Re: Object Auditing -- MIDRANGE-L

Does journaling report deletion of the object? I thought just the data. I think there could be a greater hit performance -wise with PF journaling vs. audit journaling but have no evidence.

Anyway, auditing writes to the audit journal. More information - the good stuff - is in the "Tips & Techniques for Securing Your iSeries" manual - comes with every machine in paper form, last I heard. Or is available for download at InfoCenter - I may have missed the exact name.

HTH
Vern

At 06:29 AM 5/13/2005, you wrote:

Pete,

Or you could use Journalling. Turn on journalling on the files you are
interested in....but make sure you capture enough information. There is a
code for deleting, and the journals would show who did it!
There are also Auditing tools you can buy that make the job easier - for
example Stitch in Time from Unbeaten Path, or Audit/400 etc,

cheers,

Clare

Clare Holtham
Director, Small Blue Ltd - Archiving for BPCS
Web: www.smallblue.co.uk
IBM Certified iSeries Systems Professional
Email: Clare.Holtham@xxxxxxxxxxxxxxx

----- Original Message -----
From: "Pete Helgren" <Pete@xxxxxxxxxx>
To: "Midrange Mailing List" <MIDRANGE-L@xxxxxxxxxxxx>
Sent: Thursday, May 12, 2005 10:21 PM
Subject: Object Auditing


> I have a customer who has been reporting that a few files from a library
> are being deleted "spontaneously".  They have been restoring from backup
> but I am baffled as to how files could just "delete themselves", so I'd
> like to audit the files in the library.  I found a reference to the
> CHGOBJAUD and it looks like if I want to audit all the changes to all
> the files (which I assume would include deleting the object) on a
> library called MYLIB I would use the command as CHGOBJAUD
> OBJ(MYLIB/*ALL)  OBJTYPE(*FILE)  OBJAUD(*CHANGE).
>
> It looks like I also have to change the system value QAUDCTL to *OBJAUD .
>
> Is this correct?  Will this accomplish what I want (find out who is
> deleting the files)?  How to I access the information which the
> infocenter says is "logged to the auditing journal QAUDJRN in QSYS".  I
> have never worked with auditing or journals before.
>
> Thanks,
>
> Pete Helgren
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.