Re: Journalling PF that is updated via DDM file

Hi Chris,

Thanks for the idea.  However, the only time we get those journal entries is if the DDM conversation is "protected", i.e. under commitment control.  We're not set up for that, so all DDM traffic on the internal network is "unprotected".

What we're doing for the moment to track down a rogue program that's making an unwanted change to a particular field in a particular file, is adding a trigger program to the physical file on the target system, and if the criteria are met, we send an *ESCAPE message, which actually gets sent back to the source system, causing an error.  We expect to see the error on the source system and that error should tell us the job, user and program.  At least it works for a test program that forces the error.

That should help with this particular problem, but going forward there may be other issues where we'll need a more general solution, at least until they finish migrating everything off the old v5r4 system onto the v7r3.

--
*Peter Dow* /
Dow Software Services, Inc.
909 793-9050
petercdow@xxxxxxxxx <mailto:petercdow@xxxxxxxxx>
pdow@xxxxxxxxxxxxxx <mailto:pdow@xxxxxxxxxxxxxx> /

On 10/13/2020 3:36 PM, Christopher Bipes wrote:

Search the following link for DDM https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/rzaki/rzakipdf.pdf

Look for Journal Code C, Entry Type LW A logical unit of work (has ended) -

Logical unit of work (C LW) journal entry - DDM record
Relative
offset
Field Format Description
1 Record type Char (4) Type of record:
DDM = Remote Database file record.
5 Record length Bin (15) Length of record. Currently 96 for DDM record.

After
the
remote
portion
LUW DDM portion 96 Information about DDM resources that
participated in the LUW. The entry might have 0
to n records for DDM resources. Each DDM
resource record is 96 characters long. The layout
for the “Logical unit of work (C LW) journal entry -
DDM record” on page 260 describes the DDM
record.


Chris Bipes
Director of Information Services
CrossCheck, Inc.

707.665-2100, ext. 1102
707.793.5700 FAX
chris.bipes@xxxxxxxxxxxxxxx
www.cross-check.com

Notice of Confidentiality: This e-mail, and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information.  If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this e-mail, and any attachments thereto, is strictly prohibited.  If you have received this e-mail in error, please immediately notify me by e-mail (by replying to this message) or telephone (noted above) and permanently delete the original and any copy of any e-mail and any printout thereof.  Thank you for your cooperation with respect to this matter.


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Peter Dow
Sent: Tuesday, October 13, 2020 3:16 PM
To: MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Journalling PF that is updated via DDM file

One of the purposes of journaling is auditing who did what to something.

If SYSA has a journaled physical file, and SYSB has a DDM file pointing to that physical file on SYSA, the journal entries on SYSA only show the local job (with user QUSER) and its current user (also QUSER), and the local program (QCNTEDDM), that did something to a record in the physical file.  I would like to capture the remote user, job and program if possible.

So far it doesn't seem possible, or even close.  The information doesn't appear to exist on SYSA, either in the journal entry, or a trigger program's parameters.  I can't add a trigger to the DDM file on SYSB. There is no exit point on SYSB for a record add/update/delete.

Any ideas?

--
*Peter Dow* /
Dow Software Services, Inc.
909 793-9050
petercdow@xxxxxxxxx <mailto:petercdow@xxxxxxxxx> pdow@xxxxxxxxxxxxxx <mailto:pdow@xxxxxxxxxxxxxx> /


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com