RE: [EXTERNAL]Re: Detecting when a user invoked strdbg -- MIDRANGE-L

Do you have *OBJAUD in QAUDCTL system value?

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Jay Vaughn
Sent: Wednesday, May 29, 2024 7:27 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: [EXTERNAL]Re: Detecting when a user invoked strdbg

[You don't often get email from jeffersonvaughn@xxxxxxxxx. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Rob, can't seem to get this to work...

Work with Journal Attributes

Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS

Attached receiver . : AUDRCV0001 Library . . . . . . : QGPL

Text . . . . . . . . : Auditing Journal

ASP . . . . . . . . : 1 Journaled objects:

Message queue . . . : QSYSOPR Current . . . . . : 9

Library . . . . . : *LIBL Maximum . . . . . : 250000

Manage receivers . . : *SYSTEM Recovery count . . . : *SYSDFT

Delete receivers . . : *NO Receiver size options:
*RMVINTENT
Journal cache . . . : *NO *MAXOPT2

Manage delay . . . . : 10

Delete delay . . . . : 10

Journal type . . . . : *LOCAL

Journal state . . . : *ACTIVE

Minimize entry data : *NONE

4 > CHGOBJAUD OBJ(QSYS/STRDBG) OBJTYPE(*CMD) OBJAUD(*ALL)
Object auditing value changed for STRDBG in QSYS type *CMD.

however when I do the strdbg/enddbg, nothing seems to be recorded...

Display Journal Entries

Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS
Largest sequence number on this screen . . . . . . : 00000000000000000639 Type options, press Enter.
5=Display entire entry

Opt Sequence Code Type Object Library Job Time
639 J PR QPADEV0003 7:00:04

and obviously the query does not bring in any results...

any ideas what I'm missing or could look at here?

thanks

Jay

On Tue, May 28, 2024 at 3:05 PM Jay Vaughn <jeffersonvaughn@xxxxxxxxx>
wrote:

Rob, yes... I like this better than the exit program approach.

thank you for this!

thanks

Jay

On Tue, May 28, 2024 at 2:48 PM Rob Berendt
<robertowenberendt@xxxxxxxxx>
wrote:

added the where clause
SELECT
entry_timestamp, user_name, qualified_job_name, program_name,
Program_library, remote_address, t.*
FROM TABLE (
SYSTOOLS.AUDIT_JOURNAL_CD (STARTING_TIMESTAMP *=>* *timestamp*(
'2024-05-28-14.28.23'))
) t
WHERE OBJECT_LIBRARY = 'QSYS' AND
OBJECT_NAME LIKE 'STRDBG' ;
Works like a champ. No programming needed.

On Tue, May 28, 2024 at 2:43 PM Rob Berendt
<robertowenberendt@xxxxxxxxx>
wrote:

CHGOBJAUD OBJ(QSYS/STRDBG) OBJTYPE(*CMD) OBJAUD(*ALL) STRDBG ENDDBG
DSPJRN JRN(QAUDJRN) FROMTIME(052824 1427) JOB(ROBS1)

Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : CD - Command string

Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 05/28/24
Time . . . . . . . . : 14:28:24.063808
Flag . . . . . . . . : 0
Count/RRN . . . . . : 0
Commit cycle ID . . : 0
Nested commit level : 0
Job . . . . . . . . : 569238/ROB/ROBS1
User profile . . . . : ROB
Program . . . . . . : QCMD
Library . . . . . : QSYS

SELECT
entry_timestamp, user_name, qualified_job_name, program_name,

Program_library, remote_address, t.*

FROM TABLE (
SYSTOOLS.AUDIT_JOURNAL_CD (STARTING_TIMESTAMP *=>*
*timestamp*(
'2024-05-28-14.28.23'))
) t;
2024-05-28 14:28:24.063808 ROB 569238/ROB/ROBS1 QCMD QSYS
10.14.8.56

On Tue, May 28, 2024 at 2:22 PM Jay Vaughn
<jeffersonvaughn@xxxxxxxxx>
wrote:

Thx Richard, but only until the dev's catch on and start doing
qsys/strdbg.

thanks

Jay

On Tue, May 28, 2024 at 1:12 PM Richard Schoen <

richard@xxxxxxxxxxxxxxxxx

wrote:

This might be a hammer approach, but I did this with the SIGNOFF

command a

looong time ago.

