DAF processes many different SMF records, not just the ones RACF creates. If your SMF is recording the necessary record types, DAF should be able to tell you when and by whom any dataset was created, opened, or deleted. But you need to be recording type 14, 15, 17, 18, 60, 61, 62, 65, 66, and 69 if RACF is not auditing the activities you are concerned with.
It has worked for me in the past. :>: -----Original Message----- :>: From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On :>: Behalf Of Jake anderson :>: Sent: Wednesday, March 12, 2014 8:24 PM :>: To: IBM-MAIN@LISTSERV.UA.EDU :>: Subject: DAF(Dataset Audit facility) :>: :>: Hello Group, :>: :>: I am trying to use DAF to track the creation of dataset using a specific :>: HLQ. Unfortunately I have not set AUDIT logging using our security :>: software. :>: :>: Let me be very precise, I am trying to exploit the potentiality of DAF :>: to :>: check if i can track the USERID who has a created a set of dataset in :>: past. :>: :>: Can we achieve this using DAF ? :>: :>: We are at Z/OS 1.13 :>: :>: Has anyone tried using DAF ? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
