RE: Identifying what job is calling QSH

Rob,

No double CD in my case.
Only ADDLIBLE and CHGLIBL appearing, no QSH.

Looking at both Name of object and Command string

Name of object CDONAM A 10 611
Command string CDCMDS A 65 640

CHGOBJAUD OBJ(QSH) OBJTYPE(*CMD) OBJAUD(*ALL)
Object auditing value changed for QSH in QSYS type *CMD.

CPYAUDJRNE ENTTYP(CD) OUTFILE(QGPL/QAUDIT) JRNRCV(*CURCHAIN)
Message . . . . : 7472514 entries converted from journal QAUDJRN in QSYS.
Cause . . . . . : The DSPJRN command completed.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Thursday, October 29, 2015 10:29 AM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

How did you turn on auditing?
CHGOBJAUD OBJ(QSYS/QSH) OBJTYPE(*CMD) OBJAUD(*ALL) QSH CHGOBJAUD OBJ(QSYS/QSH) OBJTYPE(*CMD) OBJAUD(*NONE)
CPYAUDJRNE ENTTYP(CD) OUTFILE(QGPL/QAUDITCD) JRNRCV(*CURCHAIN)
FROMTIME(102915 1000) TOTIME(102915 1020)

RUNQRY QRYFILE(QGPL/QAUDITCDCD)
Shift to column . . . . . . 690
9....+...70....+...71....+...72....+...73....+...74
Specific Entry Object Library Object
data type name name type
length
30 X QSH QSYS *CMD
******** End of report ********

Did you look at the right file? Your command CPYAUDJRNE ENTTYP(CD) OUTFILE(QGPL/QAUDITCD)...
creates a file named such
qauditcdCD
notice the double CD?

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 10/29/2015 09:49 AM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

After turning on auditing for QSH, and checking QAUDITCD, QSH is NOT
appearing.
Why?
What am I missing?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Thursday, October 29, 2015 9:14 AM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

Guess we'll call that belt and suspenders then.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 10/29/2015 08:10 AM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

The library object was audited, along with ADDLIBLE, CHGLIBL, EDTLIBL.
Today I also turned on auditing for QSH, going back and reviewing
journals.
Normally I look at QAUDITJS, in this case I had to look at QAUDITCD.

We prefer to control the library list via the jobd, with limited use of
ADDLIBLE, CHGLIBL.

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Thursday, October 29, 2015 7:30 AM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

You're still auditing ADDLIBLE. I say audit the library, not the command.


For instance:
CHGLIBL
Jobs using a library list from a job description Some custom RPLLIBL which

can replace your library list with that of a job description, data area or

user profile. (We have this) Qualified commands: DEFUNCTLIB/THEIRCMD
Qualified calls: CALL DEFUNCTLIB/THEIRPGM Commands dumped into QGPL or
QUSRSYS from them which execute programs from their library.
Proxy commands which are redirected to their library.

Here's a start up program from Infor:
...
DCL VAR(&USRLIB) TYPE(*CHAR) LEN(10)
DCL VAR(&INLIBL) TYPE(*CHAR) LEN(396)
DCL VAR(&SAVLIBL) TYPE(*CHAR) LEN(2750)
DCL VAR(&LIBL) TYPE(*CHAR) LEN(2750)
DCL VAR(&RPLIBL) TYPE(*CHAR) LEN(2760)
...
RTVJOBA USER(&USER) INQMSGRPY(&INQMSGRPY) +
OUTQ(&OUTQ) OUTQLIB(&OUTQLBR) DATE(&DATE) +
SWS(&SWS) USRLIBL(&LIBL) DATFMT(&DATFMT) ...
CHGVAR VAR(&SAVLIBL) VALUE(&LIBL)
RTVDTAARA DTAARA(&USRLIB/INLIBL) RTNVAR(&INLIBL) ...
CHGVAR VAR(&CMD) VALUE('CHGLIBL LIBL(' *CAT &INLIBL *TCAT ')')
...
CALL PGM(QCMDEXC) PARM(&CMD &LEN)
...
and when the programs ends it changes your library list back.

This kind of stuff is not uncommon.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 10/28/2015 04:41 PM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

QAUDITCD showed me everything I need.

SELECT * FROM qgpl/QAUDITcd WHERE locate ('G1',CDCMDS ) <> 0

662 00000000000218985723 T CD 2015-10-28-08.00.02.563904
BRCCHKFREE CPACOPER 406,251 VPVPGM01 BRCPGMSN *S

52 C ADDLIBLE QSYS *CMD E ADDLIBLE LIB(G1C1PGMS)

53 C ADDLIBLE QSYS *CMD E ADDLIBLE LIB(G1C1FILES)




Thanks
Paul


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Steinmetz, Paul
Sent: Wednesday, October 28, 2015 3:48 PM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Identifying what job is calling QSH

Rob,

Library object already being audited.
Which QAUDIT file should I be looking at for this?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Wednesday, October 28, 2015 3:35 PM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

Yes, audit the library object, as shown in the reply below.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 10/28/2015 03:19 PM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

I was auditing for ADDLIBLE, EDTLIBLE.
I was NOT auditing for the scenario where a library was added via CALLP
Cmd('ADDLIBLE LIB(G1C1PGMS)':200) Would this require different auditing?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Wednesday, October 28, 2015 2:58 PM
To: Midrange Systems Technical Discussion
Subject: RE: Identifying what job is calling QSH

First of all let me say that I love monitors that "assume" that when a
failure occurs that it's only because of a certain reason, like the
library was already in the library list. Not that there's any potential
that someone deleted the library. Because that obviously couldn't happen.




