Hi Jasi, You would most likely only see a RACF SMF DELRES event record for the deletion if the DATASET class is included in SETROPTS AUDIT set of classes. If DATASET is set for AUDIT, be sure your RACFRW command specifies EVENT ALLSVC.
Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. 617-969-8211 www.linkedin.com/in/roberthansel www.twitter.com/RSH_RACF www.rshconsulting.com --------------------------------------------------------------------------- Upcoming RSH RACF Training - WebEx - RACF Audit & Compliance Roadmap - FEB 8-12, 2021 - RACF Level I Administration - APR 12-16, 2021 - RACF Level II Administration - MAR 22-26, 2021 - RACF Level III Admin, Audit, & Compliance - MAR 1-5, 2021 - RACF - Securing z/OS UNIX - JAN 25-29, 2021 --------------------------------------------------------------------------- -----Original Message----- Date: Thu, 31 Dec 2020 20:32:02 -0600 From: Jasi Grewal <[email protected]> Subject: SMF Type65 - Determine who Deleted the Dataset Hi, I have a situation where a user is requesting information in how his datasets got deleted. We tried using SMF and then using RACFRW to generate report but is not reporting on Dataset delete but it has all other information. Is there a Tool available where one can use to read SMF type 65 and generate reports on dataset deletes. Any information would be appreciated. Thank you in advance, Regards, Jasi Grewal. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
