In order to track who issues the MVS.CANCEL command a permit was put in the Audit record:
TSS ADD(AUDIT) OPERCMDS(MVS.CANCEL)
The TSSUTIL report shows JES2, not the user as the acid who issued the command:
08/07/08 12:18:22 08R1 JES2 JES2 S F $HASPWTO UPDATE ALL OK+A 22 r MVS.CANCEL.JOB.JJCPROD1
When the MVS.CANCEL command is issued SDSF requests JES2 to cancel the job. When a user enters MVS.CANCEL it kicks off a JES2.CANCEL
command and JES2 then performs the MVS.CANCEL and cancels the job.
In order to audit who is actually entering the MVS.CANCEL command you need to audit the JES2.CANCEL command:
TSS ADD(AUDIT) OPERCMDS(JES2.CANCEL)