Event codes

The RACF SMF data unload utility creates records that represent the audit information for each type of auditable event. Table 1 contains a list of all of the supported event codes.
COLUMN NAME
DESCRIPTION
Event Code Name
Name of the event code
Column ID (Col ID)
Shortened name that is used in the column name of fields that are a part of the event code record
Event Code
The number assigned to this event code by RACF®
Description
A description of the event code.
Where Described
Where you can find the record definitions.
Table 1. Event codes and descriptions
Event code name Col ID Event code Description Where described
JOBINIT INIT 01 Job initiation The JOBINIT record extension
ACCESS ACC 02 Resource access, other than file or directory. The ACCESS record extension
ADDVOL ADV 03 ADDVOL/CHGVOL The ADDVOL record extension
RENAMEDS REN 04 Rename data set, SFS file, or SFS directory The RENAMEDS record extension
DELRES DELR 05 Delete resource The DELRES record extension
DELVOL DELV 06 Delete volume The DELVOL record extension
DEFINE DEF 07 Define resource The DEFINE record extension
ADDSD AD 08 ADDSD command The ADDSD record extension
ADDGROUP AG 09 ADDGROUP command The ADDGROUP record extension
ADDUSER AU 10 ADDUSER command The ADDUSER record extension
ALTDSD ALD 11 ALTDSD command The ALTDSD record extension
ALTGROUP ALG 12 ALTGROUP command The ALTGROUP record extension
ALTUSER ALU 13 ALTUSER command The ALTUSER record extension
CONNECT CON 14 CONNECT command The CONNECT record extension
DELDSD DELD 15 DELDSD command The DELDSD record extension
DELGROUP DELG 16 DELGROUP command The DELGROUP record extension
DELUSER DELU 17 DELUSER command The DELUSER record extension
PASSWORD PWD 18 PASSWORD command The PASSWORD record extension
PERMIT PERM 19 PERMIT command The PERMIT record extension
RALTER RALT 20 RALTER command The RALTER record extension
RDEFINE RDEF 21 RDEFINE command The RDEFINE record extension
RDELETE RDEL 22 RDELETE command The RDELETE record extension
REMOVE REM 23 REMOVE command The REMOVE record extension
SETROPTS SETR 24 SETROPTS command The SETROPTS record extension
RVARY RVAR 25 RVARY command The RVARY record extension
APPCLU APPC 26 APPC session The APPCLU record extension
GENERAL GEN 27 General purpose The general event record extension
DIRSRCH DSCH 28 Directory Search The directory search record extension
DACCESS DACC 29 Check access to a directory The check directory access record extension
FACCESS FACC 30 Check access to file The check file access record extension
CHAUDIT CAUD 31 Change audit options The change audit record extension
CHDIR CDIR 32 Change current directory The change directory record extension
CHMOD CMOD 33 Change file mode The change file mode record extension
CHOWN COWN 34 Change file ownership The change file ownership record extension
CLRSETID CSID 35 Clear SETID bits for a file The clear SETID bits record extension
EXESETID ESID 36 EXEC with SETUID/SETGID The EXEC SETUID/SETGID record extension
GETPSENT GPST 37 Get z/OS UNIX process entry The GETPSENT record extension
INITOEDP IOEP 38 Initialize z/OS UNIX process The initialize z/OS UNIX record extension
TERMOEDP TOEP 39 z/OS UNIX process complete The z/OS UNIX process completion record
KILL KILL 40 Terminate a process The KILL record extension
LINK LINK 41 LINK The LINK record extension
MKDIR MDIR 42 Make directory The MKDIR record extension
MKNOD MNOD 43 Make node The MKNOD record extension
MNTFSYS MFS 44 Mount a file system The mount file system record extension
OPENFILE OPEN 45 Open a new file The OPENFILE record extension
PTRACE PTRC 46 PTRACE authority checking The PTRACE record extension
RENAMEF RENF 47 Rename file The rename file record extension
RMDIR RDIR 48 Remove directory The RMDIR record extension
SETEGID SEGI 49 Set effective z/OS UNIX group identifier (GID). The SETEGID record extension
SETEUID SEUI 50 Set effective z/OS UNIX user identifier (UID) The SETEUID record extension
SETGID SGI 51 Set z/OS UNIX group identifier (GID). The SETGID record extension
SETUID SUI 52 Set z/OS UNIX user identifier (UID) The SETUID record extension
SYMLINK SYML 53 SYMLINK The SYMLINK record extension
UNLINK UNL 54 UNLINK The UNLINK record extension
UMNTFSYS UFS 55 Unmount file system The unmount file system record extension
CHKFOWN CFOW 56 Check file owner The check file owner record extension
CHKPRIV CPRV 57 Check privilege The check privilege record extension
OPENSTTY OSTY 58 Open slave TTY The open slave TTY record extension
RACLINK RACL 59 RACLINK command The RACLINK command record extension
IPCCHK ICHK 60 Check IPC access The IPCCHK record extension
IPCGET IGET 61 IPCGET The IPCGET record extension
IPCCTL ICTL 62 IPCCTL The IPCCTL record extension
SETGROUP SETG 63 SETGROUP The SETGROUP record extension
CKOWN2 CKO2 64 CKOWN2 The CKOWN2 record extension
R_AUDIT ACCR 65 Access Rights The access rights record extension
RACDCERT RACD 66 RACDCERT command The RACDCERT command record extension
INITACEE INTA 67 InitACEE The InitACEE record extension
KTICKET KTKT 68 Grant of initial Kerberos ticket The Network Authentication Service record extension
RPKIGENC RPKG 69 Certificate GENCERT request The RPKIGENC record extension
RPKIEXPT RPKE 70 Certificate EXPORT request The RPKIEXPT record extension
PDACCESS PDAC 71 Policy Director Authorization Services access control decision The Policy Director Authorization Services record extension
RPKIREAD RPKR 72 Certificate administration - read record The RPKIREAD record extension
RPKIUPDR RPKU 73 Certificate administration - update request record The RPKIUPDR record extension
RPKIUPDC RPKC 74 Certificate administration - update certificate record The RPKIUPDC record extension
SETFACL SACL 75 ACL entry changes The SETFACL record extension
DELFACL DACL 76 ACL deletion The DELFACL record extension
SETFSECL SSCL 77 Set security label of a z/OS® UNIX file The SETFSECL record extension
WRITEDWN WDWN 78 Set write-down privilege The WRITEDWN record extension
PKIDPUBR PKDP 79 CRL publication The PKIDPUBR record extension
RPKIRESP RPKO 80 Created by RPKIRESP The RPKIRESP record extension
PTEVAL PTEV 81 PassTicket evaluation The PassTicket evaluation (PTEVAL) record extension
PTCREATE PTCR 82 PassTicket generation The PassTicket generation (PTCREATE) record extension
RPKISCEP RPKS 83 R_PKIServ SCEPREQ The RPKISCEP record extension
RDATAUPD RPUT 84 R_datalib write function The RDATAUPD record extension
PKIAURNW PKRN 85 R_PKIServ automatic certificate renewal The PKIAURNW record extension
PGMVERYF PGMV 86 R_PgmSignVer signature verification The PGMVERYF record extension
RACMAP RACM 87 Defines the association between the distributed user identity and a RACF defined user ID The RACMAP record extension
AUTOPROF AUTO 88 Logs events that automatically modify RACF profiles The AUTOPROF record extension
RPKIQREC RPKQ 89 Finds a list of certificates of which have key pairs generated by PKI Services using the specified requester's email address and pass phrase The RPKIQREC record extension