Re: IFS Audit (already journaled by iTera)

Peter Vidal wrote on 04/17/2007 02:24:55 PM:

How can I read journaled data from activities done over a folder (and its

subfolders) in the IFS? This is currently monitored by an iTera journal
but I do not know how to take advantage of it. iTera support can't tell
how to read this for me and I can use a couple of IFS tools to do this

but

I can't use them because this iTera journal is in place and I can't

remove

it. It is part of the High Availability feature of iTera.

If you want to audit the security changes to your directories and stream
files you should be using the security audit journal. You should be able to
use the security audit journal even if an iTera journal is being used for
the same directories.

I do not know anything about the iTera product or their journal, but my
guess is that it is just a normal journal that is being used to journal
changes to a directory instead of a physical file. The iTera product
probably uses normal command or API interfaces to access the data in the
journal. So, you should be careful to not do anything that could cause the
iTera product to miss some of the entries in the journal. Since you do not
know the current, or future, internal working of the product, it would
probably be safest for you to not read any entries from this journal. I am
sure that you do not want your actions to cause extra locks that could
cause the high availability product to delay or even miss some operations.

If you are looking for a description of what the audit entries for a
directory look like you can find information by going here
http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rzaki/rzakifinder.htm
and then selecting "Journal Code B - Integrated file system" from the
first drop down list and clicking on the related GO button.

Ed Fishel,
edfishel@xxxxxxxxxx