Create your own wrapper version of STRDBG and put in place ahead
of

QSYS

in the library list, but have it call the STRDBG from QSYS.

Then you could create your own log every time STRDBG gets called.

That could probably work for the green screen, but not sure
where

else

you

need to call STRDBG from.

Regards,
Richard Schoen
Web:
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%252
Fwww.richardschoen.net%2F&data=05%7C02%7Cbrentreber%40afni.com%7
C27a2690c8fb64af776b308dc7fda9ddd%7Cd80d1b57a9af40a9a35b060795e6
ce43%7C0%7C0%7C638525824208438591%7CUnknown%7CTWFpbGZsb3d8eyJWIj
oiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0
%7C%7C%7C&sdata=MmRm4xvsL6r2%2BSsQrsCLktZbVOMhXxrSbespd1Ywkow%3D
&reserved=0
Email: richard@xxxxxxxxxxxxxxxxx

---------------------------------------------------------------------
-

message: 1
date: Tue, 28 May 2024 08:33:21 -0400
from: Jay Vaughn <jeffersonvaughn@xxxxxxxxx>
subject: Re: Detecting when a user invoked strdbg

thank you vern - the exit points came to mind after I had sent

this...

what you sent is very helpful.

thanks

Jay

On Mon, May 27, 2024 at 7:27?PM Vern Hamberg via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

Hi Jay

I believe you can use one of the CL command exit points. Here
is a link that shows how to block use of a command, you can
use it to

log

users, since part of the example is getting the user -

https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2F
http://www.ibm.com/%2Fsupport%2Fpages%2Fhow-block-cl-command-uses-qibmqcac
hg&data=05%7C02%7Cbrentreber%40afni.com%7C27a2690c8fb64af776b308dc
7fda9ddd%7Cd80d1b57a9af40a9a35b060795e6ce43%7C0%7C0%7C638525824208
448294%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzI
iLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Tlus0wvrC%2FCVG
VNw%2F3PxcxevZcdtWnkuinVpscLWIFc%3D&reserved=0

command-exit-point

HTH
Vern

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%25
2Flists.midrange.com%2Fmailman%2Flistinfo%2Fmidrange-l&data=05%7
C02%7Cbrentreber%40afni.com%7C27a2690c8fb64af776b308dc7fda9ddd%7
Cd80d1b57a9af40a9a35b060795e6ce43%7C0%7C0%7C638525824208451371%7
CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBT
iI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KdxC3aN0ZDqHa8twRY5
GacuGXkEaTuVKcmJRyBjZ7o4%3D&reserved=0
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit:
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2F
lists.midrange.com%2Fmailman%2Flistinfo%2Fmidrange-l&data=05%7C02%
7Cbrentreber%40afni.com%7C27a2690c8fb64af776b308dc7fda9ddd%7Cd80d1
b57a9af40a9a35b060795e6ce43%7C0%7C0%7C638525824208457272%7CUnknown
%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWw
iLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=K0adJiYXB7pPLjZkzJDOPoALXjerPIV
tnKjncgEHExk%3D&reserved=0 or email:
MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related

questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
https://lis/
ts.midrange.com%2Fmailman%2Flistinfo%2Fmidrange-l&data=05%7C02%7Cbren
treber%40afni.com%7C27a2690c8fb64af776b308dc7fda9ddd%7Cd80d1b57a9af40
a9a35b060795e6ce43%7C0%7C0%7C638525824208463029%7CUnknown%7CTWFpbGZsb
3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D
%7C0%7C%7C%7C&sdata=J%2Btoi3n%2ByT1s4%2BLQLcMOjyAW6kiNb%2FzZelaM0xoWZ
U4%3D&reserved=0 or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.