There are logs, but we only keep ours a few weeks to a few months, for the
purpose of identifying problems, fixing them, forgetting them.
The data in DSPLOG and various message queues can be extracted via
software, which we do, to focus on certain events of greater interest, like:
* files filling up
* latest security no nos
* business rules got changed
* IBM tax struck again
* pattern of alleged power outages
* some hardware gone flakey
Check your GO CLEANUP options ... how long are you keeping what logs.
Check your security settings ... who is even authorized to change system
values, and how often do you change the passwords for security officers?
Do you have security auditing running? What are you capturing there & how
far back does it go?
There's also 3rd party stuff that can help you, but only if you had it
installed 3 months ago.
Do you use generic security officer sign-ons that are known to several people?
In that case, maybe the security logs will show that the master security
officer was used to update the stuff. If you still had the regular system
logs for that time frame you could then see that from a particular workstation:
* JOE SHMOE was signed on until 11.30 am
* The master security officer signed on for 10 minutes to change the system
values
* JOE SHMOE then signed on again to use that workstation
That would tell you to talk with JOE SHMOE.
But that's only if you keep your logs that long.
You might also check what goes on your backups & if you have a backup tape
that might contain the logs from that time frame.
Hi Guys: is there any way to know who change a system value. Is there
any logs??? Some guy here change a system value 3 months ago and we want
to know who did it.
Thanks in advance
midrange.com
