Audit of usrprf's -- MIDRANGE-L

× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.

Hi Folks, I want to audit everything a user does on our IBMi. I'm wondering how you folks would approach it. Everything means everything, all the commands the usrprf enters and all objects the usrprf touches, whether updating or not. The user is a developer/programmer w/a user class of *PGMR, spcaut = *JOBCTL and lmtcpb = *NO. I read Steve M’s article and I’m following it and I’ve got;

QAUDCTL set to *AUDLVL/*NOQTEMP/ *OBJAUD.

QAUDLVL set to *SECURITY/*JOBDTA/*DELETE/*PGMADP/*AUTFAIL/*PGMFAIL/*SERVICE/*CREATE/*OBJMGT/*SAVRST/*SYSMGT/*PRTDTA/*SPLFDTA.

I’ve set CHGUSRAUD OBJAUD(*ALL) and AUDLVL on CHGUSRAUD set to many of the values the command allows.

Next, I’m going to have to use CHGOBJAUD OBJAUD=*USRPRF on thousands of objects.

That looks like all there is to it…has anyone gone thru this procedure and if so, how did it work for you? It looks like all I have to do after that is report on the audit journal entries and disk space is not an issue for us.

Has anyone else done this or doing it currently? Any words of wisdom to share?

I can not get approval for 3rd party software (PowerLock/Pentasafe, etc.) as of yet and not sure if I’ll ever get approval for it.

Any input/info on this appreciated.

Thanks, Frank

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.