Re: SOX auditors and QSYS2.OBJECT_STATISTICS()

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

I just looked up OBJECT_STATISTICS in the SYSFUNCS table. It's an 
external function that calls a procedure in a service program - 
QSYS/QDBSSUDF2(QSQOBSTAT) - so I ran DSPPGMREF against the service 
program - lots of files in QTEMP, so users cannot manipulate those. A 
couple of the SYS* views in QSYS2 - also cannot be changed by users. 
There are also several other service programs provided by IBM.

I have a feeling most auditors would have no idea what to do with this 
information, but you can find it. I even looked at the definition of the 
UDTF in ACS Db2 tooling - the body of the function is there - completely 
encrypted in some fashion.

Cheers
Vern

On 8/10/2021 5:10 PM, Bryan Dietz wrote:
> auditors i've dealt with just ask for the SQL i used, the resulting 
> XLS and a screen capture of the "messages" pane in ACS that shows X 
> number of rows returned.
>
> as for manipulating the "source" data, maybe you can explain how the 
> data is captured, with IBM using a API.  I sometimes just provide  the 
> link to the manuals.
>
> Bryan
>
> Robert Rogerson wrote on 8/10/2021 12:12 PM:
> > Hi everyone,
> >
> > We have a report that we give to the SOX auditors that is based on
> > QSYS2.OBJECT_STATISTICS().
> >
> > Now they are asking for proof that users can't manipulate the data.  My
> > belief is that a user can't manually manipulate the base table(s) behind
> > the UDTF.  I've been searching Google but not come up with anything 
> > clear.
> >
> > Does anyone know the answer to this or could point me to a link I can 
> > show
> > the auditors?
> >
> > Thanks,
> >
> > Rob