× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



SELECT entry_timestamp AS when,
"CURRENT_USER" AS user_name,
job_name,
job_user,
job_number,
INTERPRET(SUBSTR(entry_data, 12, 10) AS CHAR(10)) AS jobq_lib,
INTERPRET(SUBSTR(entry_data, 2, 10) AS CHAR(10)) AS jobq_name,
INTERPRET(SUBSTR(entry_data, 22, 8) AS CHAR(8)) AS object_type,
CHAR(INTERPRET(SUBSTR(entry_data, 30, 3) AS DECIMAL(5, 0))) AS access_type
FROM TABLE (
qsys2.display_journal(
'QSYS',
'QAUDJRN', STARTING_RECEIVER_NAME => '*CURAVLCHN', journal_entry_types => 'ZC',
starting_timestamp => CURRENT TIMESTAMP - 24 HOURS)
)
WHERE object_type = '*MSGQ';

For me at least I get 51 for the access_type when something puts a message on the queue. For both removing a single message, and clearing the queue, I get 38.
https://www.ibm.com/docs/en/i/7.4?topic=entries-numeric-codes-access-types



On Fri, 2021-05-14 at 17:24 +0000, Rob Berendt wrote:
<https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type>

https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type



Kind of hard telling if just a job logged a message to QSYSOPR or if someone cleared the message queue.


IDK how to bust apart the journal entry data (ENTRY_DATA from the sql service) to see if it tells you what operation was performed.


Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 7310 Innovation Blvd, Suite 104

Ft. Wayne, IN 46818

Ship to: 7310 Innovation Blvd, Dock 9C

Ft. Wayne, IN 46818

<http://www.dekko.com>

http://www.dekko.com




-----Original Message-----

From: MIDRANGE-L <

<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>

midrange-l-bounces@xxxxxxxxxxxxxxxxxx

On Behalf Of Kevin Bucknum

Sent: Friday, May 14, 2021 1:10 PM

To:

<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>

midrange-l@xxxxxxxxxxxxxxxxxx


Subject: Re: Who is clearing QSYSOPR


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.



It looks to me like you get ZC and ZR records if you turn on object auditing for the message queue.


Display Object Description - Full

Library 1 of 1

Object . . . . . . . : QSYSOPR Attribute . . . . . :

Library . . . . . : QSYS Owner . . . . . . . : QSYS

Library ASP device . : *SYSBAS Library ASP group . : *SYSBAS

Type . . . . . . . . : *MSGQ Primary group . . . : *NONE


Change/Usage information:

Change date/time . . . . . . . . . . : 05/14/21 11:51:04

Usage data collected . . . . . . . . : YES

Last used date . . . . . . . . . . . :

Days used count . . . . . . . . . . : 0

Reset date . . . . . . . . . . . . :

Allow change by program . . . . . . : YES

Auditing/Integrity information:

Object auditing value . . . . . . . : *ALL

Digitally signed . . . . . . . . . . : NO





On Fri, 2021-05-14 at 11:13 -0500, ~TA~ wrote:


I had already done DSPLOG and there was no mention of QSYSOPR in it.



DSPOBJAUT did not reveal anything helpful.



I'm looking to set up QAUDJRN with the appropriate config to see


'whodunit' the next time it happens.



Thanks.




On 5/14/2021 10:18 AM, Mark Waterbury wrote:


Tim,



Issue DSPOBJAUT QSYSOPR *MSGQ to see what user or group profiles may have enough authority to do that.



Also, DSPLOG LOG(QHST) PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) and then search the resulting spool file for "QSYSOPR" -- perhaps you may see a message in there showing "who done it"?



Hope that helps,



Mark S. Waterbury




> On Friday, May 14, 2021, 11:10:39 AM EDT, ~TA~ <


<mailto:

<mailto:tadair@xxxxxxxxxxxxxxxx>

tadair@xxxxxxxxxxxxxxxx




<mailto:tadair@xxxxxxxxxxxxxxxx>

tadair@xxxxxxxxxxxxxxxx



wrote:



I'm attempting to set up QAUDJRN to determine who is clearing the system


operator message queue (QSYSOPR). I've searched the archive, I've


searched the internet, and I still can't seem to find a straight-up


answer. I would appreciate someone pointing me in the right direction.



We're on 7.3.



Thanks in advance.






[

<https://www.medtronsoftware.com/img/MedtronMinilogo.bmp>

https://www.medtronsoftware.com/img/MedtronMinilogo.bmp

] Kevin Bucknum

Senior Programmer Analyst

MEDDATA / MEDTRON

120 Innwood Drive

Covington LA 70433

Local: 985-893-2550

Toll Free: 877-893-2550



<https://www.medtronsoftware.com>

https://www.medtronsoftware.com





CONFIDENTIALITY NOTICE


This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email:

<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>

MIDRANGE-L@xxxxxxxxxxxxxxxxxx


To subscribe, unsubscribe, or change list options,

visit:

<https://lists.midrange.com/mailman/listinfo/midrange-l>

https://lists.midrange.com/mailman/listinfo/midrange-l


or email:

<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>

MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx


Before posting, please take a moment to review the archives

at

<https://archive.midrange.com/midrange-l>

https://archive.midrange.com/midrange-l

.


Please contact

<mailto:support@xxxxxxxxxxxxxxxxxxxx>

support@xxxxxxxxxxxxxxxxxxxx

for any subscription related questions.


Help support midrange.com by shopping at amazon.com with our affiliate link:

<https://amazon.midrange.com>

https://amazon.midrange.com




[https://www.medtronsoftware.com/img/MedtronMinilogo.bmp] Kevin Bucknum
Senior Programmer Analyst
MEDDATA / MEDTRON
120 Innwood Drive
Covington LA 70433
Local: 985-893-2550
Toll Free: 877-893-2550
https://www.medtronsoftware.com



CONFIDENTIALITY NOTICE

This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.

As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:
Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.