Re: QAUDJRN and QAUDLVL

[bdietz400@xxxxxxxxx]

using the DSPSECAUD command verify you are not auditing QTEMP  
AUDCTL(*NOQTEMP)

the next thing will be to see what you are capturing.

here is a "quick" way to see the count of the captured journal types (pick  
the dates you wish to use)

DSPJRN JRN(QAUDJRN) RCVRNG(*CURCHAIN) FROMTIME(111610 000001)
TOTIME(111610 235959) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE1)
OUTFILE(QTEMP/TYPE1)
<sql>
SELECT DISTINCT joentt, count(*) as t FROM qtemp/type1
group by joentt order by t desc


Bryan


On Nov 17, 2010 2:53pm, Ryan Hunt <ryan.hunt@xxxxxxxxxxxxx> wrote:
> We recently moved from a V5R4 server to a V6R1 server. As part of my

> security monitoring we audit *AUTFAIL and *SECURITY (QAUDLVL) to the  
> QAUDJRN

> journal. I don't have my old server anymore so I can't confirm this for

> sure, but I'm pretty sure my setup for V5R4 was exactly the same.



> I'm finding that while my V5R4 server kicked out a 100MB journal receiver

> every 2 or 3 days, my V6R1 server is kicking out a 1.5GB file every single

> day.



> Has anyone else seen this behavior?







> --

> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing  
> list

> To post a message email: MIDRANGE-L@xxxxxxxxxxxx

> To subscribe, unsubscribe, or change list options,

> visit: http://lists.midrange.com/mailman/listinfo/midrange-l

> or email: MIDRANGE-L-request@xxxxxxxxxxxx

> Before posting, please take a moment to review the archives

> at http://archive.midrange.com/midrange-l.