//*                                                                     
//*******************************************************************   
//*   THIS WILL READ THE SMF EXTRACT DATASET OF RACF RELATED SMF        
//*   RECORDS (TYPES 30, 80, 81, 82, 83) AND USE THE SORT TOOL          
//*   TO SORT THE DATA AND GENERATE AN OUTPUT DATASET.                  
//*                                                                     
//*   THIS JOB WILL LIST EVERY TIME THE RACF COMMAND "PERMIT"           
//*   WAS EXECUTED.                                                     
//*                                                                     
//*   OUTPUT DATASET IS SORTED BY DATE/TIME.                            
//*                                                                     
//*******************************************************************   
//PERMIT   EXEC PGM=ICETOOL                                             
//SMFDATA  DD DISP=SHR,DSN=PROD.RACF.SMF.UNLOAD(0)                 
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0002 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0003 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TOOLMSG  DD SYSOUT=*                                                  
//PRINT    DD SYSOUT=(A,,STD),HOLD=YES,DEST=U0022                       
//DFSMSG   DD SYSOUT=*                                                  
//SYSPRINT DD SYSOUT=*                                                  
//SYSMSG   DD SYSOUT=*                                                  
//SYSOUT   DD SYSOUT=*                                                  
//SYSIN    DD *                                                         
/*                                                                      
//*------------------------------------------------------------------   
//TOOLIN   DD *                                                         
 COPY    FROM(SMFDATA) TO(TEMP0001) USING(RACF)                         
 DISPLAY FROM(TEMP0001) LIST(PRINT)           -                                   
         PAGE                                 -                                                         
         TITLE('"PERMIT" COMMANDS ISSUED')    -                            
         DATE(YMD/)                           -                                                   
         TIME(12:)                            -                                                    
         BLANK                                -                                                        
         ON(23,8,CH)   HEADER('TIME')         -                                  
         ON(32,10,CH)  HEADER('DATE')         -                                  
         ON(63,8,CH)   HEADER('USERID')       -                                
         ON(286,8,CH)  HEADER('CLASS')        -                                 
         ON(507,30,CH) HEADER('PROFILE NAME') -                        
         ON(763,50,CH) HEADER('PARMS')                                 
/*                                                                      
//*------------------------------------------------------------------   
//RACFCNTL DD *                                                         
 SORT FIELDS=(32,10,CH,A,23,8,CH,A)                                     
 INCLUDE COND=(5,6,CH,EQ,C'PERMIT')                                     
 OPTION VLSHRT                                                          
/*                                                                      

    Source: geocities.com/steveneeland