RACF 'sort' Reports and Rexx utilities

RACF 'sort' Reports

These have been compiled from the IBM DFSORT/ICETOOL website, the RACF-L listserv offerings, and other customizations for my shop's needs. Hope they help! Steve

I've added some Rexx code I use for a variety of RACF admin functions. Feel free to check them out at the bottom of this page...

SMF historical data reports - IRRADU00

ICE01 - All records applicable to a specific userid

ICE02 - All userids which had an excessive number of invalid passwords

ICE03 - All resource accesses which have been granted because a profile was in Warning mode

ICE04 - All resource accesses which represent a violation

ICE05 - All resource accesses that were allowed due to the user having the RACF 'SPECIAL" attribute

ICE06 - All resource accesses that were allowed due to the user having the RACF "OPERATIONS" attribute ==DETAIL REPORT ==

ICE06a - All resource accesses that were allowed due to the user having the RACF "OPERATIONS" attribute ==SUMMARY REPORT ==

ICE07 - All Terminals which had an excessive number of invalid passwords.

ICE08 - All records which are applicable to a specific dataset ==DETAIL REPORT ==

ICE08a - All records which are applicable to a specific dataset ==SUMMARY REPORT ==

ICE09 - All resources a specific userid(s) accessed with the 'UAUDIT' flag set to 'ON'.

ICE10 - All resource accesses which represent a violation to a specific resource.

ICE11 - List all who issued a specific UNIX command.

ICE12 - List all password resets done by userids that begin with 'RG'.

ICE14 - List all RACF 'PERMIT' commands issued.

ICE16 - List all RACF 'CONNECT' commands issued.

ICE17 - List all RACF 'ALTUSER' commands issued.

ICE20 - List all RACF commands issued.

RACF Database reports - IRRDBU00

ICE50 - All userids who have a RACF 'PASSDATE=00.00'.

ICE51 - All userids who have a 'LAST-CONNECT' date on or before a specified date (YYYY/MM/DD).

ICE52 - All userids who have the RACF userid attribute 'OPERATIONS', 'SPECIAL' or 'AUDITOR'.

ICE53 - All transactions that are defined in more than 1 General Resource class profile.

ICE54 - All userids who have an OMVS segment assigned.

ICE55 - All userids who have the RACF GROUP-LEVEL attribute 'OPERATIONS', 'SPECIAL' or 'AUDITOR' or who are Revoked at the group-level.

ICE56 - All userids who are Revoked or have a future Revoke date set.

ICE57 - All userids created between two dates.

ICE58 - All userids with non-expiring passwords.

ICE59 - All dataset profiles with 'UACC=NONE' (can be modified to report all 'UACC<>NONE').

ICE60 - All group names and their creation date.

ICE61 - All userids with UAUDIT flag set to 'ON'.

ICE62 - All userids with system-Special and a Workattr segment.

ICE63 - All userids that were connected to a specific RACF group in ? days or more (REXX exec also used).

ICE64 - All userids that have never been logged on to.

ICE65 - All General Resource class profiles that end in 'TRN' and list the number of members in each profile. An optional program parm can we issued to list the profile's members if desired. (REXX exec also used)

ICE66 - All dataset profiles with the UACC and Description information.

ICE67 - All userids that have a TSO segment.

ICE68 - All RACF groups that have an OMVS segment (GID).

ICE69 - All dataset profiles with the specified userid/group in the access lists. Also all General Resource class profiles with the specified userid/group in the access lists..

ICE69b - All dataset profiles with their access list entries. Also all General Resource class profiles with their access lists.

ICE70 - All group connections rights that are not 'USE' ('CONNECT', 'JOIN' or 'CREATE')

ICE71 - List all RACF userids

ICE72 - All General Resource class profiles

ICE73 - All General Resource classes that a specific profile is defined in (with access list).

ICE74 - List all userids that have a password interval that does not = 60 days

ICE75 - List all userids that have a password interval less than 33 days

ICE76 - List all dataset profiles that are in 'Warning' mode.

ICE77 - List all Group profiles and what userids are connected each group.

Some Rexx Utilities for RACF Admins

These are some Rexx tools I have thrown together over the years. Feel free to use as you wish and make any improvements you need. I'm sure there are many...

LU2 - List userid profile in scrollable screen

LU3 - List userid profile in scrollable screen - Groups listed alphabetically

LG2 - List group profile in scrollable screen

LG3 - List group profile in scrollable screen - Userids listed alphabetically

LR - List dataset profile that applies to the supplied dataset name. Can be used
from TSO 3.4 screen also.

SETRLIST - List 'Setropts List' output and other system information in a scrollable screen.

TERMID - Revokes userid supplied then updates Installation-Data filed with term date.

RPTdsn1 - Generate access list report of the TSO dataset name provided.

RPTdsn2 - Generate access list report of the RACF dataset profile name provided.

RPTprof - Generate access list report of the RACF profile name provided. (not dataset profile)