Does it have its own SMF record?
Best Regards Ituriel do Nascimento Neto z/OS System Programmer Em quinta-feira, 10 de julho de 2025 às 09:33:55 BRT, Roger Lowe <[email protected]> escreveu: On Thu, 10 Jul 2025 07:53:33 +0000, Martin Packer <[email protected]> wrote: >So I think 14/15 has job identification in it. So what does SMF 30 say the >userid is for that job? > >From: IBM Mainframe Discussion List <[email protected]> on behalf of >Roger Lowe <[email protected]> >Date: Thursday, 10 July 2025 at 07:56 >To: [email protected] <[email protected]> >Subject: [EXTERNAL] Auditing/Logging of DSFS activities >Trying to find a way to audit/log activities performed by Dataset File System >(DSFS).....we are have a zOS dataset managed by DSFS. This dataset has been >'updated' by an id, but all we can see from Type 14/15 SMF records is that it >was DSFS. I have also looked at the SMF Type 92 Subtype 14 and again it only >shows up as DSFS. I am trying to find the underlying REAL userid that has used >DSFS to update the zOS dataset. I am not seeing RACF violation messages as >this userid does have sufficient authority to update the dataset in the first >place. I also haven't found anything useful in the USS logs. Anyone have any >ideas or suggestions? > >Roger As I posted "...but all we can see from Type 14/15 SMF records is that it was DSFS ...." - so we know it was "something" using DSFS to update a sequential file on zOS that had the required RACF access to the file. What we would like to find out is the REAL userid that connected with DSFS and then did the subsequent update. Not sure if Type 30 will help ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
