RE: Identifying what job is calling QSH

Rob,

Library object already being audited.
Which QAUDIT file should I be looking at for this?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Wednesday, October 28, 2015 3:35 PM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

Yes, audit the library object, as shown in the reply below.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 10/28/2015 03:19 PM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

I was auditing for ADDLIBLE, EDTLIBLE.
I was NOT auditing for the scenario where a library was added via CALLP
Cmd('ADDLIBLE LIB(G1C1PGMS)':200)
Would this require different auditing?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Wednesday, October 28, 2015 2:58 PM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

First of all let me say that I love monitors that "assume" that when a
failure occurs that it's only because of a certain reason, like the
library was already in the library list. Not that there's any potential
that someone deleted the library. Because that obviously couldn't happen.

;-) But if that's not the case, IOW, if it can ignore that the libraries
no longer exist, then the application coded for it and you can ignore it.
Although I can't imagine a scenario that would be true. Well, maybe. Add
"custom commands" library to top of system library list. If that fails
then either the library is already in the library list or that it doesn't
exist and we can use the 'regular' system commands. I'm not saying I'm
perfect (I've got to fix a program I wrote that did an ALCOBJ with NO
monmsg).

Now which were you auditing for?
- Jobs that called QSH? or
- Jobs that had those libraries in their library list?

Date sent . . . . . . : 10/28/15 Time sent . . . . . . : 14:48:13
Message . . . . : addlible robdelme

Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : ZR - Object read access
Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 10/28/15
Time . . . . . . . . : 14:48:13.432880
...
Job . . . . . . . . : 756649/ROB/ROBS1
F15=Display only entry specific data
*...+....1....+....2....+....3..
'RROBDELME QSYS *LIB ¬

Yes, it does rather grind me that IBM fails to put the object in the
"Object" and "Type" and makes you look in the "Entry specific data".

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'midrange-l@xxxxxxxxxxxx'" <midrange-l@xxxxxxxxxxxx>
Date: 10/28/2015 02:14 PM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Chuck,

The 2 JS entries contain for job name, QZSHSH and QP0ZSPWP, does not show
the name of the job calling QSH.

Entry Sequence Code Type Timestamp Job

User Job Program Program Pr
length number name name number name library AS
3,726 00000000000218985752 T JS 2015-10-28-08.00.02.810256
QZSHSH CPACOPER 406,267 QWTPIIPP QSYS *S
3,726 00000000000218985756 T JS 2015-10-28-08.00.02.830352
QP0ZSPWP CPACOPER 406,268 QWTPIIPP QSYS *S

By checking QHST I did find a few jobs that started at 8:00, I checked
those job logs, found this.

CPF1124 Information 00 10/28/15 08:00:00.093493 QWTPIIPP

QSYS 04C0 *EXT
Message . . . . : Job
406251/CPACOPER/BRCCHKFREE started on 10/28/15 at
08:00:00 in subsystem BATCH_CM in
GPL. Job entered system on 10/28/15 at
08:00:00.

CPC2196 Completion 00 10/28/15 08:00:02.563700 QLICUSRL

QSYS 0114 VPVPGM01 BRCPGMSN *STMT
To module . . . . . . . . . :
VPVPGM01
To procedure . . . . . . . :
VPVPGM01
Statement . . . . . . . . . : 1851

Message . . . . : Library G1C1PGMS
added to library list.
CPC2196 Completion 00 10/28/15 08:00:02.563975 QLICUSRL

QSYS 0114 VPVPGM01 BRCPGMSN *STMT
To module . . . . . . . . . :
VPVPGM01
To procedure . . . . . . . :
VPVPGM01
Statement . . . . . . . . . : 1856

Message . . . . : Library G1C1FILES

added to library list.

Within VPVGP01 I did find this.

0315.00 C MONITOR
0316.00 C CALLP Cmd('ADDLIBLE LIB(G1C1PGMS)':200)
0317.00 C ON-ERROR
0318.00 C ENDMON
0319.00
0320.00 C MONITOR
0321.00 C CALLP Cmd('ADDLIBLE LIB(G1C1FILES)':200)
0322.00 C ON-ERROR
0323.00 C ENDMON

My question is why did I not find QAUDJRN entries for job BRCCHKFREE
showing the ADDLIBLE?

0316.00 C CALLP Cmd('ADDLIBLE LIB(G1C1PGMS)':200)
0321.00 C CALLP Cmd('ADDLIBLE LIB(G1C1FILES)':200)

Paul


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
CRPence
Sent: Wednesday, October 28, 2015 1:27 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Identifying what job is calling QSH

On 28-Oct-2015 11:15 -0500, Steinmetz, Paul wrote:

<<SNIP>>

From the QAUDJRNJS, I have one job running daily at 8:00 am, that
calls QSH, (QZSHSH, QPOZSPWP) still has the 3rd party app libraries in
their library list.

How can I find what job is calling QSH that still contains these 3rd
party app libraries?

I expect [from memory alone; i.e. not as verified by an actual test]
that by locating the T-JS [Audit:Job Data] entry for one of those jobs,
that in the Standard Heading Fields For Audit Journal Entries will be
revealed the qualified job name of the job that performed the QSH request.
[
http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_72/rzarl/rzarlf01.htm

]
_Standard heading fields for audit journal entries_ ...
"This table lists all possible values for the fields that are common to
all entry types when OUTFILFMT(*TYPE5) is specified on the DSPJRN command.
..."

The T-JS could be located by the start time of the job, and\or by
looking for the [and additionally to confirm the correct] entry having the

Job Name='QZSHSH' [and the corresponding Job User Name and Job Number;
probably also with Entry Type='S' and Job Subtype=D].
[
http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_72/rzarl/rzarlf28.htm

]
_JS (Job Change) journal entries_
"This table provides the format of the JS (Job Change) journal entries.
..."

And if not revealed with that job [the Job Name='QZSHSH'], then the
other job [the Job Name='QPOZSPWP']; i.e. again, the job to which the T-JS

is associated, for at least one of those Qxxx jobs, presumably will be the

job that had issued the QSH request.

--
Regards, Chuck

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.