Home > Ask the AS/400 Experts > iSeries Security Questions & Answers > Audit journal monitoring of *ALLOBJ profiles
Ask The iSeries 400 Expert: Questions & Answers
EMAIL THIS

Audit journal monitoring of *ALLOBJ profiles

Carol Woodbury EXPERT RESPONSE FROM: Carol Woodbury

Pose a Question
Other iSeries 400 Categories
Meet all iSeries 400 Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 03 February 2008
I've been trying to monitor profiles with *ALLOBJ or above authority using QHST, because QSECOFR has the authority to delete audit logs. Are there any queries or easy methods to audit *ALLOBJ or above profiles besides manually going into QHST daily and searching the spooled report to find users who I know have *ALLOBJ access? This method is not showing accurate information consistently.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
iSeries Security
Changing password security levels and upgrading operating systems on the IBM i
Determine the value of parameter UPPWEI in the DSPUSRPRF field
Define journal code value "K"
Modify content within a journal receiver file
Change password parameters on the AS/400 without deactivating user's passwords
Prevent insiders with *READ or *USE access from circumventing object authority on IBM i
Prevent insiders from obtaining user ids and passwords on the IBM i
Change the IBM i system to allow only certain types of SSL protocol versions
Authorize a specific user to select files in a separate library
Allow a user to view a library prod without granting full access to all data

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


QHST is not a reliable source. It can be deleted or cleared. The only reliable source of this type of information is the i5/OS audit journal. While entire receivers can be deleted, individual entries cannot. Even if QSECOFR was to delete an entire receiver, they are in sequence so you could tell if a receiver was missing and go look for the corresponding audit journal entry that documents the deletion.




Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



iSeries Networking - Printing, Remote Access, TCP/IP
HomeNewsTopicsITKnowledge ExchangeTipsBlogsAsk the ExpertsMultimediaWhite PapersProducts
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 1999 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts