Hi Shelia, First off, in output of the LISTUSER command, find the most recent LAST-CONNECT date/time in the group connect information for all ID's groups. Most likely it will be associated with the ID's default group. If it is the same as the LAST-ACCESS date/time, then the later was updated due to a logon. If the LAST-ACCESS date/time is later, then someone did an ALTUSER RESUME on the ID, in which case you'll want to examine SMF type 80 records for ALTUSER events.
If it appears to be a logon, you will want to examine SMF type 80 records for event JOBINIT (logon) and INITOEDP (Unix dub) as well as type 30 subtype 1 records (TSO, Batch, and Started Task logons). Note that successful logons are often not logged. It all depends on how the resource manager processing the logon is designed and configured. The SMF event names I'm referring to appear in the output of RACF's SMF unload utility. This utility converts raw SMF 80 and 30 records into text or XML output. If you have RACF administration add-on product such as zSecure, it will provide its own mechanisms for reporting from SMF data. If the above doesn't yield any useful information, try adding the UAUDIT attribute to the ID to record all its access activity. This activity might provide some clues as to how and from where the ID is being used. If you have zSecure Access Monitor, it can also provide helpful access activity information. Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. 617-969-8211 www.linkedin.com/in/roberthansel www.rshconsulting.com -----Original Message----- Date: Wed, 10 Jan 2024 21:37:46 +0000 From: "Chalk, Shelia" <[email protected]> Subject: Racf Userid Hello, I have a userid abc that was last access in racf on 1/7/24 at 5:06 a.m. Is there a report or something that will tell me who (batch job, script, etc..) is using this userid? Thanks Shelia Chalk Mainframe System Programmer [email protected] ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
