To be a bit more specific, I think "started task" (or "job") rather than "task" is what is wanted.
For this specific case, wouldn't RACF logging of denied accesses have been a way to capture the data as to which job was denied access? Peter Relson z/OS Core Technology Design ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN