Hi Floyd
The USER profile in RACF contains 2 date fields that can be related to activity: the LJDATE either shows the date when the user ID last had a successful logon, or an administrator issued an ALTUSER RESUME for the ID. When we go through all the connect groups, and look at the last use date for each group, we have a good idea about the last successful logon. CARLa refers to the latter field as LAST_CONNECT_DATE.
However, these fields only show 1 date: the last activity. Are you interested to see the users that were last active in the year (June 30, 2024 - June 30, 2025):
newlist type=racf
select class=user (last_connect_date>=30jun2024 last_connect_date<=30jun2025)
sortlist profile(8,"Userid") name last_connect_date
Note, this would NOT include the users that (also) logged on in July, August or September this year!
If you want to see users that had any activity in the year, irrespective of activity since, you need a log file. SMF data sets come to mind, all installations have SMF monthly "tapes" with historic info, but these can be humongous. For TSO users, activity can be gleaned from SMF record type 30, subtype 1 or 5. You will only find partial information about TSO user activity from SMF record type 80, but zSecure (CARLa) has hidden this issue by interpreting SMF30(1,5) as EVENT=RACINIT too.
If you can find the names of your SMF monthly data sets, with SMF types 30 and 80, you could use the code below. You would typically run this for each month separately, processing a year of SMF is going to take a job that runs many hours:
newlist type=smf
select type=(80,30(1,5)) event=racinit(success)
summary user date(min) date(max)
It would be up to you to combine the list of users from RACF with the activities from SMF. I would write the SMF reports into a flat file, allocate this as a DEFTYPE to my RACF report and use a DEFTYPE lookup from the RACF user ID.
Because SMF reports are so time consuming, zSecure Admin comes with a data collection utility called Access Monitor. This captures RACF decisions, summarizes the information so the number of records is minimized, and allows different levels of consolidation, e.g., daily, monthly and yearly files. If you have Access Monitor installed, and it collected information over the interval you're interested in, you could use the zSecure panels to select the 12 Monthly ACCESS data sets, go to AM.I (ID Usage), and have Access Monitor list all user profiles from RACF, showing which of those had activity in the 12 months of ACCESS records.
------------------------------
Rob van Hoboken
------------------------------