RE: Whodunit?

Francis Lapeyre (flapeyre@COMMUNIQUE.NET) wrote:

>Is there any way to determine who cleared the QSYSOPR message queue?
>And, is there a way to prevent it from happening again?

If they used CLRMSGQ and they're still signed on you may be able to find
message CPC2253 in the job log. But it means hunting through all the
interactive job logs. Once they're signed off you will only be able to
search if the job log was spooled. If they used DSPMSG and then took the
function key option to remove all messages then this won't even show up
in the job log.

If you have command level auditing on you might be able to find the
CLRMSGQ in the system audit journal, but you still won't find the remove
option of DSPMSG. Even turning on object auditing for the message queue
will not show anything in the audit journal as this only tracks changes
to the *MSGQ object itself, not its contents.

Similarly removing public authority to CLRMSGQ and RMVMSG will not
prevent the option from working within the DSPMSG display. Changing
these public authorities, to RMVMSG in particular, might also have
undesirable effects in your applications. If you change public authority
to the message queue itself from *CHANGE to *USE you will prevent users
from clearing the queue, but you will also prevent them from answering
messages and, more importantly, sending messages to it. I'm not sure
what the implications for your applications would be.

The surest way to prevent someone clearing the queue is to have it
allocated to another job. Any job that has the queue in break mode, for
example, will prevent other jobs from clearing it. In our case we use
paging software that monitors the queue, and this automatically prevents
it from getting cleared.

Although it may be a nuisance to have the queue cleared, is it really an
issue? Most of the messages will in any case be echoed into the system
log (QHST) giving you a more or less permanent record of significant
events.

Dave Kahn - TCO, Tengiz, Kazakstan
=========

e-mail:  kahn@tengizchevroil.com    (until August 5th)
         dkahn@cix.compulink.co.uk  (from  August 6th)

Note new e-mail address in Kazakstan
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *