The auditing could be made to be very specific, and that could limit
the amount of data produced. However not knowing what the users are
claiming not to have done, I can see the concern, because the targeting
of the auditing to specific actions\object would not be possible except
perhaps when there is an attempt to verify any _specific_ assumption
about what they may be doing that gives origin to some difficulty.
FWiW I actually almost never signed off, always using DSCJOB instead.
There is the possibility if the environment allows [named devices], to
use the change command API to insert a Disconnect Job request before
forcing the SIGNOFF LOG(*LIST) if the disconnect request ends with
CPF1358 "DSCJOB not allowed." In my experience the actual "active" job
is *way better* than just the spooled joblog in many cases. On my
systems I changed the QDSCJOBITV "Time interval before disconnected jobs
end" to 1440 or *NONE, to ensure my disconnected jobs would be there the
next day or longer.
Regards, Chuck
On 06-Jan-2012 12:05 , Jerry C. Adams wrote:
Thought about that, too. Kinda tight on disk space here, though.
<<SNIP>>
Mark Walter on Friday, January 06, 2012 1:41 PM
What sort of things are the users saying they're not doing? Audit
Journals may be more help than joblogs depending on what's
happening.
This mailing list archive is Copyright 1997-2026 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact
[javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.