Event codes

The RACF SMF data unload utility creates records that represent the audit information for each type of auditable event. Table 1 contains a list of all of the supported event codes.

COLUMN NAME: DESCRIPTION
Event Code Name: Name of the event code
Column ID (Col ID): Shortened name that is used in the column name of fields that are a part of the event code record
Event Code: The number assigned to this event code by RACF®
Description: A description of the event code.
Where Described: Where you can find the record definitions.

Table 1. Event codes and descriptions
Event code name	Col ID	Event code	Description	Where described
JOBINIT	INIT	01	Job initiation	The JOBINIT record extension
ACCESS	ACC	02	Resource access, other than file or directory.	The ACCESS record extension
ADDVOL	ADV	03	ADDVOL/CHGVOL	The ADDVOL record extension
RENAMEDS	REN	04	Rename data set, SFS file, or SFS directory	The RENAMEDS record extension
DELRES	DELR	05	Delete resource	The DELRES record extension
DELVOL	DELV	06	Delete volume	The DELVOL record extension
DEFINE	DEF	07	Define resource	The DEFINE record extension
ADDSD	AD	08	ADDSD command	The ADDSD record extension
ADDGROUP	AG	09	ADDGROUP command	The ADDGROUP record extension
ADDUSER	AU	10	ADDUSER command	The ADDUSER record extension
ALTDSD	ALD	11	ALTDSD command	The ALTDSD record extension
ALTGROUP	ALG	12	ALTGROUP command	The ALTGROUP record extension
ALTUSER	ALU	13	ALTUSER command	The ALTUSER record extension
CONNECT	CON	14	CONNECT command	The CONNECT record extension
DELDSD	DELD	15	DELDSD command	The DELDSD record extension
DELGROUP	DELG	16	DELGROUP command	The DELGROUP record extension
DELUSER	DELU	17	DELUSER command	The DELUSER record extension
PASSWORD	PWD	18	PASSWORD command	The PASSWORD record extension
PERMIT	PERM	19	PERMIT command	The PERMIT record extension
RALTER	RALT	20	RALTER command	The RALTER record extension
RDEFINE	RDEF	21	RDEFINE command	The RDEFINE record extension
RDELETE	RDEL	22	RDELETE command	The RDELETE record extension
REMOVE	REM	23	REMOVE command	The REMOVE record extension
SETROPTS	SETR	24	SETROPTS command	The SETROPTS record extension
RVARY	RVAR	25	RVARY command	The RVARY record extension
APPCLU	APPC	26	APPC session	The APPCLU record extension
GENERAL	GEN	27	General purpose	The general event record extension
DIRSRCH	DSCH	28	Directory Search	The directory search record extension
DACCESS	DACC	29	Check access to a directory	The check directory access record extension
FACCESS	FACC	30	Check access to file	The check file access record extension
CHAUDIT	CAUD	31	Change audit options	The change audit record extension
CHDIR	CDIR	32	Change current directory	The change directory record extension
CHMOD	CMOD	33	Change file mode	The change file mode record extension
CHOWN	COWN	34	Change file ownership	The change file ownership record extension
CLRSETID	CSID	35	Clear SETID bits for a file	The clear SETID bits record extension
EXESETID	ESID	36	EXEC with SETUID/SETGID	The EXEC SETUID/SETGID record extension
GETPSENT	GPST	37	Get z/OS UNIX process entry	The GETPSENT record extension
INITOEDP	IOEP	38	Initialize z/OS UNIX process	The initialize z/OS UNIX record extension
TERMOEDP	TOEP	39	z/OS UNIX process complete	The z/OS UNIX process completion record
KILL	KILL	40	Terminate a process	The KILL record extension
LINK	LINK	41	LINK	The LINK record extension
MKDIR	MDIR	42	Make directory	The MKDIR record extension
MKNOD	MNOD	43	Make node	The MKNOD record extension
MNTFSYS	MFS	44	Mount a file system	The mount file system record extension
