Re: Journalling the creation of files in the IFS

Thanks Tom, works like a dream.

----- Original Message -----
From: <thomas@inorbit.com>
To: <midrange-l@midrange.com>
Sent: Tuesday, January 22, 2002 7:58 PM
Subject: Re: Journalling the creation of files in the IFS


Robin:

On Fri, 18 January 2002, "Robin Sapiro \(Rogers\)" wrote:

> I am trying to detect whenever a stream file gets created in the IFS. I
have
> audit journalling set on for object creation. Whenever a stream file gets
> created, I get a CO entry in QAUDJRN. However most of the data in the
> journal is meaningless. How can I determine from this entry the full path
of
> the stream file just created?

I've been trying to get those rules clarified by IBM for a while. The basic
idea is that when (1) the Object Name and Library Name are *N/*N and Object
Type is *STMF or similar, then (2) use Object File ID as the argument to the
Get Path Name of Object from Its File ID (Qp0lGetPathFromFileID()) IFS API
unless (3) Object File ID is x'8000...00' in which case it's not clear what
to do. BTW, apparently it's only necessary to examine the first byte of a
File ID for x'80'.

But that handles nearly everything you'll see on most systems.

Note that if Object Type is *SOCKET or similar, you'll probably skip
resolving to the path name. And Parent File ID might never be useful to you
since it'll almost always be revealed through Object File ID anyway. And the
char(512) Object Name in the journal entry will likely appear as Unicode if
it's ever non-blank.

Hope that helps. Good luck.

Tom Liotta

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788
Fax  253-872-7904
http://www.400Security.com


___________________________________________________
The ALL NEW CS2000 from CompuServe
 Better!  Faster! More Powerful!
 250 FREE hours! Sign-on Now!
 http://www.compuserve.com/trycsrv/cs2000/webmail/




_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.