Re: File audit

This sort of thing is a software design issue ... you need to set things up 
in advance to be able to track who is updating what.  

Because part of my job is to be modifying software, I have developed some 
tools, mainly Query/400 against *OUTFILE stuff to help me get a handle on 
what are the programs that update what files & what are the programs that 
call what programs.

Depending on how well you understand your application software you may be 
able to narrow it down to a list of people who had the security access to the 
programs that can update the file.  

But this can be an exercise in futility.
I have found that the rate of end user error, and the rate of end user 
selective memory about errors, is such that what the software design 
infrastructure priorities need is rapid access to information about changes & 
mechanisms to easily correct mistakes when they are discovered.

Do the programs that update files generate some kind of audit trail & what is 
your policy for deleting or disposing of audit trails?  Ours includes not 
deleting until at least after next backup so that we have clues there just in 
case something goes wrong before the next backup.

In my case I get stuck with cleaning up the old spool files that no one 
wants, and I am just too busy to do that every day, so there is lots of 
evidence available to someone who understands the applications.

> We had an update happen to a file yesterday that we do not know who did it. 
> Is there any audit trails with the AS400 that I can find out who did the 
> change? The file is not journaled.

MacWheel99@aol.com (Alister Wm Macintyre) (Al Mac)
AS/400 Data Manager & Programmer for BPCS 405 CD Rel-02 mixed mode (twinax 
interactive & batch) @ http://www.cen-elec.com Central Industries of 
Indiana--->Quality manufacturer of wire harnesses and electrical 
sub-assemblies - fax # 812-424-6838

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---