Robin: On Fri, 18 January 2002, "Robin Sapiro \(Rogers\)" wrote: > I am trying to detect whenever a stream file gets created in the IFS. I have > audit journalling set on for object creation. Whenever a stream file gets > created, I get a CO entry in QAUDJRN. However most of the data in the > journal is meaningless. How can I determine from this entry the full path of > the stream file just created? I've been trying to get those rules clarified by IBM for a while. The basic idea is that when (1) the Object Name and Library Name are *N/*N and Object Type is *STMF or similar, then (2) use Object File ID as the argument to the Get Path Name of Object from Its File ID (Qp0lGetPathFromFileID()) IFS API unless (3) Object File ID is x'8000...00' in which case it's not clear what to do. BTW, apparently it's only necessary to examine the first byte of a File ID for x'80'. But that handles nearly everything you'll see on most systems. Note that if Object Type is *SOCKET or similar, you'll probably skip resolving to the path name. And Parent File ID might never be useful to you since it'll almost always be revealed through Object File ID anyway. And the char(512) Object Name in the journal entry will likely appear as Unicode if it's ever non-blank. Hope that helps. Good luck. Tom Liotta -- Tom Liotta The PowerTech Group, Inc. 19426 68th Avenue South Kent, WA 98032 Phone 253-872-7788 Fax 253-872-7904 http://www.400Security.com ___________________________________________________ The ALL NEW CS2000 from CompuServe Better! Faster! More Powerful! 250 FREE hours! Sign-on Now! http://www.compuserve.com/trycsrv/cs2000/webmail/
As an Amazon Associate we earn from qualifying purchases.
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.