RE: Idea - not auditing /tmp

Mark,
That will not work. The Auditing value for any directory has no bearing on create/delete of objects.

I'm currently fighting with IBM on this very issue. I recently enabled QAUDJRN, audit CO and DO. IBM DB2 Web Query is filling my journals with crap from created/deleted objects in their temp directories (which are used by WebQuery (and WebFOCUS) as temporary file workspace).

/QIBM/UserData/qwebqry/base80/temp/
/QIBM/UserData/qwebqry/ibi/srv77/wfs/edatemp/

Those directories already have an Auditing Value of *NONE.

Per IBM:
"The recommendation by the developer [of webquery] of removing *CREATE and *DELETE from the QAUDLVL system value and instead adding them to certain user profiles would indeed reduce the number of events added to the Audit Journal.
However, customers usually want to have them at global basis to find out what user is deleting or creating the objects. "
"You will still have CO and DO entries for WQ IFS directories because those are set at QAUDLVL system value."
For instance:
===> CHGAUD OBJ('/QIBM/UserData/qwebqry/base80/temp/') OBJAUD(*NONE) SUBTREE(*ALL)
It would ONLY prevent ZR, ZC and LD(some cases) from being logged.

So unless IBM gives us the omit option at the QAUDCTL, there is NO WAY around this.
Literally THOUSANDS of entries per day.

IMHO, this is completely unacceptable.

The RFE is legit - they just don't want the headache of doing it.

Greg

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Mark Waterbury
Sent: Tuesday, June 21, 2022 11:20 AM
To: Rob Williams via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Idea - not auditing /tmp

All,

Why is this "idea" (or RFE) even necessary?

Just use CHGAUD to change the auditing for "/tmp" (or any other specific directories) as desired?  

Mark S. Waterbury

On Tuesday, June 21, 2022, 11:13:17 AM EDT, Rob Williams via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

I voted this idea although IBM declined a similar request submitted by
someone in 2018.

The old RFE title and links to are below

Allow IFS directory and content *IGNORE in QAUDJRN

https://ibm-power-systems.ideas.ibm.com/ideas/IBMI-I-2655

https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=121002