Re: Detecting when a user invoked strdbg -- MIDRANGE-L

Rob, can't seem to get this to work...

Work with Journal Attributes

Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS

Attached receiver . : AUDRCV0001 Library . . . . . . : QGPL

Text . . . . . . . . : Auditing Journal

ASP . . . . . . . . : 1 Journaled objects:

Message queue . . . : QSYSOPR Current . . . . . : 9

Library . . . . . : *LIBL Maximum . . . . . : 250000

Manage receivers . . : *SYSTEM Recovery count . . . : *SYSDFT

Delete receivers . . : *NO Receiver size options:
*RMVINTENT
Journal cache . . . : *NO *MAXOPT2

Manage delay . . . . : 10

Delete delay . . . . : 10

Journal type . . . . : *LOCAL

Journal state . . . : *ACTIVE

Minimize entry data : *NONE

4 > CHGOBJAUD OBJ(QSYS/STRDBG) OBJTYPE(*CMD) OBJAUD(*ALL)
Object auditing value changed for STRDBG in QSYS type *CMD.

however when I do the strdbg/enddbg, nothing seems to be recorded...

Display Journal Entries

Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS
Largest sequence number on this screen . . . . . . : 00000000000000000639
Type options, press Enter.
5=Display entire entry

Opt Sequence Code Type Object Library Job Time
639 J PR QPADEV0003 7:00:04

and obviously the query does not bring in any results...

any ideas what I'm missing or could look at here?

thanks

Jay

On Tue, May 28, 2024 at 3:05 PM Jay Vaughn <jeffersonvaughn@xxxxxxxxx>
wrote:

Rob, yes... I like this better than the exit program approach.

thank you for this!

thanks

Jay

On Tue, May 28, 2024 at 2:48 PM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

added the where clause
SELECT
entry_timestamp, user_name, qualified_job_name, program_name,
Program_library, remote_address, t.*
FROM TABLE (
SYSTOOLS.AUDIT_JOURNAL_CD (STARTING_TIMESTAMP *=>* *timestamp*(
'2024-05-28-14.28.23'))
) t
WHERE OBJECT_LIBRARY = 'QSYS' AND
OBJECT_NAME LIKE 'STRDBG' ;
Works like a champ. No programming needed.

On Tue, May 28, 2024 at 2:43 PM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

CHGOBJAUD OBJ(QSYS/STRDBG) OBJTYPE(*CMD) OBJAUD(*ALL)
STRDBG
ENDDBG
DSPJRN JRN(QAUDJRN) FROMTIME(052824 1427) JOB(ROBS1)

Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : CD - Command string

Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 05/28/24
Time . . . . . . . . : 14:28:24.063808
Flag . . . . . . . . : 0
Count/RRN . . . . . : 0
Commit cycle ID . . : 0
Nested commit level : 0
Job . . . . . . . . : 569238/ROB/ROBS1
User profile . . . . : ROB
Program . . . . . . : QCMD
Library . . . . . : QSYS

SELECT
entry_timestamp, user_name, qualified_job_name, program_name,

Program_library, remote_address, t.*

FROM TABLE (
SYSTOOLS.AUDIT_JOURNAL_CD (STARTING_TIMESTAMP *=>* *timestamp*(
'2024-05-28-14.28.23'))
) t;
2024-05-28 14:28:24.063808 ROB 569238/ROB/ROBS1 QCMD QSYS 10.14.8.56

On Tue, May 28, 2024 at 2:22 PM Jay Vaughn <jeffersonvaughn@xxxxxxxxx>
wrote:

Thx Richard, but only until the dev's catch on and start doing
qsys/strdbg.

thanks

Jay

On Tue, May 28, 2024 at 1:12 PM Richard Schoen <

richard@xxxxxxxxxxxxxxxxx

wrote:

This might be a hammer approach, but I did this with the SIGNOFF

command a

looong time ago.

Create your own wrapper version of STRDBG and put in place ahead of

QSYS

in the library list, but have it call the STRDBG from QSYS.

Then you could create your own log every time STRDBG gets called.

That could probably work for the green screen, but not sure where

else

you

need to call STRDBG from.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx

----------------------------------------------------------------------

message: 1
date: Tue, 28 May 2024 08:33:21 -0400
from: Jay Vaughn <jeffersonvaughn@xxxxxxxxx>
subject: Re: Detecting when a user invoked strdbg

thank you vern - the exit points came to mind after I had sent

this...

what you sent is very helpful.

thanks

Jay

On Mon, May 27, 2024 at 7:27?PM Vern Hamberg via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

Hi Jay

I believe you can use one of the CL command exit points. Here is a
link that shows how to block use of a command, you can use it to

log

users, since part of the example is getting the user -

https://www.ibm.com/support/pages/how-block-cl-command-uses-qibmqcachg

command-exit-point

HTH
Vern

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.