Manage Learn to apply best practices and optimize your operations.

Detecting copied files on the AS/400 using audit journals

Want to know if a user has copied a file from the AS/400? Use QUADJRN and look at ZC and ZR to detect changes and reads of the files.

How could I detect how, who and when if a database physical file was copied from the AS/400? Which logs could help find out?
If you had auditing enabled for the system and then object auditing turned on for a database file (i.e., had run CHGOBJAUD OBJ(YOURLIB/FILENAME) OBJTYPE(*FILE) OBJAUD(*ALL) on the file) you should be able to see a ZR (read of the file) or a ZC (change of the file) in the i5/OS audit journal QAUDJRN.

Dig Deeper on iSeries system and application security

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.