OPENFILE	OPEN	45	Open a new file	The OPENFILE record extension
PTRACE	PTRC	46	PTRACE authority checking	The PTRACE record extension
RENAMEF	RENF	47	Rename file	The rename file record extension
RMDIR	RDIR	48	Remove directory	The RMDIR record extension
SETEGID	SEGI	49	Set effective z/OS UNIX group identifier (GID).	The SETEGID record extension
SETEUID	SEUI	50	Set effective z/OS UNIX user identifier (UID)	The SETEUID record extension
SETGID	SGI	51	Set z/OS UNIX group identifier (GID).	The SETGID record extension
SETUID	SUI	52	Set z/OS UNIX user identifier (UID)	The SETUID record extension
SYMLINK	SYML	53	SYMLINK	The SYMLINK record extension
UNLINK	UNL	54	UNLINK	The UNLINK record extension
UMNTFSYS	UFS	55	Unmount file system	The unmount file system record extension
CHKFOWN	CFOW	56	Check file owner	The check file owner record extension
CHKPRIV	CPRV	57	Check privilege	The check privilege record extension
OPENSTTY	OSTY	58	Open slave TTY	The open slave TTY record extension
RACLINK	RACL	59	RACLINK command	The RACLINK command record extension
IPCCHK	ICHK	60	Check IPC access	The IPCCHK record extension
IPCGET	IGET	61	IPCGET	The IPCGET record extension
IPCCTL	ICTL	62	IPCCTL	The IPCCTL record extension
SETGROUP	SETG	63	SETGROUP	The SETGROUP record extension
CKOWN2	CKO2	64	CKOWN2	The CKOWN2 record extension
R_AUDIT	ACCR	65	Access Rights	The access rights record extension
RACDCERT	RACD	66	RACDCERT command	The RACDCERT command record extension
INITACEE	INTA	67	InitACEE	The InitACEE record extension
KTICKET	KTKT	68	Grant of initial Kerberos ticket	The Network Authentication Service record extension
RPKIGENC	RPKG	69	Certificate GENCERT request	The RPKIGENC record extension
RPKIEXPT	RPKE	70	Certificate EXPORT request	The RPKIEXPT record extension
PDACCESS	PDAC	71	Policy Director Authorization Services access control decision	The Policy Director Authorization Services record extension
RPKIREAD	RPKR	72	Certificate administration - read record	The RPKIREAD record extension
RPKIUPDR	RPKU	73	Certificate administration - update request record	The RPKIUPDR record extension
RPKIUPDC	RPKC	74	Certificate administration - update certificate record	The RPKIUPDC record extension
SETFACL	SACL	75	ACL entry changes	The SETFACL record extension
DELFACL	DACL	76	ACL deletion	The DELFACL record extension
SETFSECL	SSCL	77	Set security label of a z/OS® UNIX file	The SETFSECL record extension
WRITEDWN	WDWN	78	Set write-down privilege	The WRITEDWN record extension
PKIDPUBR	PKDP	79	CRL publication	The PKIDPUBR record extension
RPKIRESP	RPKO	80	Created by RPKIRESP	The RPKIRESP record extension
PTEVAL	PTEV	81	PassTicket evaluation	The PassTicket evaluation (PTEVAL) record extension
PTCREATE	PTCR	82	PassTicket generation	The PassTicket generation (PTCREATE) record extension
RPKISCEP	RPKS	83	R_PKIServ SCEPREQ	The RPKISCEP record extension
RDATAUPD	RPUT	84	R_datalib write function	The RDATAUPD record extension
PKIAURNW	PKRN	85	R_PKIServ automatic certificate renewal	The PKIAURNW record extension
PGMVERYF	PGMV	86	R_PgmSignVer signature verification	The PGMVERYF record extension
RACMAP	RACM	87	Defines the association between the distributed user identity and a RACF defined user ID	The RACMAP record extension
AUTOPROF	AUTO	88	Logs events that automatically modify RACF profiles	The AUTOPROF record extension
RPKIQREC	RPKQ	89	Finds a list of certificates of which have key pairs generated by PKI Services using the specified requestors email address and pass phrase	The RPKIQREC record extension