Why is Deliver not producing logins or violations in external security?
There was a RMOPARM SECMSG setting of SECMSG=(NO,NO), which meant that the RMOATX01 message was not sent to the SYSLOG, and any failures were not being logged with the external security manager.
Change the setting to SECMSG=(NO,YES), which then enabled failures to log with the external security manager.