Skip to main content

RACF Reports

The EaysSMF Events for RACF app provides security reports from SMF type 80 records.

Some events e.g. Login Failures by Source include the IP address. The IP address information is extracted from TCP/IP SMF records. TCPIP type 119 records should be included in the data for the RACF SMF 80 processing so the IP address can be found.

RACF Events​

Search and filter RACF events by system, event, class, result, userid, jobname, resource, and elevated access. Drill down to Event Detail for a selected event.

RACF Events by Resource​

RACF events summarized by resource, with filters for system, event, class, result, and elevated access.

RACF Events by Userid​

RACF events summarized by userid, with filters for system, event, result, and elevated access.

RACF Login/Job Initiation Events​

Login and job initiation events, with filters for system, qualifier, result, userid, and jobname. Drill down to Login Event Detail for a selected event.

Login Failures by Source​

Failed logins summarized by source (for example terminal or IP address).

Login failures include SSH login failures reported in TCP/IP SMF records.

Login Failures by Userid​

Failed logins summarized by userid.

RACF Commands​

RACF command events, with filters for system, event, class, result, userid, jobname, and resource.