RE: QAUDJRN and QAUDLVL

["Graap, Kenneth" <Kenneth.Graap@xxxxxxxxxxxxx>]

Do you have an idea of what kind of entries are being deposited into the Audit Journal ?

For example .... Here is what is being put into mine over the last few hours....

Code  Type               Count

  J    PR                    1       ID for previous journal receiver
  T    AD                    4
  T    AF                    3
  T    AP                  258
  T    CA               32,836
  T    CD               94,764
  T    CO                7,120
  T    DI                   16       Directory services
  T    DO                7,152
  T    GR                   14
  T    GS                  585
  T    IP                5,044
  T    JS               71,450
  T    LD                6,769
  T    OM                  596
  T    OW                  439
  T    PG                    3
  T    PO                   90
  T    PS                1,483
  T    SF                1,171
  T    SG                  425       Asynchronous signals
  T    SM                    8
  T    ST                    1
  T    VO                    8
  T    ZC                  541
  U    EN                    1       User defined
  U    NA              500,896       User defined
  U    TA                1,988       User defined

                       733,666 


Kenneth
Kenneth E. Graap
http://www.linkedin.com/in/kennethgraap
 

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Ryan Hunt
Sent: Wednesday, November 17, 2010 11:53 AM
To: midrange-l@xxxxxxxxxxxx
Subject: QAUDJRN and QAUDLVL

We recently moved from a V5R4 server to a V6R1 server.  As part of my
security monitoring we audit *AUTFAIL and *SECURITY (QAUDLVL) to the QAUDJRN
journal. I don't have my old server anymore so I can't confirm this for
sure, but I'm pretty sure my setup for V5R4 was exactly the same.

I'm finding that while my V5R4 server kicked out a 100MB journal receiver
every 2 or 3 days, my V6R1 server is kicking out a 1.5GB file every single
day.

Has anyone else seen this behavior?