Auditing object changes for only certain users and libraries

I want to enable auditing for only object creations, objects changed
(moved, renamed, etc.), and object deletions in only specific libraries
done by only specific users.  Here's what I did so far:
I've used CHGSECAUD command to create the QAUDJRN journal initially.
I have *AUDLVL *OBJAUD and *NOQTEMP set for QAUDCTL and *NONE for QAUDLVL.
I have set my user profile with object auditing value of *CHANGE and object
action values of *CREATE *DELETE and *OBJMGT.
I have set the specific library's default create object auditing value to
*USRPRF.
The default create object auditing value in QCRTOBJAUD is *NONE and all the
other libraries have this set to *SYSVAL.  New objects that are created are
correctly being assigned *USRPRF in their object auditing value.

I've gotten very close to get this to work, but it's not recording the
object creations--no CO entry in the journal can be found.  I have
discovered that by adding *AUDLVL on the QAUDCTL system value and adding
*CREATE *DELETE and *OBJMGT on the User Profile's action auditing values,
this will enable the CO entry to be created.  However, this will also track
audit changes that I made to objects in ANY library--it effectively ignores
the object auditing value on the objects themselves.  So then if I reset
User Profile's action auditing values back to *NONE and leave *CHANGE on
object auditing value, I will only get changes made to objects that had
*USRPRF set to its auditing value,  but I will not get the CO entry when I
use commands like CRTBNDRPG or CRTDUPOBJ.  Yes, I am signing out and back
in after I update my profile using CHGUSRAUD.

The IBM manuals have not been much help, but I can't see how this will work
the way I want it to.  Is there something I'm missing?

Thanks,

Ben Pforsich
Programmer Analyst
Bob Evans Farms, Inc.
I/S Department
Columbus, Ohio
Ben_Pforsich-xkrT/Y0LCbpWk0Htik3J/[email protected]

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.