)DEFAULT )&?!˘}~
)CM /***********************************************BeginModule********
)CM  * Copyright IBM Corp. 1989, 2015
)CM  * Purpose: Copy RACF commands to a z/OS UNIX file
)CM  ************************************************EndModule********/
)CM Pass one query
)SEL &C2PEPASS = Y
  /* create an ALLOC for a unix file with unique filename */
n type=racf outlim=1 nopage
 sortlist,
  "alloc type=output dd=logfile," /,
  "path='/var/c2police/racf." | stamp(hex,12) | ".logfile';"

)ENDSEL
)CM Alert condition
)SEL &C2PEPASS = N
)IM C2PSGNEW
  /* make sure there is OUTLIM=0 in the newlist options */
 select type=80
)CM WTO sortlist
)SEL &C2PERCTP = WTO
 sortlist,
  recno(nd),
  user(0) 'issued' racfcmd(hor,0)

newlist type=smf nopage dd=logfile,
 name=L4091C

 select likelist=recent event=allcmds

 sortlist,
  recno(nd) '<&C2PEPRIO.>' | date(month,3) date(monthday,0) time(8),
  system 'C2P&c2pemem.',
  'ÝC2P&C2PEMEM.',
  'whatCOMMAND="' | racfcmd(hor,0) | '"',
  'whatPRIVILEGE="' | racfauth(0,explode,hor) | '"',
  'whatDESC="' | desc(0,explode,hor) | '"',
  'whatREASON="' | reason(0,explode,hor) | '"',
  'onWhatCLASS="' | class(0,firstonly) | '"',
  'onWhatPROFILE="' | profile(0,firstonly) | '"',
  'whoUSERID="' | userid(0) | '"',
  'whoNAME="' | user:pgmrname(0) | '"',
  'whoJOBNAME="' | jobname(0) | '"',
  'whoJOBID="' | jobid(0) | '"',
  'whoSNODE="' | UTOKEN_SNODE(0) | '"',
  'whoSUSER="' | UTOKEN_SUSER(0) | '"',
  'whenSMFTIME="' | datetime(Java_SimpleDate,0) | '"',
  'whereSYSTEM="' | system(0) | '"¨',
   'RACF command' desc(0,explode,hor) 'by user' user(0) racfcmd(hor,0)
)ENDSEL
)ENDSEL