[IBS Home] [Up] [Audit Journal] [Setup Auditing] [Spool Control]
|
|
|
http://www.code400.com/forum/showthread.php?t=1564 Turning on Security Auditing
PHP Code:
Place the journal receiver in a library that is saved regularly. Choose a journal receiver name that can be used to create a naming convention for future journal receivers, such as AUDRCV0001. You can use the *GEN option when you change journal receivers to continue the naming convention. Using this type of naming convention is also useful if you choose to have the system manage changing your journal receivers. Specify a receiver threshold appropriate to your system size and activity. The size you choose should be based on the number of transactions on your system and the number of actions you choose to audit. If you use system change-journal management support, the journal receiver threshold must be at least 5,000KB. For more information on journal receiver threshold refer to the Backup and Recovery book. Specify *EXCLUDE on the AUT parameter to limit access to the information stored in the journal. 2. Create the QSYS/QAUDJRN journal by using the Create Journal (CRTJRN) command:
PHP Code:
Specify the name of the journal receiver you created in the previous step. Specify *EXCLUDE on the AUT parameter to limit access to the information stored in the journal. You must have authority to add objects to QSYS to create the journal. Use the Manage receiver (MNGRCV) parameter to have the system change the journal receiver and attach a new one when the attached receiver exceeds the threshold specified when the journal receiver was created. If you choose this option, you do not have to use the CHGJRN command to detach receivers and create and attach new receivers manually. Do not have the system delete detached receivers. Specify DLTRCV(*NO), which is the default. The QAUDJRN receivers are your security audit trail. Ensure that they are adequately saved before deleting them from the system. The Backup and Recovery book provides more information about working with journals and journal receivers. 3. Set the audit level (QAUDLVL) system value using the WRKSYSVAL command. The QAUDLVL system value determines which actions are logged to the audit journal for all users on the system. For purposes of auditing in preparation for moving to security level 40, the system value QAUDLVL should contain audit value *PGMFAIL. Steps 4 through 8 do not concern us for this document, but it is suggested that you read the whole chapter to be familiar with security auditing. 9. Start auditing by setting the QAUDCTL system value to a value other than *NONE. The QSYS/QAUDJRN journal must exist before you can change the QAUDCTL system value to a value other than *NONE. When you start auditing, the system attempts to write a record to the audit journal. If the attempt is not successful, you receive a message and auditing does not start. The QAUDCTL system value needs to be set to *AUDLVL to use the *PGMFAIL value in the QAUDLVL system value. Once you set that, the system begins logging security. Reading the Security Journal There are several ways to read the security journal. This section will describe looking at it interactively. The next section will describe creating a report using Query. To look at the security journal, use the Display Journal command: DSPJRN JRN(QSYS/QAUDJRN) ENTTYP(AF) QSYS/QAUDJRN is the security journal, and AF journal types are Authority Failure records. *PGMFAIL audit entries are recorded as AF journal entries. This command will produce a screen like this:
Quote:
This is a list of audit journal entries. Putting a 5 (Display) next to the last entry presents the following screen:
Quote:
Looking in Appendix F of the Security Reference manual, there is a description of the "AF" entry. It says the first character is the type of violation, in this case D which means "Use of unsupported interface, object Domain failure." The object that was being accessed is next, QSPWRKF from library QSYS, a program. Then the job, name QPADEV0009, user TROLL, job number 103522. (I know from experience that we do not need the rest of the information.) Pressing F10 gives the journal entry details, which looks like this:
Quote:
created. If we look for this job, we should see what was happening at that time. Get a copy of the job log. In this case the job log looks like this. (Note: The columns have been compressed to better fit on the paper.)
Quote:
out that this is just a duplicate of the WRKSPLF command, created to be easier to type. This command was initially created with the command:
PHP Code:
Since the command processing program that this command calls is the IBM program QSPWRKF and is a *SYSTEM domain program, the command causes the AF audit record to be issued, and would cause the command to fail if the system went to security level 40. If you check table 2-3 in the Security Reference Manual, this falls under the case of an IBM-supplied command that was changed to run a different program, then changed back to run the original program. (Although WS has a different name, the CRTDUPOBJ command duplicated it in such a way that the system considered it an IBM command.) If you look at the command (DSPCMD) before such a change you will see that the " State used to call program" attribute is set to *SYSTEM. After the change the state has changed to *USER. A *user state command can't call a system domain object at security level 40. |
|
