Re: Who is clearing QSYSOPR -- MIDRANGE-L

SELECT entry_timestamp AS when,
"CURRENT_USER" AS user_name,
job_name,
job_user,
job_number,
INTERPRET(SUBSTR(entry_data, 12, 10) AS CHAR(10)) AS jobq_lib,
INTERPRET(SUBSTR(entry_data, 2, 10) AS CHAR(10)) AS jobq_name,
INTERPRET(SUBSTR(entry_data, 22, 8) AS CHAR(8)) AS object_type,
CHAR(INTERPRET(SUBSTR(entry_data, 30, 3) AS DECIMAL(5, 0))) AS access_type
FROM TABLE (
qsys2.display_journal(
'QSYS',
'QAUDJRN', STARTING_RECEIVER_NAME => '*CURAVLCHN', journal_entry_types => 'ZC',
starting_timestamp => CURRENT TIMESTAMP - 24 HOURS)
)
WHERE object_type = '*MSGQ';

For me at least I get 51 for the access_type when something puts a message on the queue. For both removing a single message, and clearing the queue, I get 38.
https://www.ibm.com/docs/en/i/7.4?topic=entries-numeric-codes-access-types

On Fri, 2021-05-14 at 17:24 +0000, Rob Berendt wrote:
<https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type>

https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type

Kind of hard telling if just a job logged a message to QSYSOPR or if someone cleared the message queue.

IDK how to bust apart the journal entry data (ENTRY_DATA from the sql service) to see if it tells you what operation was performed.

Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 7310 Innovation Blvd, Suite 104

Ft. Wayne, IN 46818

Ship to: 7310 Innovation Blvd, Dock 9C

Ft. Wayne, IN 46818

<http://www.dekko.com>

http://www.dekko.com

-----Original Message-----

From: MIDRANGE-L <

<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>

midrange-l-bounces@xxxxxxxxxxxxxxxxxx

On Behalf Of Kevin Bucknum

Sent: Friday, May 14, 2021 1:10 PM

To:

<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>

midrange-l@xxxxxxxxxxxxxxxxxx

Subject: Re: Who is clearing QSYSOPR

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

It looks to me like you get ZC and ZR records if you turn on object auditing for the message queue.

Display Object Description - Full

Library 1 of 1

Object . . . . . . . : QSYSOPR Attribute . . . . . :

Library . . . . . : QSYS Owner . . . . . . . : QSYS

Library ASP device . : *SYSBAS Library ASP group . : *SYSBAS

Type . . . . . . . . : *MSGQ Primary group . . . : *NONE

Change/Usage information:

Change date/time . . . . . . . . . . : 05/14/21 11:51:04

Usage data collected . . . . . . . . : YES

Last used date . . . . . . . . . . . :

Days used count . . . . . . . . . . : 0

Reset date . . . . . . . . . . . . :

Allow change by program . . . . . . : YES

Auditing/Integrity information:

Object auditing value . . . . . . . : *ALL

Digitally signed . . . . . . . . . . : NO

On Fri, 2021-05-14 at 11:13 -0500, ~TA~ wrote:

I had already done DSPLOG and there was no mention of QSYSOPR in it.

DSPOBJAUT did not reveal anything helpful.

I'm looking to set up QAUDJRN with the appropriate config to see

'whodunit' the next time it happens.

Thanks.

On 5/14/2021 10:18 AM, Mark Waterbury wrote:

Tim,

Issue DSPOBJAUT QSYSOPR *MSGQ to see what user or group profiles may have enough authority to do that.

Also, DSPLOG LOG(QHST) PERIOD((*AVAIL *BEGIN)) OUTPUT(*PRINT) and then search the resulting spool file for "QSYSOPR" -- perhaps you may see a message in there showing "who done it"?

Hope that helps,

Mark S. Waterbury

> On Friday, May 14, 2021, 11:10:39 AM EDT, ~TA~ <

<mailto:

<mailto:tadair@xxxxxxxxxxxxxxxx>

tadair@xxxxxxxxxxxxxxxx

<mailto:tadair@xxxxxxxxxxxxxxxx>

tadair@xxxxxxxxxxxxxxxx

wrote:

I'm attempting to set up QAUDJRN to determine who is clearing the system

operator message queue (QSYSOPR). I've searched the archive, I've

searched the internet, and I still can't seem to find a straight-up

answer. I would appreciate someone pointing me in the right direction.

We're on 7.3.

Thanks in advance.

[

<https://www.medtronsoftware.com/img/MedtronMinilogo.bmp>

https://www.medtronsoftware.com/img/MedtronMinilogo.bmp

] Kevin Bucknum

Senior Programmer Analyst

MEDDATA / MEDTRON

120 Innwood Drive

Covington LA 70433

Local: 985-893-2550

Toll Free: 877-893-2550

<https://www.medtronsoftware.com>

https://www.medtronsoftware.com

CONFIDENTIALITY NOTICE

This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email:

<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>

MIDRANGE-L@xxxxxxxxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit:

<https://lists.midrange.com/mailman/listinfo/midrange-l>

https://lists.midrange.com/mailman/listinfo/midrange-l

or email:

<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>

MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx

Before posting, please take a moment to review the archives

at

<https://archive.midrange.com/midrange-l>

https://archive.midrange.com/midrange-l

.

Please contact

<mailto:support@xxxxxxxxxxxxxxxxxxxx>

support@xxxxxxxxxxxxxxxxxxxx

for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link:

<https://amazon.midrange.com>

https://amazon.midrange.com

[https://www.medtronsoftware.com/img/MedtronMinilogo.bmp] Kevin Bucknum
Senior Programmer Analyst
MEDDATA / MEDTRON
120 Innwood Drive
Covington LA 70433
Local: 985-893-2550
Toll Free: 877-893-2550
https://www.medtronsoftware.com

CONFIDENTIALITY NOTICE

This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.