Re: Missing entry types for DSPAUDJRNE

Jeff Young wrote on 02/15/2007 03:04:36 PM:

I am attempting to setup auditing for the high security users at a

client.

I have setup the audit levels and audit actions so that the
desired information is being captured in QAUDJRN.
When I review the entry types for the DSPAUDJRNE command, I do not
have the ability to specify the following types:
AP > AU > CQ > CY > DI > DS > IR > KF > LD > ML > NA
RA > RJ > RO > RP > RQ > RU > RZ > SD > SE > SM > ST

In addition, when I request the JS (Job Records), I get no data,
but when I look at the journal, I see entries there.

Any suggestions will be appreciated.

Chapter 9 of the Security Reference manual indicates that IBM has stopped
providing enhancements for the DSPAUDJRNE command. The command does not
support all security audit record types, and the command does not list all
the fields for the records it supports.

Hopefully the system is at V5R4. If it is you should use the new CPYAUDJRNE
command instead of DSPAUDJRNE. If you are on an earlier release you should
first use CRTDUPOBJ OBJ(QASYxxJ5) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(QTEMP)
to create a physical file in QTEMP and then use DSPJRN to copy the xx audit
records to that file. (Where xx is the audit record entry type.) The
remaining steps to display the data will be the same as V5R4.

Ed Fishel,
edfishel@xxxxxxxxxx