We've recently had a couple of instances where the QSYSOPR message queue has been cleared. Apart from restricting the CLRMSGQ command, is there a way we can protect it?
There are a couple of ways to prevent users from clearing a message queue. As you suggested, restrict the user's authority to the command. Another way would be to restrict the user's authority to the message queue. In order to clear a message queue or remove a message from the message queue, the user needs delete authority to that message queue. So, in your case, you may want to remove *DLT authority to the *MSGQ, for the users in question. This will allow them to use the message queue in other ways but will prevent them from clearing the message queue. The authorities required for these commands are documented in Appendix D of the Security Reference, SC41-5302.
MORE INFORMATION ON THIS TOPIC
The Best Web Links: Tips, tutorials and more.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Read this Search400.com Featured Topic: Managing your iSeries.
Ask the Experts yourself: Our systems management gurus are waiting to answer your technical questions.