Tim Brown wrote: >Which smf records will give detail on creates/updates/deletes for racf >discrete/generic profiles
Others said SMF record type 80, but there are some caveats. By default, you will see only violations. If you want to record successfull attempts too, be sure to specify audit(all(READ)) for your datasets and check out LOGOPTIONS(ALWAYS) for datasets. Also, have a look at SMF record type 60, 61, 64, 65, 17, 18, etc. That is of course that your profiles you intend to audit are not already covered by Global Access Table. Also, you may have no guarantee that Trusted STC with AC=1 will write out such records. HTH! Groete / Greetings Elardus Engelbrecht ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
