TSSUTIL can be run to extract the SMF records into a readable format.
Member TSSUTILS in the TSS SAMPJCL library has sample jcl for
running TSSUTIL against the SMF files.
Release : 16.0
Component : CA Top Secret for z/OS
//JOBNAME JOB
//*********************************************************************
//* *
//* CA TOP SECRET SECURITY SAMPLE SECURITY REPORT FOR *
//* ALL SECURITY-RELATED EVENTS; FROM THE VSAM SMF FILES *
//* *
//* CUSTOMIZE THIS JOB AS FOLLOWS: *
//* *
//* . INSERT A VALID JOBCARD(ABOVE). *
//* *
//* . TAILOR THE PROC STATEMENT AND TSSIN-DD TO MEET YOUR SITE *
//* STANDARDS. *
//* *
//* REFER TO THE CA TOP SECRET REPORT & TRACKING GUIDE FOR *
//* FURTHER INFORMATION ON THE TSSUTIL UTILITY PROGRAM. *
//* *
//*********************************************************************
//TSSUTILS PROC PRINT='*', /* SYSOUT O/P DESTINATION */
// SYSDA=SYSDA /* LOCAL DASD DEVICE */
//*
//DUMPSMFX EXEC PGM=IFASMFDP
//SYSOUT DD DUMMY
//SYSPRINT DD DUMMY
//DUMPIN DD DISP=SHR,DSN=SYS1.MANX
//SMFOUT DD DISP=(,PASS),DSN=&&SMF,
// UNIT=&SYSDA,SPACE=(CYL,(5,1))
//SYSIN DD DDNAME=DUMPINX
//*
//DUMPSMFY EXEC PGM=IFASMFDP
//SYSOUT DD DUMMY
//SYSPRINT DD DUMMY
//DUMPIN DD DISP=SHR,DSN=SYS1.MANY
//SMFOUT DD DISP=(MOD,PASS),DSN=&&SMF
//SYSIN DD DDNAME=DUMPINY
//*
//TSSUTIL EXEC PGM=TSSUTIL
//UTILOUT DD SYSOUT=&PRINT
//SMFIN DD DISP=(OLD,DELETE),DSN=&&SMF,DCB=BFTEK=A
//UTILIN DD DDNAME=TSSIN
// PEND
//*
//REPORT EXEC TSSUTILS
//DUMPINX DD *
OUTDD(SMFOUT,TYPE(80))
INDD(DUMPIN,OPTIONS(DUMP))
/*
//DUMPINY DD *
OUTDD(SMFOUT,TYPE(80))
INDD(DUMPIN,OPTIONS(DUMP))
/*
//TSSIN DD *
REPORT EVENT(ALL) DATE(TODAY) END
/*