Re: SOX auditors and QSYS2.OBJECT_STATISTICS()

I just looked up OBJECT_STATISTICS in the SYSFUNCS table. It's an external function that calls a procedure in a service program - QSYS/QDBSSUDF2(QSQOBSTAT) - so I ran DSPPGMREF against the service program - lots of files in QTEMP, so users cannot manipulate those. A couple of the SYS* views in QSYS2 - also cannot be changed by users. There are also several other service programs provided by IBM.

I have a feeling most auditors would have no idea what to do with this information, but you can find it. I even looked at the definition of the UDTF in ACS Db2 tooling - the body of the function is there - completely encrypted in some fashion.

Cheers
Vern

On 8/10/2021 5:10 PM, Bryan Dietz wrote:

auditors i've dealt with just ask for the SQL i used, the resulting XLS and a screen capture of the "messages" pane in ACS that shows X number of rows returned.

as for manipulating the "source" data, maybe you can explain how the data is captured, with IBM using a API.  I sometimes just provide  the link to the manuals.

Bryan

Robert Rogerson wrote on 8/10/2021 12:12 PM:

Hi everyone,

We have a report that we give to the SOX auditors that is based on
QSYS2.OBJECT_STATISTICS().

Now they are asking for proof that users can't manipulate the data.  My
belief is that a user can't manually manipulate the base table(s) behind
the UDTF.  I've been searching Google but not come up with anything clear.

Does anyone know the answer to this or could point me to a link I can show
the auditors?

Thanks,

Rob