Bruce, You extract the SMF80 records and process it thru DFSORT. You can also use RACFRW to report
https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha800/racfrw.htm Example : This file produces a report of failed logons for user Smith. RACFRW TITLE('REPORT ON FAILED LOGONS FOR USER SMITH') SELECT PROCESS USER(DUMMY) EVENT LOGON SUMMARY USER NEWPAGE END You can use EVENT to list all of your event and generate a report https://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha800/racfrw.htm#racfrw__eventsub If you still need help please feel free to send your questions to DFSORT hotline (dfs...@us.ibm.com) along with a sample input file and desired output report. Thank you Lizette for directing the users to our hotline Thanks, Kolusu DFSORT Development IBM Corporation From: Bruce Hewson <bruce_hew...@hotmail.com> To: IBM-MAIN@LISTSERV.UA.EDU Date: 12/13/2017 02:50 AM Subject: DFSORT: RACFICE query - how to extract all commands containing some text value Sent by: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> A query for the ICETOOL/RACFICE experts, I have been asked to extract all RACF commands issued relating to a specific USERID. I am not knowledgable enough with ICETOOLS to code this myself quickly. The current RACFICE examples do not provide a sample for this. example. Extract and report all commands, ADDUSER/ALTUSER/PASSWORD/PERMIT that reference USER(xyzzy) Hopefully someone can help. Thanks Bruce Hewson ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
