//*                                                                     
//*******************************************************************   
//*   THIS WILL READ THE SMF EXTRACT DATASET OF RACF RELATED SMF        
//*   RECORDS (TYPES 30, 80, 81, 82, 83) AND USE THE SORT TOOL          
//*   TO SORT THE DATA AND GENERATE A REPORT.                           
//*                                                                     
//*   THIS JOB WILL REPORT ALL RESOURCE ACCESSES WHICH REPRESENT        
//*   A VIOLATION.                                                      
//*                                                                     
//*******************************************************************   
//REPORT   EXEC PGM=ICETOOL                                             
//SMFDATA  DD DISP=SHR,DSN=PROD.RACF.SMF.UNLOAD(0)                 
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0002 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0003 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TOOLMSG  DD SYSOUT=*                                                  
//PRINT    DD SYSOUT=(A,,STD),DEST=U0022,HOLD=YES                       
//DFSMSG   DD SYSOUT=*                                                  
//SYSPRINT DD SYSOUT=*                                                  
//SYSMSG   DD SYSOUT=*                                                  
//SYSOUT   DD SYSOUT=*                                                  
//SYSIN    DD *                                                         
/*                                                                      
//*------------------------------------------------------------------   
//TOOLIN   DD *                                                         
 COPY    FROM(SMFDATA) TO(TEMP0001) USING(RACF)                         
 DISPLAY FROM(TEMP0001) LIST(PRINT)            -                        
         PAGE                                  -                        
         TITLE('RESOURCE ACCESS VIOLATIONS')   -                        
         DATE(YMD/)                            -                        
         TIME(12:)                             -                        
         BLANK                                 -                        
         ON(32,10,CH)  HEADER('DATE')          -                        
         ON(63,8,CH)   HEADER('USERID')        -                        
         ON(286,35,CH) HEADER('RESOURCE NAME') -                        
         ON(542,5,CH)  HEADER('RQST')          -                        
         ON(551,5,CH)  HEADER('GRANT')         -                        
         ON(578,8,CH)  HEADER('CLASS')         -                        
         ON(605,28,CH) HEADER('PROFILE')                                
/*                                                                      
//*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -    
//*   DEFINE REPORT CRITERIA                                            
//*- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -    
//RACFCNTL DD *                                                         
 SORT FIELDS=(63,8,CH,A,32,10,CH,A,286,35,CH,A)                         
 INCLUDE COND=(5,8,CH,EQ,C'ACCESS',AND,                                 
               48,3,CH,EQ,C'YES')                                       
 OPTION VLSHRT                                                          
/*                                                                      

    Source: geocities.com/steveneeland