Re: QAUDJRN and who changed my source file member ?

["Ed Fishel" <edfishel@xxxxxxxxxx>]

Jorge,

If the thing you want to know is who made changes to your source files (and
when), then the ZC audit records in the security audit journal can be used
to give you that information. Each of these audit records includes the
names of the file, library, and member as well as a numeric Access Type
field. A table at the end of Appendix F of the Security Reference Manual
describes the access types.

After setting up auditing use the CHGOBJAUD command to turn on auditing for
your source files. If *ALL or *CHANGE auditing is on for a file, then when
a user adds a member to the file a ZC audit record with an access type of
Add will be written. When SEU is used to change a member, at least two
audit records will be written; a ZC for Open, and a ZC for Clear. (It
appears that SEU clears the member before writing the updates to it. If no
changes are saved then you will see the ZC for Open but not a ZC for
Clear.)  When a member is deleted a ZC for Remove is written.

Security auditing works at all security levels.

Ed Fishel,
edfishel@US.IBM.COM