Re: Wayne Evans' LOGCMD

Ed -
The program uses SNDJRNE to write a user-defined journal entry (type LC) to
QAUDJRN, it does not write a "CD" audit record at all. Command auditing is
turned on by
(1) using the AUDLVL parm of RTVUSRPRF to get the current audit level
(2) calling QSYSGETPH to get the profile handle
(3) changing the audit level of the profile with CHGUSRAUD
(4) calling QWTSETP to set the handle
(5) calling QSYRLSPH to release the handle.

So I'm looking for the audited commands in QAUDJRN. I find any commands
entered from the QCMD command line but none entered after a command with
it's own command line (WRKACTJOB) until the user returns to QCMD via
F3/F12/etc.

Thanks,
Steve

"Ed Fishel" <edfishel@xxxxxxxxxx> wrote in message
news:mailman.1072.1209733290.26483.security400@xxxxxxxxxxxxxxx

I have placed commands on an external message queue and then run them by
calling QCMD. I can also explain why that trick does not work for command
lines like the one on WRKACTJOB. What I can't explain is why the LOGCMD
program does this. Using an external message queue would not help the
auditing of the commands to the security audit journal. Are you sure that
a
CD (Command String) audit record is written to the security audit journal
for every command written under LOGCMD except for the ones entered on
other
commands lines than QCMD? That does not make any sense. Once command
auditing is on for a user, every command they enter should be audited.
Even
commands from within CL programs they use will be audited, but sometimes
not all command parameters will be placed in the audit journal. Is it
possible that you are looking for the audited commands in the external
message queue instead of the security audit journal?