Peter, The type 80 record doesn't have subtypes. 55 is an event code, and event code is a field in the 80 record. I do not know if MXG is aware of and can select records based on type 80 event codes. If your RACF team converts SMF 80 records to text format using RACF's SMF unload utility, you can try searching the unload file for UMNTFSYS events - the text equivalent of event code 55.
Various RACF auditing options determine whether such an event would be logged, and such options may not have been in effect when the event occurred, hence no record. Since the NOTYPE ranges do not exclude 80 records, you are correct that they are being collected. Also look for SUBSYS settings that might be excluding them for certain subsystems. Regards, Bob Robert S. Hansel Lead RACF Specialist RSH Consulting, Inc. *** Celebrating our 25th Year *** 617-969-8211 www.linkedin.com/in/roberthansel http://twitter.com/RSH_RACF www.rshconsulting.com -----Original Message----- Date: Wed, 27 Dec 2017 13:03:41 -0600 From: Peter Ten Eyck <peter.tene...@americannational.com> Subject: Re: How to find what performed an OMVS unmount? Thanks for the suggestion on this topic. I have discovered that the LPAR that this un-mount occurred on does not cut type 92 (USS) records so I will be unable to use them to figure what un-mounted my file. Setting: SYS(NOTYPE(16:19,62:69,92) With the help of MXG staff, I was able to run a MXG report looking for type 80 (RACF) sub type 55 records, I did not find any. To me this means that either there were no un-mounts during the time period of the input or no sub type 55 records are cut. Is the above setting what controls the sub type records cut? Type 80 is not excluded so it’s being cut, is the default all 80 sub types? ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
