RE: Special authority use ... Auditing

["Graap, Ken" <keg@xxxxxxxxxxxxx>]

Wow Pat.... That's a lot of work <smile> ... Wouldn't it be nice if an
entry was deposited to the audit journal every time a function or object
access was allowed because of Special Authority? A new QAUDLVL system
value option, *SPCAUT... Hmmmmm .... I like it!

Kenneth  

  

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Patrick Botz
Sent: Thursday, March 23, 2006 8:17 PM
To: Midrange Systems Technical Discussion
Subject: Re: Special authority use ... Auditing

Search the Security Reference Manual Appendix D (I could be wrong about
which appendix).  This will tell you the authority (and special
authority)
required by all commands.  Find all of the commands that require
*SAVSYS.
Then run one of the user profile commands in the security toolkit to
find
all user profiles with *SAVSYS special authority.

This should give you the same information as trying to audit/og when a
command that required *SAVSYS special authority was run.

Alternatively, you could turn command auditing on for a set of users and
selct the entries from the audit journal that matched the list of
commands
defined in the sec ref manual appendix.