SMF collects everything it is told to collect. SYSLOG is not one of those items. If you have RACF OPERCMDS class active and being fully audited, you may find the command in the type 80 records. If the scheduling system has a user interface to say ISPF, items there may not be logged. I would look at SYSLOG and the schedulers logs. The RACF idea is a long shot.
Dennis Roach GHG Corporation Lockheed Martin Mission Services Flight Design and Operations Contract NASA/JSC Address: 2100 Space Park Drive LM-15-4BH Houston, Texas 77058 Mail: P.O. Box 58487 Mail Code H4C Houston, Texas 77258 Phone: Voice: (281)336-5027 Cell: (713)591-1059 Fax: (281)336-5410 E-Mail: [email protected] All opinions expressed by me are mine and may not agree with my employer or any person, company, or thing, living or dead, on or near this or any other planet, moon, asteroid, or other spatial object, natural or manufactured, since the beginning of time. > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:[email protected]] On > Behalf Of larry macioce > Sent: Tuesday, June 23, 2009 1:24 PM > To: [email protected] > Subject: smf layout question > > I /we have a scheduleing system that is no longer "supported" ,well it > is > but it isn't. > Anyway, something weird happened and the operator on dusty says he > didn't do > it. > What happened was an external replay was given to release a certain > part of > the schedule. > This all occurred Friday a.m. and I was off yesterday that is why I'm > asking > today. > I've been through syslog, the scheduling systems log ,tcpip and several > reports, but have found nothing to clear or blame the operator. > I am tyring to clear him(he asked me to look into this). > We do have some remotte logins and they could have done it but I have > found > no evidence. > I know that smf collects everything but I wouldn't know where to start > looking > thanks > Mace > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: GET IBM-MAIN INFO > Search the archives at http://bama.ua.edu/archives/ibm-main.html ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
