Peter, There are multiple RACF audit options that might come into play as discussed in our presentation on this topic. See (beware the line wrap):
http://www.rshconsulting.com/RSHpres/RSH_Consulting__RACF_Monitoring_&_Reporting__August_2017.pdf Event Code 55 (UMNTFSYS) comes under Unix audit class FSOBJ. Use caution in auditing Unix events because of the potential high volume of SMF records. Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. *** Celebrating our 25th Year *** 617-969-8211 www.linkedin.com/in/roberthansel http://twitter.com/RSH_RACF www.rshconsulting.com -----Original Message----- Date: Thu, 28 Dec 2017 09:37:17 -0600 From: Peter Ten Eyck <peter.tene...@americannational.com> Subject: Re: How to find what performed an OMVS unmount? Thanks for setting me straight on the difference between sub type and event code in the context of RACF. I will look into if there is a RACF unload for that time period and perhaps check with MXG about the handling of event codes as opposed to sub types. You mentioned RACF auditing options that would control which RACF event codes are cut? Where is that controlled? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
