Would there be anything in RACF Type 80 records that might be helpful? Mark Jacobs
Sent from ProtonMail, Swiss-based encrypted email. GPG Public Key - https://api.protonmail.ch/pks/lookup?op=get&[email protected] On Thursday, July 10th, 2025 at 9:45 AM, Roger Lowe <[email protected]> wrote: > The zOS 3.1 z/OS Data Set File System Administration manual has no reference > to any SMF record that it uses. I have also checked the IDFPRMxx Parmlib > member and there is no option given for enabling an SMF Record > > Roger > > On Thu, 10 Jul 2025 12:46:10 +0000, Ituriel do Neto > [email protected] wrote: > > > Does it have its own SMF record? > > > > Best Regards > > > > Ituriel do Nascimento Neto > > z/OS System Programmer > > > > Em quinta-feira, 10 de julho de 2025 às 09:33:55 BRT, Roger Lowe > > [email protected] escreveu: > > > > On Thu, 10 Jul 2025 07:53:33 +0000, Martin Packer [email protected] > > wrote: > > > > > So I think 14/15 has job identification in it. So what does SMF 30 say > > > the userid is for that job? > > > > > > From: IBM Mainframe Discussion List [email protected] on behalf of > > > Roger Lowe [email protected] > > > Date: Thursday, 10 July 2025 at 07:56 > > > To: [email protected] [email protected] > > > Subject: [EXTERNAL] Auditing/Logging of DSFS activities > > > Trying to find a way to audit/log activities performed by Dataset File > > > System (DSFS).....we are have a zOS dataset managed by DSFS. This dataset > > > has been 'updated' by an id, but all we can see from Type 14/15 SMF > > > records is that it was DSFS. I have also looked at the SMF Type 92 > > > Subtype 14 and again it only shows up as DSFS. I am trying to find the > > > underlying REAL userid that has used DSFS to update the zOS dataset. I am > > > not seeing RACF violation messages as this userid does have sufficient > > > authority to update the dataset in the first place. I also haven't found > > > anything useful in the USS logs. Anyone have any ideas or suggestions? > > > > > > Roger > > > > As I posted "...but all we can see from Type 14/15 SMF records is that it > > was DSFS ...." - so we know it was "something" using DSFS to update a > > sequential file on zOS that had the required RACF access to the file. What > > we would like to find out is the REAL userid that connected with DSFS and > > then did the subsequent update. Not sure if Type 30 will help > > > > ---------------------------------------------------------------------- > > For IBM-MAIN subscribe / signoff / archive access instructions, > > send email to [email protected] with the message: INFO IBM-MAIN > > > > ---------------------------------------------------------------------- > > For IBM-MAIN subscribe / signoff / archive access instructions, > > send email to [email protected] with the message: INFO IBM-MAIN > > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
