During an SFTP transaction the mainframe makes calls to resource csfowh which then generate smf type 80 logging records.
Release : 16.0
Component : CA Top Secret for z/OS
LOG(ACC,SMF) was set in the Top Secret Control Options which causes authorized access to get logged to the Top Secret Audit Tracking File and SMF dataset.