Re: SOX auditors and QSYS2.OBJECT_STATISTICS()

Thanks Bryan and Vern.

I explained to them that OBJECT_STATISTICS is a UDFT provided by IBM for
viewing object statistics. The user doesn't actually have access to the
code of the UDFT and so can not update data using the UDFT.

The SOX auditors are happy for now...Thanks for the help.

Rob

On Wed, Aug 11, 2021 at 8:13 AM Vern Hamberg <vhamberg@xxxxxxxxxxxxxxx>
wrote:

I just looked up OBJECT_STATISTICS in the SYSFUNCS table. It's an
external function that calls a procedure in a service program -
QSYS/QDBSSUDF2(QSQOBSTAT) - so I ran DSPPGMREF against the service
program - lots of files in QTEMP, so users cannot manipulate those. A
couple of the SYS* views in QSYS2 - also cannot be changed by users.
There are also several other service programs provided by IBM.

I have a feeling most auditors would have no idea what to do with this
information, but you can find it. I even looked at the definition of the
UDTF in ACS Db2 tooling - the body of the function is there - completely
encrypted in some fashion.

Cheers
Vern

On 8/10/2021 5:10 PM, Bryan Dietz wrote:

auditors i've dealt with just ask for the SQL i used, the resulting
XLS and a screen capture of the "messages" pane in ACS that shows X
number of rows returned.

as for manipulating the "source" data, maybe you can explain how the
data is captured, with IBM using a API. I sometimes just provide the
link to the manuals.

Bryan

Robert Rogerson wrote on 8/10/2021 12:12 PM:

Hi everyone,

We have a report that we give to the SOX auditors that is based on
QSYS2.OBJECT_STATISTICS().

Now they are asking for proof that users can't manipulate the data. My
belief is that a user can't manually manipulate the base table(s) behind
the UDTF. I've been searching Google but not come up with anything
clear.

Does anyone know the answer to this or could point me to a link I can
show
the auditors?

Thanks,

Rob

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com