I have found reference to violations against OPERCMDS resource MVS.UNKNOWN - what is this?
MVS.UNKNOWN is used to handle MVS system commands that operators might enter but which the system does not recognize. Some command processors, including CANCEL, FORCE, MODIFY, and STOP, also use this resource when auditing unknown tasks or address spaces.
A specific LOG rule may be used to allow and log these validations to SMF for subsequent reporting via the ACFRPTRV report, i.e.:
UNKNOWN UID(*) LOG
(where opr is the OPERCMDS RSRCTYPE defined in GSO CLASMAP)