Re: Object Auditing

[Vernon Hamberg <vhamberg@xxxxxxxxxxx>]

Does journaling report deletion of the object? I thought just the data. I 
think there could be a greater hit performance -wise with PF journaling vs. 
audit journaling but have no evidence.

Anyway, auditing writes to the audit journal. More information - the good 
stuff - is in the "Tips & Techniques for Securing Your iSeries" manual - 
comes with every machine in paper form, last I heard. Or is available for 
download at InfoCenter - I may have missed the exact name.

HTH
Vern

At 06:29 AM 5/13/2005, you wrote:

> Pete,
>
> Or you could use Journalling. Turn on journalling on the files you are
> interested in....but make sure you capture enough information. There is a
> code for deleting, and the journals would show who did it!
> There are also Auditing tools you can buy that make the job easier - for
> example Stitch in Time from Unbeaten Path, or Audit/400 etc,
>
> cheers,
>
> Clare
>
> Clare Holtham
> Director, Small Blue Ltd - Archiving for BPCS
> Web: www.smallblue.co.uk
> IBM Certified iSeries Systems Professional
> Email: Clare.Holtham@xxxxxxxxxxxxxxx
>
> ----- Original Message -----
> From: "Pete Helgren" <Pete@xxxxxxxxxx>
> To: "Midrange Mailing List" <MIDRANGE-L@xxxxxxxxxxxx>
> Sent: Thursday, May 12, 2005 10:21 PM
> Subject: Object Auditing
>
>
> > I have a customer who has been reporting that a few files from a library
> > are being deleted "spontaneously".  They have been restoring from backup
> > but I am baffled as to how files could just "delete themselves", so I'd
> > like to audit the files in the library.  I found a reference to the
> > CHGOBJAUD and it looks like if I want to audit all the changes to all
> > the files (which I assume would include deleting the object) on a
> > library called MYLIB I would use the command as CHGOBJAUD
> > OBJ(MYLIB/*ALL)  OBJTYPE(*FILE)  OBJAUD(*CHANGE).
> >
> > It looks like I also have to change the system value QAUDCTL to *OBJAUD .
> >
> > Is this correct?  Will this accomplish what I want (find out who is
> > deleting the files)?  How to I access the information which the
> > infocenter says is "logged to the auditing journal QAUDJRN in QSYS".  I
> > have never worked with auditing or journals before.
> >
> > Thanks,
> >
> > Pete Helgren
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> >
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.