RE: Audit Journal Entry

The "GR" audit journal entries were added to the system as a way to solve a
development process problem.

Often the need for a new audit journal entry in the OS was not discovered
until too late in the development process to create them in time for that
release.  In the -- now, long ago -- past, we would have to wait for the
next release to add the new audit journal entry.  This time delay was not
always acceptable.

So, to be able to add new crucial audit journal entry codes that were not
originally planned for, we created the concept of a "generic audit journal"
entry or the GR.  The GR entry is used for many different types of
unrelated entries.  The TYPE of the GR entry ("T" in this case) is supposed
to tell you exactly what a specific entry means.  The type also defines
what kind information is stored in the other entries of this particular
record.

Unfortunately, a quick check of the Audit Entry Layout appendix in the
Security Reference manual, seems to show that the information for the "T"
entry type for GR records is missing.  It was either inadvertently removed
or somehow never got updated.

Based on the information in a previous post of this topic, it seems that
this indicates something today with an FTP connection request.  I can't be
sure though.

As an aside, this "brilliant" idea happened to be mine and I was somehow
able to convince the necessary people that this was indeed a good idea.
After one or two releases, however, it became apparent that the idea may
not have been quite as brilliant as I thought it was. Mea culpa...

Patrick Botz
Senior Technical Staff Member
IBM Lab Services, Rochester
Security Architecture & Consulting, i5/OS Security Architect
(507) 253-0917, T/L 553-0917
CTC Fax # 507-253-2070
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services