SELECT entry_timestamp AS when,
"CURRENT_USER" AS user_name,
job_name,
job_user,
job_number,
INTERPRET(SUBSTR(entry_data, 12, 10) AS CHAR(10)) AS jobq_lib,
INTERPRET(SUBSTR(entry_data, 2, 10) AS CHAR(10)) AS jobq_name,
INTERPRET(SUBSTR(entry_data, 22, 8) AS CHAR(8)) AS object_type,
CHAR(INTERPRET(SUBSTR(entry_data, 30, 3) AS DECIMAL(5, 0))) AS access_type
FROM TABLE (
qsys2.display_journal(
'QSYS',
'QAUDJRN', STARTING_RECEIVER_NAME => '*CURAVLCHN', journal_entry_types => 'ZC',
starting_timestamp => CURRENT TIMESTAMP - 24 HOURS)
)
WHERE object_type = '*MSGQ';
For me at least I get 51 for the access_type when something puts a message on the queue. For both removing a single message, and clearing the queue, I get 38.
https://www.ibm.com/docs/en/i/7.4?topic=entries-numeric-codes-access-types
On Fri, 2021-05-14 at 17:24 +0000, Rob Berendt wrote:
<
https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type>
https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type
Kind of hard telling if just a job logged a message to QSYSOPR or if someone cleared the message queue.
IDK how to bust apart the journal entry data (ENTRY_DATA from the sql service) to see if it tells you what operation was performed.
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
<
http://www.dekko.com>
http://www.dekko.com
-----Original Message-----
From: MIDRANGE-L <
<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
midrange-l-bounces@xxxxxxxxxxxxxxxxxx
On Behalf Of Kevin Bucknum
Sent: Friday, May 14, 2021 1:10 PM
To:
<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>
midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Re: Who is clearing QSYSOPR
CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
It looks to me like you get ZC and ZR records if you turn on object auditing for the message queue.
Display Object Description - Full
Library 1 of 1
Object . . . . . . . : QSYSOPR Attribute . . . . . :
Library . . . . . : QSYS Owner . . . . . . . : QSYS
Library ASP device . : *SYSBAS Library ASP group . : *SYSBAS
Type . . . . . . . . : *MSGQ Primary group . . . : *NONE
Change/Usage information:
Change date/time . . . . . . . . . . : 05/14/21 11:51:04
Usage data collected . . . . . . . . : YES
Last used date . . . . . . . . . . . :
Days used count . . . . . . . . . . : 0
Reset date . . . . . . . . . . . . :
Allow change by program . . . . . . : YES
Auditing/Integrity information:
Object auditing value . . . . . . . : *ALL
Digitally signed . . . . . . . . . . : NO
On Fri, 2021-05-14 at 11:13 -0500, ~TA~ wrote:
I had already done DSPLOG and there was no mention of QSYSOPR in it.
DSPOBJAUT did not reveal anything helpful.
I'm looking to set up QAUDJRN with the appropriate config to see
'whodunit' the next time it happens.
Thanks.
On 5/14/2021 10:18 AM, Mark Waterbury wrote:
Tim,
Issue DSPOBJAUT QSYSOPR *MSGQ to see what user or group profiles may have enough authority to do that.
Also, DSPLOG LOG(QHST) PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) and then search the resulting spool file for "QSYSOPR" -- perhaps you may see a message in there showing "who done it"?
Hope that helps,
Mark S. Waterbury
> On Friday, May 14, 2021, 11:10:39 AM EDT, ~TA~ <
<mailto:
<mailto:tadair@xxxxxxxxxxxxxxxx>
tadair@xxxxxxxxxxxxxxxx
<mailto:tadair@xxxxxxxxxxxxxxxx>
tadair@xxxxxxxxxxxxxxxx
wrote:
I'm attempting to set up QAUDJRN to determine who is clearing the system
operator message queue (QSYSOPR). I've searched the archive, I've
searched the internet, and I still can't seem to find a straight-up
answer. I would appreciate someone pointing me in the right direction.
We're on 7.3.
Thanks in advance.
[
<
https://www.medtronsoftware.com/img/MedtronMinilogo.bmp>
https://www.medtronsoftware.com/img/MedtronMinilogo.bmp
] Kevin Bucknum
Senior Programmer Analyst
MEDDATA / MEDTRON
120 Innwood Drive
Covington LA 70433
Local: 985-893-2550
Toll Free: 877-893-2550
<
https://www.medtronsoftware.com>
https://www.medtronsoftware.com
CONFIDENTIALITY NOTICE
This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email:
<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>
MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
<
https://lists.midrange.com/mailman/listinfo/midrange-l>
https://lists.midrange.com/mailman/listinfo/midrange-l
or email:
<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
<
https://archive.midrange.com/midrange-l>
https://archive.midrange.com/midrange-l
.
Please contact
<mailto:support@xxxxxxxxxxxxxxxxxxxx>
support@xxxxxxxxxxxxxxxxxxxx
for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
<
https://amazon.midrange.com>
https://amazon.midrange.com
[
https://www.medtronsoftware.com/img/MedtronMinilogo.bmp] Kevin Bucknum
Senior Programmer Analyst
MEDDATA / MEDTRON
120 Innwood Drive
Covington LA 70433
Local: 985-893-2550
Toll Free: 877-893-2550
https://www.medtronsoftware.com
CONFIDENTIALITY NOTICE
This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.
As an Amazon Associate we earn from qualifying purchases.