Well, I did say they were RACF users. ACF2 does not generally cut Type 80 records, although its default Type 230 record could be overridden to 80 if the customer desired. (TSS by default does cut Type 80 records.) This does not look like an ACF2 record; I would recognize that. The record is very much "RACF-like." It is in fact a valid "RACF" Type 80 record, although there is a lot of unaccounted for data in the middle. Because of the pointer architecture of the RACF record layout, extra data in the middle does not affect the validity of the layout of the "RACF-like" portions.
> I don't think there's anything stopping ANY software from confecting SMF 80 records. Well, there's "anything" if you count APF. But your point is well taken -- it could be almost any program or product cutting an SMF 80 record. It would not have to be a security product or a "RACF add-on." Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of Martin Packer Sent: Tuesday, July 05, 2016 11:55 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Help identifying source of SMF 80 record Nobody has mentioned ACF2 yet. Is that a possibility? In principle I don't think there's anything stopping ANY software from confecting SMF 80 records. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
