Is there any way that ACF2 can report on user logons and their source?
Running ACFRPTLL utility with the UPDATE parameter specified on the input parameters would display entries for successful
logons. Entries with UPDATE in the CHANGE field are created at logon time.
For TSO logons, the JOBNAME field would contain MSTJCL00.
This is useful in the case of TSO logons but would not show all logons in MUSASS (Multi User Single Address Space System) regions that have NO-STATS specified. For example if the TCP/IP region logonid has NO-STATS specified only one logon request per day would show in ACFRPTLL.
An example entry in ACFRPTLL would look something like this
DATE mm/dd/yy (yy.ddd) TIME hh.mm DETAIL UPDATE TIME(S)
DATE TIME LOGONID JOBNAME CHANGER CHANGE CPU USING
FIELD OLD VALUE NEW VALUE
yy.ddd mm/dd hh.mm.ss USERO1 MSTJCL00 UPDATE CPUA
*** NO FIELDS CHANGED ***
In addition, adding MON-LOG field to a logonid, entries for successful logons can be displayed in the ACFRPTPW report
(entries with RC=254).
CA ACF2 - ACFRPTPW - INVALID PASSWORD/AUTHORITY LOG - PAGE 1
DATE mm/dd/yy (yy.ddd) TIME hh.mm
DATE TIME LID JNAME SUBMIT'R SOURCE PROGRAM RC RS
yy.ddd mm/dd hh.mm USER01 USER01 P-LOGON Z452AL075 254
RC FIELD DESCRIPTIONS
254 LOGONID HAS MON-LOG ATTRIBUTE
Details of each utility is explained in Report and Utilities Guide, and details of MON-LOG field is explained in Administrator Guide.
ACF2 cannot generate a report for logoff events as ACF2 doesn't cut a SMF record for logoff processing.