Run RACFRW against your daily SMF - https://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha800/samrep.htm Believe it's the LIST keyword you need to use. Yes, RACFRW is 'stabilized', but it's enough for a first look.
- KB ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Tuesday, July 14, 2020 3:57 AM, TenEyck, Peter <peter.tene...@americannational.com> wrote: > What SMF record and report/tool could I use to determine the point of origin > for this attempted logon? > > M 0080000 ABCD 20180 07:40:36.85 JOB03275 00000090 ICH408I USER(RACFID ) > GROUP( ) NAME(??? ) 395 > E 395 00000090 LOGON/JOB INITIATION - USER AT TERMINAL NOT RACF-DEFINED > > //* Peter Ten Eyck > //* Senior Systems Programmer > //* American National > // > > American National is the brand name for American National Insurance Company, > headquartered in Galveston, Texas, and its subsidiaries. Each company has > financial responsibility only for its own products and services. American > National Insurance Company is not licensed in New York. In New York, business > is conducted by New York licensed subsidiaries. For more information, go to > www.americannational.com. > Confidentiality: This transmission, including any attachments, is solely for > the use of the intended recipient(s). This transmission may contain > information that is confidential or otherwise protected from disclosure. The > use or disclosure of the information contained in this transmission, > including any attachments, for any purpose other than that intended by its > transmittal is strictly prohibited. Unauthorized interception of this email > is a violation of federal criminal law. If you are not an intended recipient > of this transmission, please immediately destroy all copies received and > notify the sender. > > -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
