ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

ACFRPTTZ - Audit Utility for ACF2


Article ID: 223236


Updated On:


ACF2 - z/OS


As an auditor, you want to see all activity that occurs by a user or ticket from elevation to de-elevation or elevation timeout. A unique user ID (TAMID) is assigned at elevation time and carried through each elevation and de-elevation event.


Release : 16.0

Component :


The ACFRPTTZ audit utility reads the same SMF records as the following reports and 
generates a CSV file containing the fields that appear on the individual reports. The SAFTZJSN reads the CSV 
file, reformats, and creates a JSON file. The ACFRPTTZ SAMPJ member contains an example of how to invoke 
• ACFRPTDS - Data Set/Program Event Log
• ACFRPTEL - Infostorage Update Log
• ACFRPTLL - Logonid Modification Log
• ACFRPTNV - The Environment Report
• ACFRPTRL - Rule ID Modification Log
• ACFRPTRV - Resource Event Log
The ACFRPTTZ utility accepts the following parameters:
Allows the user to report ELEVATE-related entries. The CSV output contains information from SMF records, 
which are written while the user was elevated. Output includes records which are written to elevate and end 
the elevation for a user.
Specifies an elevation activity for a specific user.
Specifies an elevation activity for specific TAMIDs. Up to 32 TAMID values or masks can be specified. Only 
records with TAMID values are selected.
Specifies elevation activity for specific TICKETS. Up to 32 ticket number values or masks can be specified. If 
TICKET is not specified, all ticket numbers are reported

The following sample output is from the ACFRPTTZ utility:

CA ACF2 - ACFRPTTZ - TAMz Activity Journal - PAGE 1 DATE 08/31/21 (21.243) TIME 13.51

Counts CSV 30 DS 3 EL 3 LL 0 NV 3 RL 0 RV 21

The following sample output is the CSV file generated by ACFRPTTZ:

"SMF subtype","CVS File date","CSV File Time","Date of Record","Time of Record",TAMID,TICKET,TAM CLASS,"TAM Reason","Elevation Status","Elevation Disp","Job Name",LOGONID,"UID String",Source,"SMF CPU ID","System ID",Module,"User Name",ACSMROLE,"NV-Cmd Issuer","NV-Elevated User",NV-Event,NV-ConsoleCMD,"DS-Record type","DS-Vio Type",DS-Access,"DS-Access Type",DS-Dataset,DS-Volume,"DS-PDS member",DS-DDname,DS-Library,DSLib Volume,DS-Program,"DS-Step Name","DS-Job Number",DS-Source,DS-Name,DS-RM-RC,DS-Inst,DS-STAPE,"DS-Nextkey count","DS-Pgm Path err","EL-Record Key",EL-Function,"LL-Record Key","LL-Signon type",LL-Function,"RL-Record Key",RL-Function,RV-Lookup Key,RV-Requested RSC,RV-NAME,"RV-Record mode",RV-DISP,RV-DSP-MOD,RV-PRE,RV-RMC,RV[1]INT,RV-PST,RV-FIN,RV-SERV,RV-SAF RSC CLASS,"RV-Rsrc Name",RV-LogString,RV-LONG rcrd key,RV-Criteria, Y,09/02/21,,09/01,12.21,"0901202112212242",,zztop,"put stuff in csv",,,CUNKE01,CUNKE01,"SHS CUNKE01",A43LO903,XE43,XE43,,,,CUNKE01,curar15,"ELEVATE",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, V,09/02/21,,09/01,12.21,"0901202112212242",,ZZTOP,"put stuff in csv",ELEVATED,ALLOWED,CURAR15,CURAR15," CURAR15",A43LO901,XE43,XE43,ACF9CFAT,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,RFAC-IARRSM,RFAC[1]IARRSM.EXEMPT.ASLR.CURAR15,"AQUAMAN",LOG,NO[1]REC,ELEVATE,00,08,00,00,04,READ,FACILITY,IARRSM.EXEMPT.ASLR.CURAR15,,,,