The QAUDCTL must have the *AUDLVL active, beyond just activating the
*CREATE [and\or *OBJMGT & *DELETE for general object auditing events]
for QAUDLVL. That is, the system Auditing Control values, must include
the request to activate the QAUDLVL settings. The *CREATE being active
in QAUDLVL is part of general object auditing, for which there is no
requirement to use CHGUSRAUD. To get the CO [Create Object event
entries] requires only QAUDCTL and QAUDLVL [or QAUDLVL2]. The audit
events for specific object auditing are controlled by the *OBJAUD
setting in QAUDCTL, and activated according to the library, object, and
user auditing settings [QCRTOBJAUD, CRTLIB CRTOBJAUD(), CHGUSRAUD, etc.].
See QAUDCTL
http://publib.boulder.ibm.com/infocenter/systems/scope/i5os/topic/rzarl/rzarlaudsv.htm
Regards, Chuck
lgoodbar@xxxxxxxxxxxxxx wrote:
What's required to audit instances of object creation (type CO)?
I've got the system audit journal QAUDJRN enabled, and changed system
value QAUDLVL to include *CREATE. Do I need to also specify
CHGUSRAUD AUDLVL(*CREATE) at the user level? Anything at the object
level - how would this capture new objects?
After creating save files in my library (not QTEMP), I'm unable to
see the audit using DSPAUDJRNE ENTTYP(CO) OUTPUT(*).
Any pointers or RTMs appreciated.
