Kolusu, I would not recommend the use of RACFRW. It was stabilized in 1992 and won't report on the use of newer command operands such as NOEXPIRE. Bruce is better off using ICETOOL.
Bruce, Our presentation on DFSORT and ICETOOL and its use with RACF might be of help. You'll find it on our "RACF Center" webpage along with other useful RACF information. http://www.rshconsulting.com/racfres.htm Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. *** Celebrating our 25th Year *** 617-969-8211 www.linkedin.com/in/roberthansel http://twitter.com/RSH_RACF www.rshconsulting.com -------------------------------------------------------------------------------- Upcoming RSH RACF Training - WebEx - RACF Audit & Compliance Roadmap - FEB 5-9, 2018 - RACF Level I Administration - APR 3-6, 2018 - RACF Level II Administration - JUN 4-8, 2018 - RACF Level III Admin, Audit, & Compliance - FEB 26-MAR 2, 2018 - RACF - Securing z/OS UNIX - APR 23-27, 2018 -------------------------------------------------------------------------------- -----Original Message----- Date: Wed, 13 Dec 2017 10:20:41 -0700 From: Sri h Kolusu <skol...@us.ibm.com> Subject: Re: DFSORT: RACFICE query - how to extract all commands containing some text value Bruce, You extract the SMF80 records and process it thru DFSORT. You can also use RACFRW to report https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha800/racfrw.htm Example : This file produces a report of failed logons for user Smith. RACFRW TITLE('REPORT ON FAILED LOGONS FOR USER SMITH') SELECT PROCESS USER(DUMMY) EVENT LOGON SUMMARY USER NEWPAGE END You can use EVENT to list all of your event and generate a report https://www.ibm.com/support/knowledgecenter/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha800/racfrw.htm#racfrw__eventsub If you still need help please feel free to send your questions to DFSORT hotline (dfs...@us.ibm.com) along with a sample input file and desired output report. Thank you Lizette for directing the users to our hotline Thanks, Kolusu DFSORT Development IBM Corporation From: Bruce Hewson <bruce_hew...@hotmail.com> To: IBM-MAIN@LISTSERV.UA.EDU Date: 12/13/2017 02:50 AM Subject: DFSORT: RACFICE query - how to extract all commands containing some text value Sent by: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> A query for the ICETOOL/RACFICE experts, I have been asked to extract all RACF commands issued relating to a specific USERID. I am not knowledgable enough with ICETOOLS to code this myself quickly. The current RACFICE examples do not provide a sample for this. example. Extract and report all commands, ADDUSER/ALTUSER/PASSWORD/PERMIT that reference USER(xyzzy) Hopefully someone can help. Thanks Bruce Hewson ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
