Re: Changing to security level 40.

[Ed Fishel <edfishel@xxxxxxxxxx>]

Rob Berendt wrote on 01/26/2006 02:13:05 PM:

> I am following the instructions in pdf page 37, printed page 15, of
> "iSeries Security Reference" SC41-5302.  "Changing to Security Level 40".

> http://publib.boulder.ibm.
> com/infocenter/iseries/v5r3/topic/books/sc415302.pdf
> I've set up the journal receivers, journal, system values, etc.  Let it
> run for a few days.  Then I did a
> DSPJRN JRN(QAUDJRN)
>        ENTTYP(AF)
>        OUTPUT(*OUTFILE)
>        OUTFILE(QTEMP/DSPJRN)
> Every AF entry in there is a CODE 'T'.  I did a Query/400 record
selection
> omitting 'T' and then get no entries.

Rob,

Code T stands for Audit trail entry. You should be looking at the Violation
Type entry in the AF audit record. Also, before you use DSPJRN, I suggest
that you use CRTDUPOBJ to make a copy of the QASYAFJ5 file into QTEMP and
then add the OUTFILFMT(*TYPE5) parameter to the DSPJRN command when you use
the copy as the target output file.

The best description of the fields in the AF audit record can be found in
Appendix F of the Security Reference manual.

Ed Fishel,
edfishel@xxxxxxxxxx