is that lpar mirrored? any chances of command replication on this lpar? On Aug 7, 2013 10:03 PM, "Greg Shirey" <wgshi...@benekeith.com> wrote: > > Hello group, > > Does anyone know of a method to resume a RACF revoked ID without having an SMF record be written? > > We produce a daily listing of RACF commands from our SMF type 80s (using RACFRW) and we list ADDUSER ADDGROUP ALTUSER ALTGROUP CONNECT DELUSER DELGROUP PASSWORD PERMIT RALTER RDEFINE REMOVE. > > We also produce a daily listing of our CICS user IDs and their RACF status. On July 8 we had a user ID on our report that was listed as REVOKED and a LAST-ACCESS date and time of 07/17/07 17:01:28. > > On July 9, the report showed the ID was no longer revoked and the LAST-ACCESS reported as 07/08/13 19:24:14. However, our SMF report listed no ALTUSER command or any other command against this ID. (No DELUSER or ADDUSER, for instance). > > I dumped the SMF records for both July 7 and July 8 and ran a RACFRW to list all the records and there is no reference to this User ID. > > I'm a sysprog, so I can't blame it on magic or elves - I could try blaming it on the software, but I'm finding that hard to believe - so I have to think there's something I'm missing. I've just looked at everything I know to look at. (Did someone modify SMF for a period? No. Does the COBOL program that lists the RACF users have a bug in it? No.) > > If anyone has a suggestion for what to look for, I'd appreciate hearing about it. > > Thanks, > Greg Shirey > Ben E. Keith Company > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
