Re: Auditing Program Calls

[Gord Hutchinson <gordm1@xxxxxxxxxxxxxxx>]

I did RTM!  A CD is written to the audit journal when a program is called
from a command line.

The same command string when executed within a CL program does NOT write
the CD entry.

On Tue, Mar 28, 2017 at 10:52 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

> RTM
> https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/
> rzaki/rzakijournalfinderall2.htm
>
> A CD entry is "change was made for a command string".
>
> Try CHGOBJAUD
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Gord Hutchinson <gordm1@xxxxxxxxxxxxxxx>
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   03/28/2017 10:39 AM
> Subject:        Auditing Program Calls
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> I've been trying to report on the commands and programs a user calls on
> our
> 7.1 systems.  *CMD auditing is turned on for the users in question.
>
> When a program is called from the command line I see the CD entry for the
> CALL in QAUDJRN.  If that program calls a second program, I do not see a
> second CD entry.  If the program calls a command, the CD for the command
> is
> QAUDJRN.
>
> i.e. CALL PGMA writes a CD entry for the call.
>
> If PGMA does a call to PGMB and then calls cmd DSPSYSSTS there is no CD
> entry for the call of PGMB but there is one for DSPSYSSTS.
>
> Is this expected behaviour or am I missing a setting somewhere?
>
> Thanks,
>
>
> Gord
>
>
>
> --
> Gord Hutchinson
> TST Overland Express
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: http://amzn.to/2dEadiD