Re: Auditing suspended after maintenance

On 21 Jan 2013 13:21, CRPence wrote:

There would likely be a VLIC Log for the process that failed to turn
off auditing. There may even be a VLOG specifically for the LIC
request to stop auditing. Those would of course be logged sometime
before the last recorded audit entry. The most common issue I had
investigated several times [irrespective of the possibility the
described effect was also a symptom] was always due to a lack of PASA
[Process Automatic Storage] in the process. AFaIK if the "audit end
action" system value QAUDENDACN had been established as *PWRDWNSYS,
the system would have powered down with the SRC that indicated the
issue; i.e. SRCB9003D10.

I should have said those VLogs would appear *after* the last recorded audit entry. However some VLog conditions for a particular process that was the origin for an issue requiring auditing to be turned off, may actually appear before auditing completely stopped. Basically the VLogs from sometime before the last entry until after the end of the next pwrdwn\IPL could be of the most potential interest; and ideally there would be something logged to diagnose the mismatch between what the OS thought and the LIC thought was the current status of auditing when the CHGSYSVAL QAUDLVL was done to recover.