Audit trail for security admin person issuing NORULE(null|jobname|ALL).
TSO: SET NORULE [(jobname|ALL)]"
Release : R16
Z/OS
The ACFRPTNV report is able to report on the issuing of the TSO: SET NORULE [(jobname|ALL)]" command from TSO.
An SMF record is generated and it is an implied modify type even though you didn't enter it as a modify.
Below is a sample report output.
ACF2 MODIFY userid yy.ddd mm/dd hh:mm 00 sysid sysid
PARM='SETNORUL(ALL)'
MSG ='ACF79931 RULES RESET FOR ALL ADDRESS SPACES'