;-) But if that's not the case, IOW, if it can ignore that the libraries


no longer exist, then the application coded for it and you can ignore it.
Although I can't imagine a scenario that would be true. Well, maybe. Add


"custom commands" library to top of system library list. If that fails
then either the library is already in the library list or that it doesn't
exist and we can use the 'regular' system commands. I'm not saying I'm
perfect (I've got to fix a program I wrote that did an ALCOBJ with NO
monmsg).

Now which were you auditing for?
- Jobs that called QSH? or
- Jobs that had those libraries in their library list?

Date sent . . . . . . : 10/28/15 Time sent . . . . . . : 14:48:13
Message . . . . : addlible robdelme

Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : ZR - Object read access
Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 10/28/15
Time . . . . . . . . : 14:48:13.432880
...
Job . . . . . . . . : 756649/ROB/ROBS1
F15=Display only entry specific data
*...+....1....+....2....+....3..
'RROBDELME QSYS *LIB ¬

Yes, it does rather grind me that IBM fails to put the object in the
"Object" and "Type" and makes you look in the "Entry specific data".

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'midrange-l@xxxxxxxxxxxx'" <midrange-l@xxxxxxxxxxxx>
Date: 10/28/2015 02:14 PM
Subject: RE: Identifying what job is calling QSH
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Chuck,

The 2 JS entries contain for job name, QZSHSH and QP0ZSPWP, does not show
the name of the job calling QSH.

Entry Sequence Code Type Timestamp Job




User Job Program Program Pr
length number name name number name library AS
3,726 00000000000218985752 T JS 2015-10-28-08.00.02.810256
QZSHSH CPACOPER 406,267 QWTPIIPP QSYS *S
3,726 00000000000218985756 T JS 2015-10-28-08.00.02.830352
QP0ZSPWP CPACOPER 406,268 QWTPIIPP QSYS *S

By checking QHST I did find a few jobs that started at 8:00, I checked
those job logs, found this.

CPF1124 Information 00 10/28/15 08:00:00.093493 QWTPIIPP




QSYS 04C0 *EXT
Message . . . . : Job
406251/CPACOPER/BRCCHKFREE started on 10/28/15 at
08:00:00 in subsystem BATCH_CM in
GPL. Job entered system on 10/28/15 at
08:00:00.

CPC2196 Completion 00 10/28/15 08:00:02.563700 QLICUSRL




QSYS 0114 VPVPGM01 BRCPGMSN *STMT
To module . . . . . . . . . :
VPVPGM01
To procedure . . . . . . . :
VPVPGM01
Statement . . . . . . . . . : 1851

Message . . . . : Library G1C1PGMS
added to library list.
CPC2196 Completion 00 10/28/15 08:00:02.563975 QLICUSRL




QSYS 0114 VPVPGM01 BRCPGMSN *STMT
To module . . . . . . . . . :
VPVPGM01
To procedure . . . . . . . :
VPVPGM01
Statement . . . . . . . . . : 1856

Message . . . . : Library G1C1FILES




added to library list.

Within VPVGP01 I did find this.

0315.00 C MONITOR
0316.00 C CALLP Cmd('ADDLIBLE LIB(G1C1PGMS)':200)
0317.00 C ON-ERROR
0318.00 C ENDMON
0319.00
0320.00 C MONITOR
0321.00 C CALLP Cmd('ADDLIBLE LIB(G1C1FILES)':200)
0322.00 C ON-ERROR
0323.00 C ENDMON

My question is why did I not find QAUDJRN entries for job BRCCHKFREE
showing the ADDLIBLE?

0316.00 C CALLP Cmd('ADDLIBLE LIB(G1C1PGMS)':200)
0321.00 C CALLP Cmd('ADDLIBLE LIB(G1C1FILES)':200)

Paul


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
CRPence
Sent: Wednesday, October 28, 2015 1:27 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Identifying what job is calling QSH

On 28-Oct-2015 11:15 -0500, Steinmetz, Paul wrote:

<<SNIP>>

From the QAUDJRNJS, I have one job running daily at 8:00 am, that
calls QSH, (QZSHSH, QPOZSPWP) still has the 3rd party app libraries in
their library list.

How can I find what job is calling QSH that still contains these 3rd
party app libraries?

I expect [from memory alone; i.e. not as verified by an actual test]
that by locating the T-JS [Audit:Job Data] entry for one of those jobs,
that in the Standard Heading Fields For Audit Journal Entries will be
revealed the qualified job name of the job that performed the QSH request.
[
http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_72/rzarl/rzarlf01.htm




]
_Standard heading fields for audit journal entries_ ...
"This table lists all possible values for the fields that are common to
all entry types when OUTFILFMT(*TYPE5) is specified on the DSPJRN command.
..."

The T-JS could be located by the start time of the job, and\or by
looking for the [and additionally to confirm the correct] entry having the




Job Name='QZSHSH' [and the corresponding Job User Name and Job Number;
probably also with Entry Type='S' and Job Subtype=D].
[
http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_72/rzarl/rzarlf28.htm




]
_JS (Job Change) journal entries_
"This table provides the format of the JS (Job Change) journal entries.
..."

And if not revealed with that job [the Job Name='QZSHSH'], then the
other job [the Job Name='QPOZSPWP']; i.e. again, the job to which the T-JS




is associated, for at least one of those Qxxx jobs, presumably will be the




job that had issued the QSH request.

--
Regards, Chuck

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.