//*                                                                     
//*******************************************************************   
//*   THIS WILL READ THE SMF EXTRACT DATASET OF RACF RELATED SMF        
//*   RECORDS (TYPES 30, 80, 81, 82, 83) AND USE THE SORT TOOL          
//*   TO SORT THE DATA AND GENERATE AN OUTPUT DATASET.                  
//*                                                                     
//*   THIS JOB WILL LIST EVERY TIME THE RACF COMMAND "CONNECT"          
//*   WAS EXECUTED.                                                     
//*                                                                     
//*   OUTPUT DATASET IS SORTED BY DATE/TIME.                            
//*                                                                     
//*******************************************************************   
//CONNECT  EXEC PGM=ICETOOL                                             
//SMFDATA  DD DISP=SHR,DSN=PROD.RACF.SMF.UNLOAD(0)                 
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0002 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TEMP0003 DD DISP=(NEW,DELETE,DELETE),SPACE=(0,(1000,350))             
//TOOLMSG  DD SYSOUT=*                                                  
//PRINT    DD SYSOUT=(A,,STD) ,HOLD=YES                       
//DFSMSG   DD SYSOUT=*                                                  
//SYSPRINT DD SYSOUT=*                                                  
//SYSMSG   DD SYSOUT=*                                                  
//SYSOUT   DD SYSOUT=*                                                  
//SYSIN    DD *                                                         
/*                                                                      
//*------------------------------------------------------------------   
//TOOLIN   DD *                                                         
 COPY    FROM(SMFDATA) TO(TEMP0001) USING(RACF)                         
 DISPLAY FROM(TEMP0001) LIST(PRINT) -                                   
         PAGE -                                                         
         TITLE('"CONNECT" COMMANDS ISSUED') -                           
         DATE(YMD/) -                                                   
         TIME(12:) -                                                    
         BLANK -                                                        
         ON(23,8,CH)    HEADER('TIME') -                                
         ON(32,10,CH)   HEADER('DATE') -                                
         ON(63,8,CH)    HEADER('DONE BY') -                             
         ON(498,8,CH)   HEADER('DONE TO') -                             
         ON(336,4,CH)   HEADER('UAUDIT') -                              
         ON(507,60,CH)  HEADER('PARMS')                                 
/*                                                                      
//*------------------------------------------------------------------   
//RACFCNTL DD *                                                         
 SORT FIELDS=(32,10,CH,A,23,8,CH,A)                                     
 INCLUDE COND=(5,7,CH,EQ,C'CONNECT')                                    
 OPTION VLSHRT                                                          
/*                                                                      

    Source: geocities.com/steveneeland