Hi USS SMF records have some self-defining sections. ICETOOL needs fix offsets, therefore I use REXX.
Here the SMF recordtype 92 subtype 14 report extract: vbsbytes= 4 /* ------------ */ process_record: /* ------------ */ /* SMF Record Type 92 Subtype 14 */ /* Record Header Section */ smf92sid = substr(smf_record,14-vbsbytes+1,4) /* System ID */ smf92wid = substr(smf_record,18-vbsbytes+1,4) /* Subsystem ID */ /* Time field in hundredths of a second format */ /* is the number of seconds after midnight */ s92_tme = c2d(substr(smf_record,6-vbsbytes+1,4)) s92_hh = right(s92_tme % 360000,2,'0') /* integer divide */ s92_hhr = s92_tme // 360000 /* remainder */ s92_mm = right(s92_hhr % 6000,2,'0') s92_mmr = s92_hhr // 6000 s92_ss = right(s92_mmr // 100,2,'0') smf92tme = s92_hh!!'.'!!s92_mm!!'.'!!s92_hh /* Date the record was written in the form 0cyydddF, (where c is */ /* 0 for 19xx and 1 for 20xx, yy is the current year (0-99), ddd is */ /* the current day (1-366), and F is the sign for a packed field). */ s92_dte = c2x(substr(smf_record,10-vbsbytes+1,4)) /* convert julian to standard */ smf92dte = date('S',substr(s92_dte,3,5),'J') /* Offset to subsys section */ smf92sof = c2d(substr(smf_record,28-vbsbytes+1,4)) /* Offset to ident. section */ smf92iof = c2d(substr(smf_record,36-vbsbytes+1,4)) offset_id = smf92iof - vbsbytes r = ident_section() /* Offset to data section */ smf92dof = c2d(substr(smf_record,44-vbsbytes+1,4)) offset_data = smf92dof - vbsbytes r = data_section() if r = zero then r = write_record() return(r) /* ----------- */ ident_section: /* ----------- */ /* Identification Section */ smf92jbn = substr(smf_record,offset_id+1,8) /* Jobname */ smf92stm = substr(smf_record,offset_id+16+1,8) /* Stepname */ smf92rud = substr(smf_record,offset_id+32+1,8) /* User ID */ return(r) /* ---------- */ data_section: /* ---------- */ /* Subtype 14 */ smf92dfn = substr(smf_record,offset_data+72+1,64) /* delete fn */ return(r) HTH If you need the whole part please contact me offline Albert -----Ursprüngliche Nachricht----- Von: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] Im Auftrag von sunil mirchandani Gesendet: Mittwoch, 23. Januar 2013 16:39 An: IBM-MAIN@LISTSERV.UA.EDU Betreff: Reg: OMVS deleted files/directories. Hello Team, Can any one help to find out who has deleted particular files/directories under OMVS. Do we have any command to check or any other way( Any utility/job which takes SMF data as a input and generate some report to find the user who has deleted). Any help much appreciated. Thanks & Regards: Sunil Mirchandani 9742433311 "Yesterday I dared to struggle. Today I dare to win" ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN VERLAGSGRUPPE WELTBILD GMBH Sitz der Gesellschaft: Augsburg Handelsregister Augsburg HRB 6035 Ust-ID-Nr: DE 127501299 Geschäftsführung: Carel Halff (Vorsitzender), Dr. Martin Beer Vorsitzender des Aufsichtsrats: Generalvikar DDr. Peter Beer ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN