Re: Security Audit Journal receiver

["David Morris" <David.Morris@xxxxxxxxxxxxx>]

You could just use a Receive Journal Entry (RCVJRNE) followed by a send
to your alternate system. You could write some code to sign the entries
to ensure that the utility wasn't started and stopped without detection
and that entries have not been tampered with. I would write something
like this in Java because of the sockets and encryption support. I
haven't thought it through completely but you should be able to make it
very difficult to make an undetected change to auditing assuming you log
the right events.

David Morris

>>> sanjivji@xxxxxxxxx 1/11/2005 8:34:05 PM >>>
The Audit Group in the organization is making sure that AS400 System
Admins should not have access to System Security Audit Journal
receivers hence I am looking for a product where System security audit
Journal receivers can be replicated in real time or any other method
to any Unix System ( Sun Solaris , Linux, HP anything)

We use Lakeview -Mimix product but System Security receivers cannot be
replicated in mimix.

I have heard that Lakeview has a new product called Echostream which
does replication to other systems ?

Does Anyone have opinions as how replication from AS400 to any uNix
system can be achieved ?

Thks in advance