Right. I think most SMF reporting programs allow at least limited filtering. SMF exits are not for the feint-hearted.
SMF 42 only records STOW: updates done "the right way" in user code or basic updates like ISPF edit and DD DSN=my.dsn(member). It does not record "sophisticated" access like some or all IEBCOPY, or a sophisticated programmer that intends to defeat it. SMF 15 catches *every* close output (write, in other words) of every dataset, no matter wha5t. You could find anyone defeating SMF 42 by correlating SMF 15 with SMF 42 (if it's in 15 but not 42, you may have found a problem) but it would be a lot of work without the right tools. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of Cannaerts, Jan Sent: Tuesday, November 29, 2016 6:18 AM To: [email protected] Subject: Re: recording all TSO command and recording all updated member of libraries >One more, if I active smf's type 32 and 42, all the actions will be >recorded? if I only need to audit one person, is it possible to filter >it (not after SMF extraction)? All actions will be recorded. But you can discard records when SMF is handling the record with an exit if you're in to writing assembler. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
