Rob,
What about situations where someone runs a command or procedure that does a "profile swap" to a more powerful profile, or runs under a program that adopts owner authority (of a more powerful profile)?
Mark S. Waterbury
On Monday, July 8, 2019, 4:33:08 PM EDT, Rob Berendt <rob@xxxxxxxxx> wrote:
Please no vendor plugs as I am wishing to resolve this on my own.
I can easily retrieve user profiles with elevated privileges from qsys2.user_info.
To see whether or not all use of that user profile is audited I can join that to object_statistics.
I want to find out all jobs which use that user profile. So even if a job like 148345/QUSER/QRWTSRVR is using one of these user profiles I want to know about it.
So I guess what I need to do is
1: Determine the users with elevated privileges.
2: If not already done then CHGOBJAUD OBJ(...) OBJTYPE(*USRPRF) OBJAUD(*ALL)
Once I've done this then later on I can do something like:
SELECT journal_code, journal_entry_type, "CURRENT_USER", "JOB_NAME", "JOB_USER", "JOB_NUMBER",
PROGRAM_NAME, PROGRAM_LIBRARY, PATH_NAME, OBJECT, OBJECT_TYPE, REMOTE_ADDRESS, REMOTE_PORT
FROM TABLE (QSYS2.Display_Journal(
JOURNAL_LIBRARY => 'QSYS',
JOURNAL_NAME => 'QAUDJRN',
STARTING_RECEIVER_LIBRARY => 'QGPL',
STARTING_RECEIVER_NAME => '*CURCHAIN',
STARTING_TIMESTAMP => CURRENT TIMESTAMP - 7 DAYS
)) X
WHERE OBJECT_TYPE = '*USRPRF'
and journal_entry_type<>'ZC'; -- Don't want to know about password changes, etc
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
midrange.com
