Is it possible to auditor non single the accesses to objects, but at the level of registry acceded within those objects? And if it is possible, what options must I activate?
If I understand your question correctly, you are looking to have some automatic notification when an object is being accessed more than xx times. If this is correct, there are no OS/400 tools that will do this. However, some of the third-party message management products also look at the security audit journal. You could configure OS/400 to log all accesses - both reads and changes - to a particular object by using the Change Object Audit (CHGOBJAUT) command. When the object is accessed, an audit journal entry is sent. Within these products you can define an "event". An example of an event would be defined as object xyz is accessed 15 times within 30 minutes. If that event occurs, the product notifies you or takes some action. Most of these products allow several different ways of notification.
MORE INFORMATION ON THIS TOPIC
The Best Web Links: Tips, tutorials and more.
Search400.com's targeted search engine: Get relevant information on security.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Read this Search400.com Featured Topic: Secure your iSeries
Dig Deeper on iSeries CL programming
Related Q&A from Carol Woodbury
Before changing password levels and upgrading operating systems on the AS/400, ensure the clients connecting to the NetServer do not need the old ... Continue Reading
Look in the audit journal (QAUDJRN) on the AS/400 for an authority failure message with the name of the library as the object name. Use the ... Continue Reading
The UPPWEI field corresponds to the password expiration interval field, and its values "0" and "-1" represent the *SYSVAL and *NOXMAX commands. Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.