Re: SMF Type65 - Determine who Deleted the Dataset
Quit diddling around. Mike Cleary's DAF on file 94 CBT looks atall relevant SMF records. [Default] On 1 Jan 2021 07:37:00 -0800, in bit.listserv.ibm-main charl...@mcn.org (Charles Mills) wrote: -Original Message- From: Clark Morris To: IBM-MAIN@LISTSERV.UA.EDU Sent: Fri, Jan 1, 2021 11:32 am Subject: Re: SMF Type65 - Determine who Deleted the Dataset [Default] On 1 Jan 2021 07:37:00 -0800, in bit.listserv.ibm-main charl...@mcn.org (Charles Mills) wrote: >I am trying to recall. I think SMF 17 may be written for non-VSAM as well as >VSAM. The doc (V2R1 is what I happen to have open) says "Record type 17 is >written when a non-temporary DASD data set or a temporary DASD data set is >scratched." Would not seem to exclude VSAM. Type 17 is non-VSAM only. I think that type 65 is VSAM related only. The type 42s are after my active time but they may be of help. Clark Morris > >In my experience, the most frequent cause of "how come I don't see an SMF xx >record for such-and-such?" is the convoluted logic of SMFPRMxx TYPE/NOTYPE >SYS/SUBSYS logic. Do a D SMF,O and look very, very carefully at the output. It >sometimes turns out that at some point in history lost in the mists of time >someone said "we are filling up SMF with 65's from TSO" or some such logic and >turned SMF type 65 off for TSO. > >Charles > > >-Original Message- >From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On >Behalf Of Jasi Grewal >Sent: Thursday, December 31, 2020 7:16 PM >To: IBM-MAIN@LISTSERV.UA.EDU >Subject: Re: SMF Type65 - Determine who Deleted the Dataset > >Charles Thank You for taking the time to respond on New Year Eve and >unfortunately, the datasets in question are VSAM Datasets and would I see the >information for that. >Happy New Year to You and to All! >Regards, >Jasi G. > >-- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMF Type65 - Determine who Deleted the Dataset
Thank You Robert for taking the time to respond and that helps alot as I forgot about SETR Audit option and I knew I was forgetting something. Thank You again and Happy New Year, Regards, Jasi Grewal. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMF Type65 - Determine who Deleted the Dataset
[Default] On 1 Jan 2021 07:37:00 -0800, in bit.listserv.ibm-main charl...@mcn.org (Charles Mills) wrote: >I am trying to recall. I think SMF 17 may be written for non-VSAM as well as >VSAM. The doc (V2R1 is what I happen to have open) says "Record type 17 is >written when a non-temporary DASD data set or a temporary DASD data set is >scratched." Would not seem to exclude VSAM. Type 17 is non-VSAM only. I think that type 65 is VSAM related only. The type 42s are after my active time but they may be of help. Clark Morris > >In my experience, the most frequent cause of "how come I don't see an SMF xx >record for such-and-such?" is the convoluted logic of SMFPRMxx TYPE/NOTYPE >SYS/SUBSYS logic. Do a D SMF,O and look very, very carefully at the output. It >sometimes turns out that at some point in history lost in the mists of time >someone said "we are filling up SMF with 65's from TSO" or some such logic and >turned SMF type 65 off for TSO. > >Charles > > >-Original Message- >From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On >Behalf Of Jasi Grewal >Sent: Thursday, December 31, 2020 7:16 PM >To: IBM-MAIN@LISTSERV.UA.EDU >Subject: Re: SMF Type65 - Determine who Deleted the Dataset > >Charles Thank You for taking the time to respond on New Year Eve and >unfortunately, the datasets in question are VSAM Datasets and would I see the >information for that. >Happy New Year to You and to All! >Regards, >Jasi G. > >-- >For IBM-MAIN subscribe / signoff / archive access instructions, >send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMF Type65 - Determine who Deleted the Dataset
Hi Jasi, You would most likely only see a RACF SMF DELRES event record for the deletion if the DATASET class is included in SETROPTS AUDIT set of classes. If DATASET is set for AUDIT, be sure your RACFRW command specifies EVENT ALLSVC. Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. 617-969-8211 www.linkedin.com/in/roberthansel www.twitter.com/RSH_RACF www.rshconsulting.com --- Upcoming RSH RACF Training - WebEx - RACF Audit & Compliance Roadmap - FEB 8-12, 2021 - RACF Level I Administration - APR 12-16, 2021 - RACF Level II Administration - MAR 22-26, 2021 - RACF Level III Admin, Audit, & Compliance - MAR 1-5, 2021 - RACF - Securing z/OS UNIX - JAN 25-29, 2021 --- -Original Message- Date:Thu, 31 Dec 2020 20:32:02 -0600 From:Jasi Grewal Subject: SMF Type65 - Determine who Deleted the Dataset Hi, I have a situation where a user is requesting information in how his datasets got deleted. We tried using SMF and then using RACFRW to generate report but is not reporting on Dataset delete but it has all other information. Is there a Tool available where one can use to read SMF type 65 and generate reports on dataset deletes. Any information would be appreciated. Thank you in advance, Regards, Jasi Grewal. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SMF Type65 - Determine who Deleted the Dataset
I am trying to recall. I think SMF 17 may be written for non-VSAM as well as VSAM. The doc (V2R1 is what I happen to have open) says "Record type 17 is written when a non-temporary DASD data set or a temporary DASD data set is scratched." Would not seem to exclude VSAM. In my experience, the most frequent cause of "how come I don't see an SMF xx record for such-and-such?" is the convoluted logic of SMFPRMxx TYPE/NOTYPE SYS/SUBSYS logic. Do a D SMF,O and look very, very carefully at the output. It sometimes turns out that at some point in history lost in the mists of time someone said "we are filling up SMF with 65's from TSO" or some such logic and turned SMF type 65 off for TSO. Charles -Original Message- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Jasi Grewal Sent: Thursday, December 31, 2020 7:16 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: SMF Type65 - Determine who Deleted the Dataset Charles Thank You for taking the time to respond on New Year Eve and unfortunately, the datasets in question are VSAM Datasets and would I see the information for that. Happy New Year to You and to All! Regards, Jasi G. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: EBCDIC-ASCII converter and other tools
On 1/01/2021 3:07 am, Robert Prins wrote: That's a straw man argument! I have a lot of friends that use FB for their businesses which in the old days would require a bespoke web site. Potentially giving a job and income to local people, rather than the 0.0001% haha! One of my ex colleagues has a side hustle creating websites for small business and outsources the work to Indian subcontractors. If it's less than 5 pages he just knocks it up using a template. Why pay subcontractor wages in a foreign country if you can get it for free? My son sold his car this week on FB marketplace. Killing off more local newspapers... Local newspapers! You mean those paper things given away for free in the local shopping center full of advertisements and no news? Most people use the internet these days. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
