For information on how to capture SMF log records for RACF access events, see z/OS Security Server RACF Auditor’s Guide and z/OS Security Server RACF Command Language Reference.

You can extract RACF log records from the SMF data set that can be correlated to the ICSF log records. For more information on how to obtain RACF log records from the SMF data set, see z/OS Security Server RACF Auditor’s Guide.