Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Monitoring QSECOFR

Security expert Carol Woodbury explains the best method for tracking activity QSECOFR has on V4 OS/400s.

Monitoring QSECOFR What's the best practice in tracking activity QSECOFR has on V4 OS/400s, and is it different on V5 OS/400 systems?
The best way to monitor QSECOFR is through the audit journal. You could run queries to find any objects created or deleted (*CREATE and *DELETE must be specified in the QAUDLVL system value to generate these) by QSECOFR. You can also monitor all of the CL commands this profile enters by running the Change User Auditing (CHGUSRAUD) specifying *CMD for the User action auditing parameter. A couple of other activities that you might find useful are the invalid sign on attempts for the QSECOFR profile -- *SECURITY must be specified in the QAUDLVL parameter to log this activity –- and the programs and service programs that adopt QSECOFR. You can find these by running the Display Program Adopt (DSPPGMADP) command. These techniques can be used on either V4 or V5 systems.

Dig Deeper on iSeries system performance and monitoring