Peter, it seems somebody submitted the JOB03275 job on behalf of RACFID (like a jobcard with USER=RACFID).
Into the log you should see something like $HASP100 ABCD ON INTRDR userid .... Maybe it will be useful. Regards. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Mail priva di virus. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> Il giorno mar 14 lug 2020 alle ore 00:28 TenEyck, Peter < peter.tene...@americannational.com> ha scritto: > What SMF record and report/tool could I use to determine the point of > origin for this attempted logon? > > M 0080000 ABCD 20180 07:40:36.85 JOB03275 00000090 ICH408I > USER(RACFID ) GROUP( ) NAME(??? ) 395 > E 395 00000090 LOGON/JOB > INITIATION - USER AT TERMINAL NOT RACF-DEFINED > > //* Peter Ten Eyck > //* Senior Systems Programmer > //* American National > // > > > ________________________________ > American National is the brand name for American National Insurance > Company, headquartered in Galveston, Texas, and its subsidiaries. Each > company has financial responsibility only for its own products and > services. American National Insurance Company is not licensed in New York. > In New York, business is conducted by New York licensed subsidiaries. For > more information, go to www.americannational.com. > Confidentiality: This transmission, including any attachments, is solely > for the use of the intended recipient(s). This transmission may contain > information that is confidential or otherwise protected from disclosure. > The use or disclosure of the information contained in this transmission, > including any attachments, for any purpose other than that intended by its > transmittal is strictly prohibited. Unauthorized interception of this email > is a violation of federal criminal law. If you are not an intended > recipient of this transmission, please immediately destroy all copies > received and notify the sender. > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
