Dan, as you mentioned UID(*) log means universal access allowed, but all the access will be logged. You can run ACFRPTRV report with DETAIL option pointing to SMF active at the time when access was made and it will print all the log entries showing ...