If you use something like RACF you can look at the product logs or SMF and see who created it if the log option for the covering profile. I have used RACF to create a full generic profile with no the same access as the current controlling profile and audit(all(read)).
Dennis Roach, CISSP AIG Identity & Access Management | Infrastructure Services 2929 Allen Parkway, America Building, 3rd Floor | Houston, TX 77019 Work: 713-831-8799 Cell: 713-591-1059 (cell) dennis.ro...@aig.com | www.aig.com PTO Schedule none. -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Jim Beck Sent: Wednesday, November 07, 2018 2:44 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: How to tell what allocated a dataset never opened All, We've retired an application and are in the process of cleanup. Does anyone know of a way to identify what is allocating a given dataset if it's never opened? SMF cuts 14 & 15 records only if the dataset is open. Other than scratch, rename, and other VTOC changes, I haven't found an SMF record that contains the dataset name, just the DD name or unit address. The MONITOR option in CONSOLExx can track the deallocation in SYSLOG/OPERLOG, but for TSO sessions you can't tie that back to a CLIST or command. For batch jobs, you can eventually tie it back to the step. The only other way I've seen is the hit-or-miss enqueue check and contact the TSO session owner. Jim ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
