The zOS 3.1 z/OS Data Set File System Administration manual has no reference to any SMF record that it uses. I have also checked the IDFPRMxx Parmlib member and there is no option given for enabling an SMF Record
Roger On Thu, 10 Jul 2025 12:46:10 +0000, Ituriel do Neto <[email protected]> wrote: >Does it have its own SMF record? > > >Best Regards > >Ituriel do Nascimento Neto >z/OS System Programmer > > > > > > >Em quinta-feira, 10 de julho de 2025 às 09:33:55 BRT, Roger Lowe ><[email protected]> escreveu: > > > > > >On Thu, 10 Jul 2025 07:53:33 +0000, Martin Packer <[email protected]> >wrote: > >>So I think 14/15 has job identification in it. So what does SMF 30 say the >>userid is for that job? >> >>From: IBM Mainframe Discussion List <[email protected]> on behalf of >>Roger Lowe <[email protected]> >>Date: Thursday, 10 July 2025 at 07:56 >>To: [email protected] <[email protected]> >>Subject: [EXTERNAL] Auditing/Logging of DSFS activities >>Trying to find a way to audit/log activities performed by Dataset File System >>(DSFS).....we are have a zOS dataset managed by DSFS. This dataset has been >>'updated' by an id, but all we can see from Type 14/15 SMF records is that it >>was DSFS. I have also looked at the SMF Type 92 Subtype 14 and again it only >>shows up as DSFS. I am trying to find the underlying REAL userid that has >>used DSFS to update the zOS dataset. I am not seeing RACF violation messages >>as this userid does have sufficient authority to update the dataset in the >>first place. I also haven't found anything useful in the USS logs. Anyone >>have any ideas or suggestions? >> >>Roger > >As I posted "...but all we can see from Type 14/15 SMF records is that it was >DSFS ...." - so we know it was "something" using DSFS to update a sequential >file on zOS that had the required RACF access to the file. What we would like >to find out is the REAL userid that connected with DSFS and then did the >subsequent update. Not sure if Type 30 will help > >---------------------------------------------------------------------- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to [email protected] with the message: INFO IBM-MAIN > >---------------------------------------------------------------------- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
