Hello group, Does anyone know of a method to resume a RACF revoked ID without having an SMF record be written?
We produce a daily listing of RACF commands from our SMF type 80s (using RACFRW) and we list ADDUSER ADDGROUP ALTUSER ALTGROUP CONNECT DELUSER DELGROUP PASSWORD PERMIT RALTER RDEFINE REMOVE. We also produce a daily listing of our CICS user IDs and their RACF status. On July 8 we had a user ID on our report that was listed as REVOKED and a LAST-ACCESS date and time of 07/17/07 17:01:28. On July 9, the report showed the ID was no longer revoked and the LAST-ACCESS reported as 07/08/13 19:24:14. However, our SMF report listed no ALTUSER command or any other command against this ID. (No DELUSER or ADDUSER, for instance). I dumped the SMF records for both July 7 and July 8 and ran a RACFRW to list all the records and there is no reference to this User ID. I'm a sysprog, so I can't blame it on magic or elves - I could try blaming it on the software, but I'm finding that hard to believe - so I have to think there's something I'm missing. I've just looked at everything I know to look at. (Did someone modify SMF for a period? No. Does the COBOL program that lists the RACF users have a bug in it? No.) If anyone has a suggestion for what to look for, I'd appreciate hearing about it. Thanks, Greg Shirey Ben E. Keith Company ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
