Re: Wayne Evans' LOGCMD

Ed -
The program uses SNDJRNE to write a user-defined journal entry (type LC) to 
QAUDJRN, it does not write a "CD" audit record at all.  Command auditing is 
turned on by
(1) using the AUDLVL parm of RTVUSRPRF to get the current audit level
(2) calling QSYSGETPH to get the profile handle
(3) changing the audit level of the profile with CHGUSRAUD
(4) calling QWTSETP to set the handle
(5) calling QSYRLSPH to release the handle.

So I'm looking for the audited commands in QAUDJRN.  I find any commands 
entered from the QCMD command line but none entered after a command with 
it's own command line (WRKACTJOB) until the user returns to QCMD via 
F3/F12/etc.

Thanks,
Steve

"Ed Fishel" <edfishel-r/[email protected]> wrote in message 
news:mailman.1072.1209733290.26483.security400-Zwy7GipZuJitq2lpoERdew@public.gmane.org
>
> I have placed commands on an external message queue and then run them by
> calling QCMD. I can also explain why that trick does not work for command
> lines like the one on WRKACTJOB.  What I can't explain is why the LOGCMD
> program does this. Using an external message queue would not help the
> auditing of the commands to the security audit journal. Are you sure that 
> a
> CD (Command String) audit record is written to the security audit journal
> for every command written under LOGCMD except for the ones entered on 
> other
> commands lines than QCMD?  That does not make any sense. Once command
> auditing is on for a user, every command they enter should be audited. 
> Even
> commands from within CL programs they use will be audited, but sometimes
> not all command parameters will be placed in the audit journal. Is it
> possible that you are looking for the audited commands in the external
> message queue instead of the security audit journal?


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.