Re: IFS Audit (already journaled by iTera)

[Ed Fishel <edfishel@xxxxxxxxxx>]

Peter Vidal wrote on 04/17/2007 02:24:55 PM:

> How can I read journaled data from activities done over a folder (and its

> subfolders) in the IFS?  This is currently monitored by an iTera journal
> but I do not know how to take advantage of it.  iTera support can't tell
> how to read this for me and I can use a couple of IFS tools to do this
but
> I can't use them because this iTera journal is in place and I can't
remove
> it.  It is part of the High Availability feature of iTera.

If you want to audit the security changes to your directories and stream
files you should be using the security audit journal. You should be able to
use the security audit journal even if an iTera journal is being used for
the same directories.

I do not know anything about the iTera product  or their journal, but my
guess is that it is just a normal journal that is being used to journal
changes to a directory instead of a physical file. The iTera product
probably uses normal command or API interfaces to access the data in the
journal.  So, you should be careful to not do anything that could cause the
iTera product to miss some of the entries in the journal. Since you do not
know the current, or future, internal working of the product, it would
probably be safest for you to not read any entries from this journal. I am
sure that you do not want your actions to cause extra locks that could
cause the high availability product to delay or even miss some operations.

If you are looking for a description of what the audit entries for a
directory look like you can find information by going here
http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rzaki/rzakifinder.htm
  and then selecting "Journal Code B - Integrated file system" from the
first drop down list and clicking on the related GO button.

Ed Fishel,
edfishel@xxxxxxxxxx