Re: QCRTOBJAUD and the audit journal

Frank wrote on 02/07/2007 01:19:18 PM:

Hi, we changed sysval QAUDCTL and added *OBJAUD.  That flooded our
jrnrcv's with ZR's.

I then changed sysval QCRTOBJAUD from *ALL to *CHANGE thinking
that the ZR's would cease but that's not happening.

Is there any way to stop the ZR's from being created in the audit
journal if QAUDCTL is set to *OBJAUD?

The QCRTOBJAUT system value only sets the auditing value for new objects at
the time they are created. Changing it will not have any effect for
existing objects.

One way to reduce the number of ZR audit records would be to add *NOQTEMP
to the QAUDCLT system value.
Do not do the following until you have read to the end of the note. To
change all existing objects in a library to have *CHANGE auditing you could
use a command similar to this one for each of your libraries.
  CHGAUD OBJ('/qsys.lib/libname.lib/*') OBJAUD(*CHANGE)
where "libname" is the name of your library. Of course you can use the
command for your directories as well. Depending on your system and how long
QCRTOBJAUD has been set to *ALL, this command could cause your system to
write more ZC audit records than the ZR records it is currently writing.
This is because the command changes the audit value for all objects in a
library where you may currently have *ALL set only for objects created
after QCRTOBJAUD was changed to *ALL. You may decide to use OBJAUD(*CHANGE)
for some libraries and OBJAUD(*NONE) or OBJAUD(*USRPRF) for other
libraries.

Ed Fishel,
edfishel@xxxxxxxxxx