The CKGRACF command is logged in field LOGSTR, so you have to adjust your CARLa SELECT command to find the actions you want to notify on. For example, a RESUME action would be captured by
S EVENT=GENERAL AND LOGSTR=:"CKGRACF USER" AND LOGSTR=:" RESUME" AND NOT(LOGSTR=:" PWSET")
A password reset might be
S EVENT=GENERAL AND LOGSTR=:"CKGRACF USER" AND LOGSTR=:" PWSET"
You would find the user ID by doing
define target_user(8,"Userid") as parse(logstr,"CKGRACF USER "," ")
although you could verify on your system if CLASS and PROFILE happen to contain anything useful. You could test alert functionality in a CARLa program like so:
newlist type=smf
define target_user(8,"Userid") as parse(logstr,"CKGRACF USER "," ")
S EVENT=GENERAL AND LOGSTR=:"CKGRACF USER" AND LOGSTR=:" RESUME" AND NOT(LOGSTR=:" PWSET")
sortlist date(7) time(4) desc userid class profile(8) target_user logstr
The select variant "APPL=CKGRACF" finds XFACILIT resource access checks issued from CKGRACF, to verify authority of the issuer, for actions where the command is not in LOGSTR. Since you're interested in commands only, you can focus on the LOGSTR=:CKGRACF variants.
NB. I typed this from memory and have not tested for syntax or other mistakes. Caveat emptor.
------------------------------
Rob van Hoboken
------------------------------