Re: Wayne Evans' LOGCMD

Steve,

>Does someone know of a way to correct this behavior or of another
method of giving users (on-call programmers, actually) a way to respond
to 
>problems which would require *ALLOBJ authority without actually giving
them *ALLOBJ on their user profile?

We have a product that does this - with all the enhanced reporting and
notification features you'd expect from a  mature commercial product.
It also has a FireCall(R) feature that allows programmers to be
temporarily elevated, while tracking all of their activity.  

I have to agree with Ed though - the behavior you describe is very odd.
Only IBM can write T-CD entries to QAUDJRN, and once you put a user into
Command Audit mode, the system should write the entries until you do a
CHGUSRAUD command to take them back out.  I haven't seen Wayne's code
either, so my guess is that if you need to stay with that utility,
you've got some debugging to do.

jte

--
 
John Earl, VP and Chief Technology Officer
PowerTech:   253-872-7788
Direct:          253-479-1408
Mobile:          206-669-3336
John.Earl-Ua2wos9bJ7y1Z/[email protected]
 

 
 
Email is an excellent way to communicate material that is not time
sensitive.  If your communication is of a more urgent nature, please
call. 
 
===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.
 

> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] 
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Steve McKay
> Sent: Thursday, May 01, 2008 8:58 AM
> To: security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> Subject: [Security400] Wayne Evans' LOGCMD
> 
> I have a copy of Wayne Evans' LOGCMD program/command.  This 
> allows specified non-admin users to gain *ALLOBJ authority 
> and records the commands they enter to QAUDJRN by acquiring a 
> user profile handle, turning on *CMD auditing on the user 
> profile, and processing the entered commands as messages from 
> the external message queue.  This works well if the user 
> stays on the QCMD screen that is initially displayed.  If the 
> user enters some command that has it's own command line 
> (WRKACTJOB, for instance), any commands entered on that 
> command line do not get recorded in QAUDJRN.
> 
> Does someone know of a way to correct this behavior or of 
> another method of giving users (on-call programmers, 
> actually) a way to respond to problems which would require 
> *ALLOBJ authority without actually giving them *ALLOBJ on 
> their user profile?
> 
> TIA,
> 
> Steve 
> 
> 
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries 
> (Security400) mailing list To post a message email: 
> Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change 
> list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, 
> please take a moment to review the archives at 
> http://archive.midrange.com/security400.
> 
> 
> 
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.