×
The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.
On 06-Sep-2011 16:14 , James Lampert wrote:
Interesting:
The system already has auditing turned on.
Being "on" as compared to specifically what level of auditing is
activated may have different meaning\effect. Particularly for the given
scenario, are both *DELETE in QAUDLVL [or QAUDLVL2] and *AUDLVL in QAUDCTL?
1. I don't have the authority to do a DSPAUDJRNE on the customer
box.
As I recall use of that command is deprecated; IIRC, specifically due
to an inability to provide the complete IFS name in output. CPYAUDJRNE
is recommended instead, or just using DSPJRN might suffice in some cases.
2. I can, however, do a DSPJRN there.
I created and deleted an object in the "IFS directory of interest."
If I then do
DSPJRN JRN(QAUDJRN) FROMTIME('09/06/2011' '17:00:01') ENTTYP(DO)
Close attention to the date\time of the retrieved entries may be
important when RCVRNG(*CURCHAIN) is not utilized, since entries from a
prior receiver may not appear in a date\time-based selection; i.e. the
shipped-default is to search only the *CURRENT receiver.
I get a bunch of entries, but most of them are irrelevant, and I
find that without knowing the jobname, I would have to manually scan
all 280 entries to find the one I'm looking for.
Using OUTPUT() other than to the display often assists with only
partial filtering on the command, to enable search\find activity on the
report or OUTFILE() since the displayed entries are one-at-a-time
oriented. However when the specific job name of the activity is known,
the entries are easily enough pared directly using the JOB() parameter
on the DSPJRN. There is also the USRPRF() parameter; e.g. as passed on
the xxxAUDJRNE commands to the effective DSPJRN done by those utilities.
If I add OBJPATH(('/foo')) and SUBTREE(*ALL) parameters ("/foo" being
the most senior containing directory), I get "Maximum number of
objects exceeded." Ditto for OBJPATH(('/foo/bar')). But if I then do
OBJPATH(('/foo/bar/settings')), even though that is the directory
where I created and deleted an object, I get "No entries converted
or received from journal QAUDJRN."
Help?
Specifying the OBJPATH() [and SUBTREE()] would be about the same as
specifying the FILE().? That conclusion seems to be supported by the
error messages seen, for which the full list of objects in the named
directory [and subtrees] would have to be processed. In the given
scenario the attempt is to find audit entries, not journal entries for
specific objects.
Regards, Chuck
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact
[javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.