Mainframe, MVS and zOS Discussion

How to find out who edited PS file?

[ Post made via Android ]

If by "ps file" you mean a sequential MVS data set:
To find out who edited a data set in the past, you'll need to pull in the SMF records (type 15 for output in particular) to find the user id.
If you want to track this for future edits, work with your site support group to have RACF record all accesses to the data set.

If by "ps file" you mean a sequential Unix System Services file, I don't recall if SMF type 15 records are written for USS files -- you will have to research that yourself in the SMF manual. And you would need to check with your site support group about RACF logging for USS files for future edits.

And, in general, if editing a data set (or file) is a concern, using your site security package to control access is the way to go. If you want to complain that everyone in your group needs to be able to edit the data set (or file), then you need to have your site security package logging EVERY access (read, write, delete -- whatever) so you know who modified it and when.

Robert Sample wrote: ↑Fri Dec 14, 2018 8:55 pmIf by "ps file" you mean a sequential MVS data set:
To find out who edited a data set in the past, you'll need to pull in the SMF records (type 15 for output in particular) to find the user id.
If you want to track this for future edits, work with your site support group to have RACF record all accesses to the data set.

This is what I meant. I did not know that there are these many possibilities. I read somewhere that MVS does not really work on "who" instead works on "what" concept. Like it never stores who has updated a given data set but at what time, it might store that. Looks like I was thinking right.

Like it never stores who has updated a given data set but at what time, it might store that. Looks like I was thinking right.

No, you're not really thinking right. RACF records when a data set is written in the type 15 records, but the user id is part of the SMF type 15 record. Auditing requires knowledge of both what happened and who did it.

Sorry to nitpick,
"RACF records when a data set is written in the type 15 records, "
I was under the impression that SMF started task monitors this activity and captures this information in type 15 records, rather than RACF.

I think RACF records activity only in Type 80 records.
Please feel free to correct me.

Regards,
Vasanth.S

Thanks. But is it RACF or SMF?

RACF (or whatever security software is used at the site) controls access and logging, but the type 15 records are written to the SMF output (which may be a logstream or data set). Sorry for not making that clear.

Thanks Robert. I was looking for this information and got to this topic, again.

I have bit odd question, how can we really try to become more knowledgeable with RACF. I am a programmer and would like to learn and practice about RACF but my company won't allow that. As I work from offshore and they don't have this team at offshore. So is it possible that someone can understand RACF by creating some sandbox at home?

IBM has a thing called ZD&T which is an emulation system that lets z/OS run on a PC and will allow you full administration rights. This was intended for commercial use, so the pricing of it is rather high. They did, however, create a "Learner's Edition" which cost 120USD but it was only made available for a short period and only in the USA. According to the website, the Learner's edition is "currently being updated and will return soon." This message has been there for most of the year. I have been told that it was expected to be re-released some time this year and that it will be more widely available.

The website is here: https://www.ibm.com/products/z-developm ... nt/pricing

Thanks zum13.

But this is very expensive specially when you earn in rupees. Not sure if we can ever create an environment for personal learning.