Re: QAUDJRN and QAUDLVL

using the DSPSECAUD command verify you are not auditing QTEMP AUDCTL(*NOQTEMP)

the next thing will be to see what you are capturing.

here is a "quick" way to see the count of the captured journal types (pick the dates you wish to use)

DSPJRN JRN(QAUDJRN) RCVRNG(*CURCHAIN) FROMTIME(111610 000001)
TOTIME(111610 235959) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE1)
OUTFILE(QTEMP/TYPE1)
<sql>
SELECT DISTINCT joentt, count(*) as t FROM qtemp/type1
group by joentt order by t desc


Bryan


On Nov 17, 2010 2:53pm, Ryan Hunt <ryan.hunt@xxxxxxxxxxxxx> wrote:

We recently moved from a V5R4 server to a V6R1 server. As part of my

security monitoring we audit *AUTFAIL and *SECURITY (QAUDLVL) to the QAUDJRN

journal. I don't have my old server anymore so I can't confirm this for

sure, but I'm pretty sure my setup for V5R4 was exactly the same.

I'm finding that while my V5R4 server kicked out a 100MB journal receiver

every 2 or 3 days, my V6R1 server is kicking out a 1.5GB file every single

day.

Has anyone else seen this behavior?

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.