Re: audit journaling source file member adds, updates, deletes

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>]

I recommend RCVJRNE on QAUDJRN, not QDBJRN - I don't like messing with 
those cross-reference files. if you have some kind of object replication 
software, watch out for this, as they may need the entry to stay in the 
audit journal.

No problem deleting an object with auditing turned on - all it is is a flag 
that is checked at tevery access to the object anyway - that's why there is 
minimal impact on the system, as you believe. The check is always done - 
extra overhead comes from writing the journal record, if needed.

Don't interrogate QADBXREF - run DSPFD *ALL/*ALL fileatr(*pf) 
output(*outfile) and query the outfile - again, stay away from the system 
database cross-reference - the system is always touching that stuff.

BTW, I'm curious about your 1000 limit - I could not find that in the 
Capacities Reference.

HTH

Vern

At 01:01 PM 9/12/2003 -0700, you wrote:
> Well, I was specifically hoping I wouldn't have to do a CHGOBJAUD on each
> source file.  Source files get created, get deleted, etc, and I want to
> track all source files on the system, regardless of who creates them or
> when they are created.  However, if that is the only way, will the
> following scenario work?
>
> Let's say I have an initial step where I do a CHGOBJAUD on every source
> file known on the system.  I can interrogate the QADBXREF file to do this,
> since it tells whether a file is a source or data file.
>
> What if, immediately after that first step, I start a RCVJRNE on the
> QDBJRN journal, which journals the QADBXREF file, and I look for source
> files being created or deleted.  When one is created, I could immediately
> issue a CHGOBJAUD on it.  (What happens when a file being audited is
> deleted?  Anything bad happen?  Should I issue a CHGOBJAUD OBJAUD(*NONE)
> on it?)
>
> And, assuming all of the above is viable, what happens if I have 1000
> source files that I've started auditing?  I'm asking this question as it
> pertains to the limit on the number of objects that can be audited.  I
> don't really see where auditing source member adds, updates, and deletes
> is going to impact system performance.  But someone may educate me
> otherwise.
>
> Is it possible to easily list all objects that are being audited?
>
> BTW, do I want to use OBJAUD(*CHANGE) on the CHGOBJAUD command?
>
> I'll see the wisdom of asking this on Friday afternoon.  <g>
>
> TIA, GA