SMF records
- Type 80
- Produced during RACF processing
- Type 81
- Produced at the completion of RACF initialization and the SETROPTS command
- Type 83
- Produced during RACF and z/OS® component processing
The type 83 record is generated under the following circumstances: SETROPTS MLACTIVE is in effect and a RACF command (ADDSD, ALTDSD, DELDSD) has been issued that changed the security label of a data set profile.
Security events detected by non-RACF components.
The first 18 bytes of type 80 and 81 records represent the standard SMF header without subtypes. The first 24 bytes of type 83 records represent the standard SMF header with subtypes. See z/OS MVS System Management Facilities (SMF) for information about how to use SMF.
For sorting purposes, the RACF report writer reformats SMF records (types 20, 30, 80, 81 and 83) and uses these reformatted records as input to the modules that produce the RACF reports. There are two types of reformatted records: reformatted process records and reformatted status records. If you want to use the RACF report writer exit (ICHRSMFE) to produce additional reports or to add additional record selection criteria, you should familiarize yourself with the layouts of these reformatted records.
Table 1 shows each RACROUTE request type and the corresponding independent system macro.
Guideline: Use a RACROUTE request rather than an independent system macro.
| RACROUTE request type | Independent RACF system macro |
|---|---|
| REQUEST=AUTH | RACHECK |
| REQUEST=DEFINE | RACDEF |
| REQUEST=EXTRACT | RACXTRT |
| REQUEST=FASTAUTH | FRACHECK |
| REQUEST=LIST | RACLIST |
| REQUEST=STAT | RACSTAT |
| REQUEST=VERIFY | RACINIT |
| REQUEST=VERIFYX | RACINIT |