I had to do this back in 2007 when it was necessary to discover what commands that were being issued by users from the command line.
These were being used in an uncontrolled manner from the command line instead of from an appropriate option from a menu.
The information required can be extracted from the system audit journal QAUDJRN.
First you need to change the user profile of the users for whom you wish to capture their command usage so that it appears in the audit journal.
e.g. CHGUSRAUD USRPRF(CHAMARA) AUDLVL(*CMD)
Note - The user should signoff and on to begin capture.
Then you need to parse QAUDJRN selecting JRNCDE((T)) ENTTYP(CD)
If you use the DSPJRN command to display the journal entries they will show the following -
The character C in column 1 indicates that the following 10 characters are the command that was run.
The character Y or N in column 30 indicates if it was run from a CLP or not.
The string after column 30 is the exact command that was run.
In my case I set up background job to continuously monitor the audit journal via a CLP in which executes the RCVJRNE command after a periodic delay.
RCVJRNE JRN(QSYS/QAUDJRN) EXITPGM(MONAUDCMDR) RCVRNG(*CURCHAIN) FROMTIME(&FRMDATE &FRMTIME) JRNCDE((T)) ENTTYP(CD) ENTFMT(*TYPE4)
You must write the RPGLE for MOMAUDCMDR which gets passed the audit journal entry plus a journal entry code.
You need to process the entry only when passed a journal entry code value of 1 (0 means ignore and 3 means the RCVJRNE cmd has ended so you should set on LR)
As with the DSPJRN you only process if CDTYPE=C and CDCLPGM=N (these are fields within the journal entry data structure the system defines for a *TYPE4 journal entry)
In my case I process the entry by writing an custom entry out to my own log which I can query at my leisure by user or command etc.
Cheers, Peter
----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx [mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Saturday, 30 April 2011 4:54 a.m.
To: RPG programming on the IBM i / System i
Subject: Re: Command Line
Using the system's built in audit journal is probably the best way...
Look at the QUADCTL system value, if *OBJAUD is not there, put it there...
CHGUSRPRF OBJAUT(*ALL)
CHGOBJAUD (*ALL/*ALL) OBJTYPE(*CMD) OBJAUD(*USRPRF)
Though I believe the above will capture commands used in a CL program...
I don't know of anyway to capture just commands issued at the command line.
HTH,
Charles
On Fri, Apr 29, 2011 at 12:10 PM, Chamara Withanachchi
<chamaraw@xxxxxxxxxx> wrote:
Hi,
Actually I want to capture all the commands issued by users who has Command
Line Access
Chamara
On Fri, Apr 29, 2011 at 8:46 PM, Buck <kc2hiz@xxxxxxxxx> wrote:
On 4/29/2011 7:45 AM, Chamara Withanachchi wrote:
I want to record all the functions, commands which entered from line to
be
capture in a file. How can I do this can I use any Exit Point for this or
is
there any other method to do so.
You can capture all the commands from a job by reading the messages
(field ID 0302) with the QMHLJOBL API.
--buck
--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.
--
Regards,
Chamara Withanachchi
IBM Certified Power System Expert
RPG Programmer
(owner of www.rpgiv.info)
WWW.RPGIV.INFO
Mob: +94 77 1678646
chamaraw@xxxxxxxxxx
i want to be future ready. i want control. i want an i.
--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.
midrange.com
