Is there any way that ACF2 can report on user logons and their source?

Document ID : KB000026487
Last Modified Date : 14/02/2018
Show Technical Document Details

Question:

Is there any way that ACF2 can report on user logons and their source?

Answer:

Running ACFRPTLL utility with the UPDATE parameter specified on the input parameters would display entries for successful
logons. Entries with UPDATE in the CHANGE field are created at logon time.
For TSO logons, the JOBNAME field would contain MSTJCL00.
This is useful in the case of TSO logons but would not show all logons in MUSASS (Multi User Single Address Space System) regions that have NO-STATS specified. For example if the TCP/IP region logonid has NO-STATS specified only one logon request per day would show in ACFRPTLL.

An example entry in ACFRPTLL would look something like this

DATE mm/dd/yy (yy.ddd) TIME hh.mm DETAIL UPDATE TIME(S)
DATE              TIME  LOGONID JOBNAME CHANGER CHANGE CPU USING 
FIELD             OLD VALUE                           NEW VALUE

yy.ddd mm/dd hh.mm.ss USERO1 MSTJCL00               UPDATE CPUA 
  *** NO FIELDS CHANGED *** 

In addition, adding MON-LOG field to a logonid, entries for successful logons can be displayed in the ACFRPTPW report
(entries with RC=254).

CA ACF2 - ACFRPTPW - INVALID PASSWORD/AUTHORITY LOG -                 PAGE    1
DATE mm/dd/yy (yy.ddd) TIME hh.mm                                               
                                                                                
    DATE             TIME          LID      JNAME  SUBMIT'R     SOURCE    PROGRAM    RC   RS
                                                                               
yy.ddd mm/dd hh.mm       USER01  USER01  P-LOGON    Z452AL075                   254  
RC FIELD DESCRIPTIONS                                                          
  254  LOGONID HAS MON-LOG ATTRIBUTE                                           

Details of each utility is explained in Report and Utilities Guide, and details of MON-LOG field is explained in Administrator Guide.

ACF2 cannot generate a report for logoff events as ACF2 doesn't cut a SMF record for logoff processing.