Auditing the MVS.CANCEL command.

Document ID : KB000026115
Last Modified Date : 14/02/2018
Show Technical Document Details

Problem:

In order to track who issues the MVS.CANCEL command a permit was put in the Audit record:

TSS ADD(AUDIT) OPERCMDS(MVS.CANCEL)

The TSSUTIL report shows JES2, not the user as the acid who issued the command:

08/07/08 12:18:22 08R1 JES2 JES2  S F  $HASPWTO UPDATE  ALL  OK+A  22 r MVS.CANCEL.JOB.JJCPROD1 

Resolution:

When the MVS.CANCEL command is issued SDSF requests JES2 to cancel the job. When a user enters MVS.CANCEL it kicks off a JES2.CANCEL
command and JES2 then performs the MVS.CANCEL and cancels the job.

In order to audit who is actually entering the MVS.CANCEL command you need to audit the JES2.CANCEL command:

TSS ADD(AUDIT) OPERCMDS(JES2.CANCEL)