Maintaining system security

An installation can use Resource Access Control Facility (RACF®) SMF record types (80, 81 and 83) to:

Track the total use of a resource.
Identify the resources that are repeated targets of detected unauthorized attempts to access them.
Identify the users who make detected unauthorized requests.
Track the activity of a particular user.
Perform operator command auditing.

z/OS Security Server RACF Auditor's Guide describes how the installation can request that records be written, and how to use the RACF report writer to look at the results.

RACF provides options that allow your installation to control access to resources and, through SMF records, audit your security controls. Note that many of these options significantly increase the number of SMF records your system generates.