Just turned on Auditing, what is your take on our journal entries?

Hello folks,

On Tuesday, we turned auditing on for the first time.  It is not that 
difficult and it is exciting to learn what it can do.  We are auditing for 
*AUTFAIL, *SECURITY, *SERVICE and *SYSMGT.  NO QTEMP.  We have 258 AS/400 
user profiles on a 620 running V4R4, CAE 44, TCP/IP and MAPICS ERP XA5.5. 

We have about 3300 entries since Tuesday, and I have broken down the 
majority as follows:

1,283 PS  (profile swap)
  690 OW  (object ownership)
  368 GS  (a descriptor was given)
  505 CA  (changes to obj auth)
  320 AF  (auth failures)

I have not reached a stage yet now where I can explain why we are getting 
any of these but would like to know if we should be immediately concerned 
about any of these entries.  How do you think external auditors will view 
these entries?  (They are the ones who suggested we turn on auditing).

Also, can someone explain what a "profile swap" (PS) is, and what "a 
descriptor was given" (GS) means?

Also, where can I buy a hard copy of the Security Reference manual 
(SC42-5302-03)?  I have bought redbooks before but never an IBM manual. 
 Internets searches for SC42-5302-03 have led nowhere.

Thanks in advance for any replies!


Bryan Burns
System Operator
Echo, Inc.
Lake Zurich, IL
Burnsbm@echoincorporated.com
847-540-8400  x493



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---