Ravi Gaur wrote: >We have had a situation where somebody cancelled a job which caused IMS left >in middle and later issue now we tried finding who issued it however it got >just INTERNAL (Generally something coming from console) anybody know any other >pin to go back to root who issued it..another thing I could notice is command >seems to be coming thru netview..
>12114 14:46:37.86 INTERNAL 00000290 CANCEL STLD3VDC,A=025B >12114 14:46:37.90 STC12398 00000290 CANCEL STLD3VDC,A=025B ====> >STC12398 = Netview task.. >Now SMF30 doesn't contain any info neither 26 ..Syslog doesn't got anything >Netview log got only command as pasted here...any call? If you have RACF and you have SMF records type 80, etc for RACF records, you may perhaps have some clues. But then you should have LOGOPTIONS(ALWAYS) setup for the RACF class OPERCMDS before that event... I don't know if you will get other info from SMF RACF records besides 'internal', 'master' or something like that. HTH and good luck! Groete / Greetings Elardus Engelbrecht ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
