× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Ed -
The program uses SNDJRNE to write a user-defined journal entry (type LC) to
QAUDJRN, it does not write a "CD" audit record at all. Command auditing is
turned on by
(1) using the AUDLVL parm of RTVUSRPRF to get the current audit level
(2) calling QSYSGETPH to get the profile handle
(3) changing the audit level of the profile with CHGUSRAUD
(4) calling QWTSETP to set the handle
(5) calling QSYRLSPH to release the handle.

So I'm looking for the audited commands in QAUDJRN. I find any commands
entered from the QCMD command line but none entered after a command with
it's own command line (WRKACTJOB) until the user returns to QCMD via
F3/F12/etc.

Thanks,
Steve

"Ed Fishel" <edfishel@xxxxxxxxxx> wrote in message
news:mailman.1072.1209733290.26483.security400@xxxxxxxxxxxxxxx

I have placed commands on an external message queue and then run them by
calling QCMD. I can also explain why that trick does not work for command
lines like the one on WRKACTJOB. What I can't explain is why the LOGCMD
program does this. Using an external message queue would not help the
auditing of the commands to the security audit journal. Are you sure that
a
CD (Command String) audit record is written to the security audit journal
for every command written under LOGCMD except for the ones entered on
other
commands lines than QCMD? That does not make any sense. Once command
auditing is on for a user, every command they enter should be audited.
Even
commands from within CL programs they use will be audited, but sometimes
not all command parameters will be placed in the audit journal. Is it
possible that you are looking for the audited commands in the external
message queue instead of the security audit journal?



As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2022 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.