Monitoring QSECOFR What's the best practice in tracking activity QSECOFR has on V4 OS/400s, and is it different on V5 OS/400 systems?
The best way to monitor QSECOFR is through the audit journal. You could run queries to find any objects created or deleted (*CREATE and *DELETE must be specified in the QAUDLVL system value to generate these) by QSECOFR. You can also monitor all of the CL commands this profile enters by running the Change User Auditing (CHGUSRAUD) specifying *CMD for the User action auditing parameter. A couple of other activities that you might find useful are the invalid sign on attempts for the QSECOFR profile -- *SECURITY must be specified in the QAUDLVL parameter to log this activity –- and the programs and service programs that adopt QSECOFR. You can find these by running the Display Program Adopt (DSPPGMADP) command. These techniques can be used on either V4 or V5 systems.
Dig Deeper on iSeries system performance and monitoring
Before changing password levels and upgrading operating systems on the AS/400, ensure the clients connecting to the NetServer do not need the old ...
When error messages arise concerning attempts to use a permanent system object without authority, find the source of the issue by looking for an AF ...
The UPPWEI field corresponds to the password expiration interval field, and its values "0" and "-1" represent the *SYSVAL and *NOXMAX commands.