On Fri, 10 Feb 2006 09:12:54 -0600, Compton, John <[EMAIL PROTECTED] INC.COM> wrote:
>Likewise when deleting a file (as I found out to my cost only recently) >The type 17 (scratch) record is only written at file close time, so >//step EXEC PGM=IEFBR14 >//ddname DD Dsn=x,DISP=(OLD,DELETE) >deletes file 'x' and leaves no trace of 'whodunnit' behind... SMF 17's have nothing to do with open. If you saw no trace of the scratch, something is either wrong with the audit trail or the tool assessing the audit trail. If the dataset was also uncataloged via this method, associated SMF 60's and 65's would also be present. You should get to the bottom of this one way or another. Michael ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
