Re: QSYSOPR Message Queue Control

On 07-Mar-2012 13:20 , Evan Harris wrote:

looking for ideas on how to keep track of who's doing what to
QSYSOPR when many people have access to it (yes, I know that's not
ideal...)

I was just wondering how I can get something along the lines of an
audit log so as to identify who answered a message, who cleared the
message queue etc. Object auditing can tell me who interfered with
the object but doesn't give me much in the way of the message data
or message actions. I could put a lock on the queue to prevent it
being cleared or perhaps write a message handling program to shove
everything off into a journal or table or something else.

Messages sent to the *SYSOPR message queue [QSYSOPR in QSYS] are also sent to the History Log message queue [QHST in QSYS]. The message data is available via the history files and\or from any history API, because the messages in QHST are copied to the history log. The job details are part of /reply/ messages, just as for the original inquiry message.

Is there good reasons to allow the *DELETE data authority to the QSYSOPR *MSGQ so broadly; i.e. might removing that authority generally, best limit the ability to delete messages individually or by /clear/ [F13=Clear or CLRMSG] for those who should not be doing either?

Regards, Chuck