|
Ok, I realize I had several characters in there. Let me cut it down.
<snip>
I want a report of all programs and commands called. Including system
commands.
</snip>
To get such a list requires that you start object auditing on every thing
you want in the list. See CHGOBJAUD.
Then you have to get the appropriate entries. See CPYAUDJRNE. I suggest
doing the *ALL once. This helped me limit it down to the ZR entries.
If you just want one particular step, like all the stack used when someone
executes a particular program, then you could try TRCJOB.
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: Gord Hutchinson <gordm1@xxxxxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 03/28/2017 11:50 AM
Subject: Re: Auditing Program Calls
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
I do not really care what programs or commands were. The point is not
what
was called but the fact that something was called. I want a report of all
programs and commands called. Including system commands.
On Tue, Mar 28, 2017 at 11:24 AM, Rob Berendt <rob@xxxxxxxxx> wrote:
ZR (Read of Object) journal entriescalled
Let me step through this
GORD1
PGM
CALL GORD2
SNDMSG MSG(GORD1) TOUSR(*REQUESTER)
ENDPGM
GORD2
PGM
SNDMSG MSG(GORD2) TOUSR(*REQUESTER)
ENDPGM
CHGOBJAUD OBJ(ROB/GORD*) OBJTYPE(*PGM) OBJAUD(*ALL)
CALL GORD1
QSYS/CPYAUDJRNE ENTTYP(ZR)
FROMTIME(032817 1113)
TOTIME(032817 1116)
WRKF QTEMP/QAUDIT*
QAUDITZR
RUNQRY QRYFILE(QTEMP/QAUDITZR)
Object Library Object
name name type
GORD1 ROB *PGM
GORD2 ROB *PGM
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: Gord Hutchinson <gordm1@xxxxxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 03/28/2017 10:58 AM
Subject: Re: Auditing Program Calls
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
I did RTM! A CD is written to the audit journal when a program is
from a command line.<midrange-l@xxxxxxxxxxxx>
The same command string when executed within a CL program does NOT write
the CD entry.
On Tue, Mar 28, 2017 at 10:52 AM, Rob Berendt <rob@xxxxxxxxx> wrote:
RTM
https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/
rzaki/rzakijournalfinderall2.htm
A CD entry is "change was made for a command string".
Try CHGOBJAUD
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: Gord Hutchinson <gordm1@xxxxxxxxxxxxxxx>
To: Midrange Systems Technical Discussion
onDate: 03/28/2017 10:39 AM
Subject: Auditing Program Calls
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
I've been trying to report on the commands and programs a user calls
aourthe
7.1 systems. *CMD auditing is turned on for the users in question.
When a program is called from the command line I see the CD entry for
CALL in QAUDJRN. If that program calls a second program, I do not see
commandsecond CD entry. If the program calls a command, the CD for the
CDis
QAUDJRN.
i.e. CALL PGMA writes a CD entry for the call.
If PGMA does a call to PGMB and then calls cmd DSPSYSSTS there is no
listentry for the call of PGMB but there is one for DSPSYSSTS.list
Is this expected behaviour or am I missing a setting somewhere?
Thanks,
Gord
--
Gord Hutchinson
TST Overland Express
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
Gord Hutchinson
TST Overland Express
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
Gord Hutchinson
TST Overland Express
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
