Re: audit journaling source file member adds, updates, deletes

[G Armour <garmour400m@xxxxxxxxx>]

Well, I was specifically hoping I wouldn't have to do a CHGOBJAUD on each
source file.  Source files get created, get deleted, etc, and I want to
track all source files on the system, regardless of who creates them or
when they are created.  However, if that is the only way, will the
following scenario work?

Let's say I have an initial step where I do a CHGOBJAUD on every source
file known on the system.  I can interrogate the QADBXREF file to do this,
since it tells whether a file is a source or data file.

What if, immediately after that first step, I start a RCVJRNE on the
QDBJRN journal, which journals the QADBXREF file, and I look for source
files being created or deleted.  When one is created, I could immediately
issue a CHGOBJAUD on it.  (What happens when a file being audited is
deleted?  Anything bad happen?  Should I issue a CHGOBJAUD OBJAUD(*NONE)
on it?)

And, assuming all of the above is viable, what happens if I have 1000
source files that I've started auditing?  I'm asking this question as it
pertains to the limit on the number of objects that can be audited.  I
don't really see where auditing source member adds, updates, and deletes
is going to impact system performance.  But someone may educate me
otherwise.

Is it possible to easily list all objects that are being audited?

BTW, do I want to use OBJAUD(*CHANGE) on the CHGOBJAUD command?

I'll see the wisdom of asking this on Friday afternoon.  <g>

TIA, GA

--- Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> Use the QAUDCTL *OBJAUD setting (can be mixed with *AUDLVL), then use 
> CHGOBJAUD on the source physicals only.
> 
> HTH
> 
> Vern
> 
> At 12:19 PM 9/12/2003 -0700, you wrote:
> >We are currently using audit journaling:
> >   QAUDCTL = *AUDLVL
> >   QAUDLVL = *AUTFAIL, *CREATE, *DELETE, *OBJMGT, *SAVRST, *SECURITY,
> >*PGMFAIL
> >
> >I would like to be able to audit ALL source files (PF-SRC) on the
> system,
> >specifically whenever a source member is created, updated, or deleted.
> >
> >I would prefer to not have to audit every file of all types (PF-DTA,
> LF)
> >on the system, just the source files.
> >
> >Advice, ideas, suggestions welcomed!
> >
> >GA


__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com