RE: STRSQL audit log

["Elvis Budimlic" <ebudimlic@xxxxxxxxxxxxxxxxxxxxxxxxx>]

> I expect the correct way to go is to use the appropriate exit point -
> QIBM_QZDA_SQL1 & QIBM_QZDA_SQL2 look to be likely candidates and log
> all SQL access.

These 2 exit points cover ODBC/JDBC (Open Toolbox driver) interfaces, not
STRSQL command.

We have added this type of logging for STRSQL into one of our tools
(Centerfield) based on a request from one of our customers, but in the end
they decided against using it :)
For good reasons obviously... do you plug the holes in a dam one finger at a
time or use a better, over-encompassing approach like journaling?

That said, I've seen people do really crazy things many, many times, simply
so they can check something off on the auditor's checklist and move on to
running their business.
We always advise customers on the 'right' approach, but they often don't
have time, resources or desire to do it the 'right' way, and simple fix will
do.

HTH, Elvis

Celebrating 11-Years of SQL Performance Excellence on IBM i, i5/OS and
OS/400
www.centerfieldtechnology.com