So I think 14/15 has job identification in it. So what does SMF 30 say the userid is for that job?
From: IBM Mainframe Discussion List <[email protected]> on behalf of Roger Lowe <[email protected]> Date: Thursday, 10 July 2025 at 07:56 To: [email protected] <[email protected]> Subject: [EXTERNAL] Auditing/Logging of DSFS activities Trying to find a way to audit/log activities performed by Dataset File System (DSFS).....we are have a zOS dataset managed by DSFS. This dataset has been 'updated' by an id, but all we can see from Type 14/15 SMF records is that it was DSFS. I have also looked at the SMF Type 92 Subtype 14 and again it only shows up as DSFS. I am trying to find the underlying REAL userid that has used DSFS to update the zOS dataset. I am not seeing RACF violation messages as this userid does have sufficient authority to update the dataset in the first place. I also haven't found anything useful in the USS logs. Anyone have any ideas or suggestions? Roger ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN Unless otherwise stated above: IBM United Kingdom Limited Registered in England and Wales with number 741598 Registered office: Building C, IBM Hursley Office, Hursley Park Road, Winchester, Hampshire SO21 2JN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
