IBM Support

Auditing Changes to the System Reply List

Question & Answer


Question

How do you audit changes to the System Reply List?

Answer

The Systems Management Change auditing value tracks changes to the System Reply List.  
Steps
 
First, verify that the QAUDJRN journal exists and that you are tracking for Systems Management Change *SYSMGT. Use the DSPSECAUD command and make sure the following settings are configured on your system:
  
  Security journal QAUDJRN exists . . . . . :  YES    
Current QAUDCTL system value  . . . . . . :  *AUDLVL                                                        
Current QAUDLVL system value  . . . . . . :  *SYSMGT
 
If not listed, use the CHGSECAUD command to add them to your system.  The value *SYSMGT for the QAUDLVL system value is required to audit the changes to the System Reply List.  
Analyzing the Results.   
 
Method 1 for releases  7.4, 7.5:
 
NOTE:  This SQL sample uses the AUDIT_JOURNAL_SM table function only available on Releases 7.4 and 7.5.  For older releases, use Method 2. 
NOTE 2: The SQL table function is available with the following PTFs:
  • R750:  SF99950 Level 2
  • R740:  SF99704 Level 23
 
Step 1:  Using the Run SQL Scripts tool, run the following SQL Statement:
SELECT ENTRY_TIMESTAMP,
       USER_NAME,
       JOB_NAME,
       JOB_USER,
       JOB_NUMBER,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       ACCESS_TYPE,
       REPLY_SEQUENCE_NUMBER,
       REPLY_MESSAGE_ID
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_SM(STARTING_TIMESTAMP => CURRENT TIMESTAMP - 15 DAY)  -- Adjust the time range period
        )
    WHERE ENTRY_TYPE = 'S';
image-20240206075001-1
NOTE: Modify the CURRENT TIMESTAMP to specify the number of days to included in the report.


 
Method 2 for older releases. 
 
Step 1: 
 
Create a file with the contents of SM (Systems Management Change) Operations:
  
CPYAUDJRNE ENTTYP(SM) OUTFILE(QGPL/QAUDIT) JRNRCV(*CURCHAIN) FROMTIME(020624 070000) TOTIME(020624 090000)
NOTE:  Adjust the Time and Date.
NOTE 2: Replace QPGL with the name of the library where the file QAUDITSM is created.
 
Step 2:  
 
Using the STRSQL command, run the following SQL Statement:
SELECT SMTSTP,
       SMJOB,
       SMUSER,
       SMNBR,
       SMETYP,
       SMATYP,
       SMSNUM,
       SMMSID
    FROM qgpl/qauditsm
image-20240206075609-2
For more information on the Access Type, refer to the Security Reference Manual: 

[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.2.0;7.3.0;7.4.0;7.5.0"}]

Document Information

Modified date:
06 February 2024

UID

ibm17115234

Page Feedback