[prev in list] [next in list] [prev in thread] [next in thread] 

List:       racf-l
Subject:    Re: RACF ID's deleted
From:       D E Engelbrecht <elardus.engelbrecht () SITA ! CO ! ZA>
Date:       2011-08-19 14:20:37
Message-ID: 201108191420.p7JAlsv5015472 () waikiki ! cc ! uga ! edu
[Download RAW message or body]

Mark Steely wrote:

>I had several ID's which were deleted and I can't determine how or who was
able to do this. SMF has no record of this event. Is there any other way
to find out what happen to these ID's.

Ouch...

Do you have an old copy of your RACF DB or an unloaded RACF DB? If you can
find it, you can search SMF records from ALL systems using that RACF DB. Or
use that info to recover your data.

That is at least you (previously) enabled collecting SMF records 80 and
others as well the SETROPTS option SAUDIT + CMDVIOL and setting audit for
USER class.

HTH!

Groete / Greetings
Elardus Engelbrecht
[prev in list] [next in list] [prev in thread] [next in thread]