Mainframe Basics for Security Professionals: Getting Started with RACF

Chapter 4. Logging

Thus far we have shown how to authenticate users and create profiles that authorize users to use various resources. Now we demonstrate how to log user actions to ensure that users are using their rights appropriately.

Terminology

You will often hear the words auditing and logging used interchangeably. Don’t be confused by the two: Logging is the act of recording information about an event. Auditing is the examination of information, including logs, to ensure compliance with the installation security policy.

Unfortunately, the operating system documentation sometimes uses these terms inconsistently. In the TSO commands, log options are used for logging information about a particular resource, such as when a data set is modified. ...