[Security400] SQL and IT Controls

["Chuck Bower" <cbower@xxxxxxxxxxxx>]

Group:
 
We are attempting to wrestle with a final Sarbanes Oxley issue relating to SQL, 
specifically using STRSQL via the command line.  While STRSQL is restricted to 
those who have a business need to use it, our problem relates to the potential 
for data manipulation and changes that are not logged.  Our development staff 
can use it (but not update production data) but our security officers can of 
course use it, AND update production data.  It is NOT practical for us to 
journal all of our production data libraries.  While I do have STRSQL command 
usage logged via the OS/400 audit journal, (we know who uses it and when) it 
does not provide the log of activity within the STRSQL session.
 
Are there any tools on the market that can log the activity within the STRSQL 
session?   Any feedback you can provide would be GREATLY appreciated!
 
Chuck Bower
VP of IS
Coachmen Technology Services, Inc.