Sample RACFRW CONTROL Files

The following are examples of RACFRW CONTROL files that produce various reports from the RACF report writer.

This file produces a report with all RACF SMF records sorted by user, and a general summary report showing overall RACF-related system activity. (This report may be large. It can produce more than 10,000 lines.)
```
RACFRW  TITLE ('ALL ACTIVITIES REPORT BY USER') GENSUM
 LIST SORT(USER)
END
```

This file produces a report of failures to access all RACF protected resources and of violations at logon. A summary report by resource and by user is provided.

RACFRW  TITLE ('MONITORING ACCESS VIOLATIONS')
 SELECT PROCESS VIOLATIONS
  EVENT ACCESS EVQUAL(1)
  EVENT LOGON
 LIST SORT(USER  CLASS)
 SUMMARY RESOURCE BY(USER)
 SUMMARY USER BY(RESOURCE)
END

This file produces a summary report of minidisk access violations. The report is sorted by user.

RACFRW GENSUM TITLE('ACCESS VIOLATIONS SORTED BY USERID OF OFFENDERS')
 SELECT PROCESS VIOLATIONS
  EVENT ACCESS CLASS(VMMDISK)
 SUMMARY RESOURCE BY(USER)
END

This file produces a report of the activities of SPECIAL and group-SPECIAL users.

RACFRW  TITLE ('USERS WITH SPECIAL OR GROUP-SPECIAL ATTRIBUTE REPORT')
 SELECT PROCESS REASON(SPECIAL)
 SELECT PROCESS AUTHORITY(SPECIAL)
  EVENT ALLSVC
  EVENT ALLCOMMAND
LIST SORT(USER)
END

This file produces a list of all the RACF commands issued. The report is sorted by user.

RACFRW  TITLE ('MONITORING THE USE OF RACF COMMANDS')
 SELECT PROCESS
  EVENT ALLCOMMAND
 SUMMARY COMMAND BY (USER)
END

This file produces a report of the activities of OPERATIONS and group-OPERATIONS users.

RACFRW TITLE('USERS WITH OPERATIONS OR GROUP-OPERATIONS ATTRIBUTE' )
 SELECT PROCESS AUTHORITY(OPERATIONS)
  EVENT ALLSVC
  EVENT ALLCOMMAND
LIST SORT(USER)
END

This file produces a report of password violations at logon.

RACFRW  TITLE ('PASSWORD VIOLATION REPORT')
 SELECT PROCESS
  EVENT LOGON EVQUAL(1)
LIST SORT(USER)
END

This file produces a report of failed logons for user Smith.

RACFRW TITLE('REPORT ON FAILED LOGONS FOR USER SMITH')
 SELECT PROCESS  USER(DUMMY)
  EVENT LOGON
SUMMARY USER NEWPAGE
END

This file produces a report of access granted only because the warning mode is active.

RACFRW  TITLE ('MONITORING ACCESS ATTEMPTS IN WARNING MODE')
 SELECT PROCESS  WARNING
LIST SORT(DATE USER EVENT NAME CLASS)
END

This file produces a report of ALTUSER commands issued by user Jones.

RACFRW TITLE('ALTUSER COMMANDS ISSUED BY USER JONES')
 SELECT PROCESS USER(JONES)
  EVENT ALTUSER
 SUMMARY USER
END