QPJOBLOG security

Rob Berendt wrote
>How can I prevent people from deleting their joblogs?

There has been a lot of good discussion on this topic, but there is one
solution that has not been mentioned yet. You can use the Control Job Log
Output (QMHCTLJL) API to cause the job log to be placed into physical files
instead of being placed into a spooled file. Then by using object authority
you can prevent users from even reading those physical files. Here is a
sample CL program that uses this API to do just that.

PGM
DCL       VAR(&FILENAME) TYPE(*CHAR) LEN(65)
DCL       VAR(&FORMAT) TYPE(*CHAR) LEN(8) VALUE('CTLJ0100')
DCL       VAR(&MSG) TYPE(*CHAR) LEN(30)
DCL       VAR(&FILTER) TYPE(*CHAR) LEN(4) VALUE(X'00000000')
DCL       VAR(&MSGQ) TYPE(*CHAR) LEN(20) VALUE('*SYSOPR             ')
DCL       VAR(&ERROR) TYPE(*CHAR) LEN(256) VALUE(X'00000000')
DCL       VAR(&USR) TYPE(*CHAR) LEN(10)
DCL       VAR(&NBR) TYPE(*CHAR) LEN(6)
RTVJOBA   USER(&USR) NBR(&NBR)
CHGVAR    VAR(%BIN(&FILENAME 1 4)) VALUE(65)
CHGVAR    VAR(%SST(&FILENAME 5 10))  VALUE('P         ')
CHGVAR    VAR(%SST(&FILENAME 6 9)) VALUE(&USR)
CHGVAR    VAR(%SST(&FILENAME 15 10)) VALUE('JOBLOG    ')
CHGVAR    VAR(%SST(&FILENAME 25 10)) VALUE('JOB       ')
CHGVAR    VAR(%SST(&FILENAME 28 6)) VALUE(&NBR)
CHGVAR    VAR(%SST(&FILENAME 35 10)) VALUE('S         ')
CHGVAR    VAR(%SST(&FILENAME 36 9)) VALUE(&USR)
CHGVAR    VAR(%SST(&FILENAME 45 10)) VALUE('JOBLOG    ')
CHGVAR    VAR(%SST(&FILENAME 55 10)) VALUE(%SST(&FILENAME 25 10))
CHGVAR    VAR(%SST(&FILENAME 65 1)) VALUE('0')
CALL      PGM(QSYS/QMHCTLJL) PARM(&FILENAME &FORMAT &MSG &FILTER +
            &MSGQ &ERROR)
CHGOBJOWN OBJ(JOBLOG/%SST(&FILENAME 5 10)) OBJTYPE(*FILE) +
            NEWOWN(______) CUROWNAUT(*REVOKE)
RVKOBJAUT OBJ(JOBLOG/%SST(&FILENAME 5 10)) OBJTYPE(*FILE) +
            USER(*PUBLIC) AUT(*ALL)
CHGOBJOWN OBJ(JOBLOG/%SST(&FILENAME 35 10)) OBJTYPE(*FILE) +
            NEWOWN(______) CUROWNAUT(*REVOKE)
RVKOBJAUT OBJ(JOBLOG/%SST(&FILENAME 35 10)) OBJTYPE(*FILE) +
            USER(*PUBLIC) AUT(*ALL)
ENDPGM
Before using the program create library JOBLOG. Also change 'NEWOWN
(______)' in the above source to change the physical files created into
that library to be owned by the same user profile that will own the CL
program. Then create the program while specifying USRPRF(*OWNER). Now,
after the program is called in a job, if that job produces a job log that
job log will be placed into two member of two physical files in the JOBLOG
library. The names of the two physical files will be P and S followed by
the first 9 characters of the user profile name.

One enhancement that is needed is to have the program send a message
somewhere that includes the full job name and the names of the physical
files and the member that will be used for the job log. This should help
you determine which member to look at.

Ed Fishel,
edfishel@US.IBM.COM


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---