Re: who changed the file?

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Jodi Walker wrote:

>      I'm hoping that there is something I haven't yet thought of, because
>      everything else has been a dead end.  How can I identify who last
>      changed a physical file if that file is not journaled? I'm not
>      concerned with a particular record, but who last touched the file for
>      something other than input.

If you don't have journaling turned on for the file, and you don't have the
QAUDJRN turned on and the proper QAUDLVL system values set, then I can think of
no fairly accurate way to discern file level history.  You can guess, but you'll
never really know.

If I were to guess, I would look at the history log for signon and signoff times
(CPF1124 and CPF1164) over the time in question.  Then I would look at the Last
Changed Date on the file (assuming you haven't messed with it yet), and see if I
could make an educated guess.  Not a perfect scenario, and there are lots of
things that could mess with your guess, but in the absence of QSECURITY auditing
it's likely the best you can do.

When you've finished this crisis, turn Security Auditng on.  It is free, and
worth 10 times the price :)

jte

--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---