IBM Mainframe Forum

In my understand, you can using the RACF SMF data unload utility modules (IRRADU00 and IRRADU86) to extract SMF type 80, 81 and 83.

The output will show who create the userid you want to know.

You can find it by search "ADDUSER" keyword.

Refer "Security Server RACF Macros and Interfaces", section "IRRADU00 record format".

In some shop if we list a user then you get a information who has created that(Probably you should have the right access to list the specific user. If you are a racf administrator, then you might be terminal supervisor for a various mainframe user groups. Then racf administrator hold record like when it was created , who created etc. In acf2, if we decomp the ACF id then you get the history of the ID creation. Auditors can too involve in knowing the trail. In syslog you could trace but it would be tedious to find if it is too old.

SMF record 80, Event type 10 has this information
If you have Barry Merrill's MXG product. Look at SAS FilE TYPE8010, fields JOB, RACFUSER, etc