You can use SMF data to find when and who creates the dataset (type 15 if seq, type 61 if vsam). When the dataset is read (type 14 seq, type 64 vsam). When updated (type 15 seq, type 64 vsam). When deleted (type 17 seq, type 65 vsam). Exception - type 61 & 65 can record sequential define and delete of sequential if IDCAMS was used. You probably also need to process type 20 (job/user start & end) to determine the userid on the job that created the SMF records.