
title: "box.as400"
canonical: "https://docs.devo.com/space/latest/94665044/box.as400"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `box.as400` identify events generated by [IBM AS/400](https://www.ibm.com/ibm/history/exhibits/rochester/rochester_4010.html).

## Valid tags and data tables

<span style="color: #282828">The full tag must have 4 levels. The first two are fixed as</span><span style="color: #282828">** **</span>`box.as400`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype.</span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| IBM AS/400 | `box.as400.audit.type2` | `box.as400.audit.type2` |
| `box.as400_townsend.logagent.audit` | `box.as400_townsend.logagent.audit` |

For more information, read more [About Devo tags](https://docs.devo.com/space/latest/95126204).

## Send it

Logs generated by IBM are forwarded to Devo using a dedicated collector or using the [relay](https://docs.devo.com/space/latest/96468993/Devo+Relay). 

[Contact us](mailto:support@devo.com) if you need to forward these events to your Devo domain so we can guide you through the process.

### Example [relay rules](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: box.as400.audit.type2
Sent without syslog tag: true
        Stop processing: false
```

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: box.as400_townsend.logagent.audit
Sent without syslog tag: false
        Stop processing: true
```


## Table structure

These are the fields displayed in these tables:

### box.as400.audit.type2

| **Field** | **Type** | ***Extra***** fields** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *Entry_Length* | `str` |  |
| *Sequence_Number* | `str` |  |
| *Journal_Code* | `str` |  |
| *Entry_Type* | `str` |  |
| *Date_Stamp* | `str` |  |
| *Time_Stamp* | `str` |  |
| *Job_Name* | `str` |  |
| *User_Name* | `str` |  |
| *Job_Number* | `str` |  |
| *Program_Name* | `str` |  |
| *Object_Name* | `str` |  |
| *Library_Name* | `str` |  |
| *Member_Name* | `str` |  |
| *Count_Rel_Rec_Num* | `str` |  |
| *Indicator_Flag* | `str` |  |
| *Commit_Cycle_Identifier* | `str` |  |
| *User_Profile* | `str` |  |
| *System_Name* | `str` |  |
| *Incomplete_Data* | `str` |  |
| *Minimized_Entry_Specific_Data* | `str` |  |
| *Reserved_Field* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |

### box.as400_townsend.logagent.audit

| **Field** | **Type** | ***Extra***** fields** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *event_code* | `str` |  |
| *event* | `str` |  |
| *event_type* | `str` |  |
| *sev* | `str` |  |
| *actual_type* | `str` |  |
| *user_profile* | `str` |  |
| *jrn_seq* | `str` |  |
| *timestamp* | `str` |  |
| *job_name* | `str` |  |
| *user_name* | `str` |  |
| *job_number* | `str` |  |
| *eff_user* | `str` |  |
| *logical_partition* | `str` |  |
| *violation* | `str` |  |
| *action* | `str` |  |
| *val_job* | `str` |  |
| *val_user* | `str` |  |
| *val_jobno* | `str` |  |
| *object* | `str` |  |
| *object_library* | `str` |  |
| *object_type* | `str` |  |
| *pgm_name* | `str` |  |
| *pgm_libr* | `str` |  |
| *workstation* | `str` |  |
| *causing_user* | `str` |  |
| *field* | `str` |  |
| *op_violation* | `str` |  |
| *object_name* | `str` |  |
| *access_type* | `str` |  |
| *specific_data* | `str` |  |
| *ip_addr* | `str` |  |
| *port* | `str` |  |
| *computer_name* | `str` |  |
| *server_name* | `str` |  |
| *connection_user* | `str` |  |
| *log_type* | `str` |  |
| *message* | `str` |  |
| *send_pgm* | `str` |  |
| *message_id* | `str` |  |
| *message_file_lib* | `str` |  |
| *message_file* | `str` |  |
| *severity* | `str` |  |
| *auth_user* | `str` |  |
| *ifs_path* | `str` |  |
| *cmd_type* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |