I opened up a SR with IBM and they confirmed your statement.
The AUDITFID is the FID valuse shown in the ICH408I message. This can be
found at offset x'108' (decimall 264) in the extended-length relocate
section of the SMF type 80 record.
Mark Jacobs
On 08/21/12 11:43, Walt Farrell wrote:
On Mon, 20 Aug 2012 13:53:01 -0700, retired
mainframer<[email protected]> wrote:
Both MXG (which requires SAS) and RACFICE (from SAMPLIB) provide the
capability to adjust the selection criteria to anything you wish.
But this assumes the data of interest is actually recorded. I found
references to auditid in the BPXYATTR and BPXYSTAT macros. I could not find
any reference in the SMF type 80 record description.
I -think- it would be extended relocate section #264 (x'108'), listed in the RACF
documentation for the type 80 record as File Identifier (16 bytes, binary), and in the
IRRADU00 output as the File ID (e.g, FACC_FILE_ID, 32 bytes character in the "check
file access record extension").
I have no way to check that, but a question on RACF-L might get a response from
a developer or Level 2. Or someone with access to SMF records and especially an
ICH408I containing the audit ID should be able to confirm it.
--
Mark Jacobs
Time Customer Service
Tampa, FL
----
The Doctor: You know when grown-ups tell you everything's going to be
fine, and you think they're probably lying to make you feel better?
Young Amy: Yes.
The Doctor: Everything's going to be fine.
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
