Re: change system values log

[Vernon Hamberg <vhamberg@xxxxxxxxxxx>]

Perhaps have a job that runs at the end of every day, it does a 
DSPLOG for the messages about changing system values, and then store 
the date/time somewhere for the next time. If there's a changed 
value, send a message or email to the right person. No need to fight 
with audit journals, which is not all that bad, but this is easier.

At 08:57 AM 4/12/2008, you wrote:

> There are logs, but we only keep ours a few weeks to a few months, for the
> purpose of identifying problems, fixing them, forgetting them.
>
> The data in DSPLOG and various message queues can be extracted via
> software, which we do, to focus on certain events of greater interest, like:
> * files filling up
> * latest security no nos
> * business rules got changed
> * IBM tax struck again
> * pattern of alleged power outages
> * some hardware gone flakey
>
> Check your GO CLEANUP options ... how long are you keeping what logs.
> Check your security settings ... who is even authorized to change system
> values, and how often do you change the passwords for security officers?
> Do you have security auditing running?  What are you capturing there & how
> far back does it go?
>
> There's also 3rd party stuff that can help you, but only if you had it
> installed 3 months ago.
>
> Do you use generic security officer sign-ons that are known to several people?
> In that case, maybe the security logs will show that the master security
> officer was used to update the stuff.  If you still had the regular system
> logs for that time frame you could then see that from a particular 
> workstation:
> * JOE SHMOE was signed on until 11.30 am
> * The master security officer signed on for 10 minutes to change the system
> values
> * JOE SHMOE then signed on again to use that workstation
>
> That would tell you to talk with JOE SHMOE.
> But that's only if you keep your logs that long.
>
> You might also check what goes on your backups & if you have a backup tape
> that might contain the logs from that time frame.
>
> >Hi Guys: is there any way to know who change a system value. Is there
> >any logs??? Some guy here change a system value 3 months ago and we want
> >to know who did it.
> >
> >Thanks in advance
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.