User logon activity depends upon a combination of which logons you are talking about -and- which OEM security you use - RACF, Top Secret, or ACF2.
TSO logon, job start (batch) and Started Task events are SMF type 20 or type 30. Anything else (CICS, Distributed DB2, IMS, etc…) is an SMF type 80 (event code 1 - RACINIT) cut by the security product itself. Hayim > On Oct 25, 2020, at 16:36, Seymour J Metz <[email protected]> wrote: > > Ouch! > > I meant type 80, but from what you say he may be SOL if he needs more than > TSO. > > > -- > Shmuel (Seymour J.) Metz > http://mason.gmu.edu/~smetz3 > > ________________________________________ > From: IBM Mainframe Discussion List [[email protected]] on behalf of > Charles Mills [[email protected]] > Sent: Sunday, October 25, 2020 4:03 PM > To: [email protected] > Subject: Re: SMF to capture user login history > > I lived and breathed z/OS event monitoring via real-time SMF from 2010 to > 2018. CICS and most if not all session managers are pretty much hopeless. > Ditto end-user access to WebSphere, and Db2 if it is three-tier -- i.e., the > user logs onto Linux or Windows and a process there hits Db2. CICS cuts SMF > 110 records but not for logons. > > Charles > > > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:[email protected]] On > Behalf Of Seymour J Metz > Sent: Sunday, October 25, 2020 12:34 PM > To: [email protected] > Subject: Re: SMF to capture user login history > > I don't know that TSO is all that is of interest. What about, e.g., CICS, > NVAS, TPX? > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
