Using the RACF report writer

The RACF® report writer lists information contained in RACF-generated SMF records. With the RACF report writer you can:

Collect data about successful accesses and warnings before building resource profile access lists.
List the contents of RACF SMF records in a format that is easy to read.
Obtain reports that describe attempts to access a particular RACF-protected resource. These reports contain the user ID, the number and type of successful accesses, the number and type of unauthorized access attempts, and the name of the user if available in the SMF record.
Obtain reports that describe user and group activity.
Obtain reports that summarize system and resource use.

The output from the RACF report writer includes a header page that explains the meaning of the event and qualifier numbers that appear in the SMF record listings and summary reports. The remainder of the report comes in various forms, according to your selection. You can request a general summary, SMF record listings, and summary reports.

The RACF report writer has been stabilized at the RACF 1.9.2 level and has not been enhanced for this release. For example, it does not support audit records for z/OS UNIX events. To create reports and use the audit records for those events, use the SMF data unload utility.

See z/OS Security Server RACF Auditor's Guide for complete information on using the report writer.