Which "log"? And what is the source of the command? I can do an UNMOUNT in TSO (interactive or batch) to remount a filesystem to READ. I can also do a "chmount" command from a UNIX shell session (interactive or batch) to do the same. I don't think either of these commands writes to the z/OS SYSLOG or the UNIX syslog daemon (assuming the OP is running it).
-- John McKown Systems Engineer IV IT Administrative Services Group HealthMarkets(r) 9151 Boulevard 26 * N. Richland Hills * TX 76010 (817) 255-3225 phone * john.mck...@healthmarkets.com * www.HealthMarkets.com Confidentiality Notice: This e-mail message may contain confidential or proprietary information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. HealthMarkets(r) is the brand name for products underwritten and issued by the insurance subsidiaries of HealthMarkets, Inc. -The Chesapeake Life Insurance Company(r), Mid-West National Life Insurance Company of TennesseeSM and The MEGA Life and Health Insurance Company.SM > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] > On Behalf Of Scott Ford > Sent: Tuesday, November 06, 2012 6:17 PM > To: IBM-MAIN@LISTSERV.UA.EDU > Subject: Re: Who changed the mount attrib of a zFS? > > Roger, > > No problem, so that leaves an Operator or someone authorized to issue > the command. > Another possibility would be a software product, maybe. > > If you have you sys logs you could try to find who issued the command > > Scott ford > www.identityforge.com > > Tell me and I'll forget; show me and I may remember; involve me and > I'll understand. - Chinese Proverb > > > On Nov 6, 2012, at 3:26 PM, Roger Lowe <roger_l...@bigpond.com> wrote: > > > Scott, > > I should have been a little more clear on my original post - > > the BPXRMxx parmlib member has the file being mounted in RW mode, but > > somehow during normal operations, the file mount attribute got > changed > > from RW to R. I can't use the SMF Type 92 records as they are > > currently not being recorded :( I have also looked at the Type 80 > > records and RACF Event Codes 44 and 55 (Mount and UnMount) but that > > has also been unsuccessful > > > > Roger > > > > On Tue, 6 Nov 2012 10:21:29 -0500, Scott Ford > <scott_j_f...@yahoo.com> wrote: > > > >> Roger, > >> > >> If Its the member of parmlib, look at the security subsystems > >> definitions for that library, I.e.; DATASET > >> > >> Scott ford > >> www.identityforge.com > >> > >> Tell me and I'll forget; show me and I may remember; involve me and > >> I'll understand. - Chinese Proverb > >> > >> > >> On Nov 5, 2012, at 8:50 PM, Roger Lowe <roger_l...@bigpond.com> > wrote: > >> > >>> Hi, > >>> is there an easy way to identify who might have changed the MOUNT > attribute of a zFS from RW to R? > >>> > >>> Thanks, Roger > >>> > >>> ------------------------------------------------------------------- > - > >>> -- For IBM-MAIN subscribe / signoff / archive access instructions, > >>> send email to lists...@listserv.ua.edu with the message: INFO > >>> IBM-MAIN > > --------------------------------------------------------------------- > - > > For IBM-MAIN subscribe / signoff / archive access instructions, send > > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, send > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
