Re: Journalling the creation of files in the IFS

[thomas@xxxxxxxxxxx]

Robin:

On Fri, 18 January 2002, "Robin Sapiro \(Rogers\)" wrote:

> I am trying to detect whenever a stream file gets created in the IFS. I have
> audit journalling set on for object creation. Whenever a stream file gets
> created, I get a CO entry in QAUDJRN. However most of the data in the
> journal is meaningless. How can I determine from this entry the full path of
> the stream file just created?

I've been trying to get those rules clarified by IBM for a while. The basic 
idea is that when (1) the Object Name and Library Name are *N/*N and Object 
Type is *STMF or similar, then (2) use Object File ID as the argument to the 
Get Path Name of Object from Its File ID (Qp0lGetPathFromFileID()) IFS API 
unless (3) Object File ID is x'8000...00' in which case it's not clear what to 
do. BTW, apparently it's only necessary to examine the first byte of a File ID 
for x'80'.

But that handles nearly everything you'll see on most systems.

Note that if Object Type is *SOCKET or similar, you'll probably skip resolving 
to the path name. And Parent File ID might never be useful to you since it'll 
almost always be revealed through Object File ID anyway. And the char(512) 
Object Name in the journal entry will likely appear as Unicode if it's ever 
non-blank.

Hope that helps. Good luck.

Tom Liotta

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788
Fax  253-872-7904
http://www.400Security.com


___________________________________________________
The ALL NEW CS2000 from CompuServe
 Better!  Faster! More Powerful!
 250 FREE hours! Sign-on Now!
 http://www.compuserve.com/trycsrv/cs2000/webmail/