IBM Support

How to track when a user presses the ESC key (Attention key)

How To


Summary

This document discusses how to set up auditing to track what users are pressing the ESC (Attention) key.

Steps

This document assumes that security auditing is already configured.  If security auditing is not configured, follow the instructions in this document:
  • System value QAUDCTL needs to contain *OBJAUD.
Display system value QATNPGM using command DSPSYSVAL QATNPGM.
  • if the value is set to *ASSIST, you want to audit program QEZMAIN in library QSYS
  • if the value is set to something else, you want to audit the program and library listed
To turn on object auditing for the program in system value QATNPGM, run one of these commands:
  • If *ASSIST was the value: CHGOBJAUD OBJ(QSYS/QEZMAIN) OBJTYPE(*PGM) OBJAUD(*ALL)
  • If a program was the value:  CHGOBJAUD OBJ(library/program) OBJTYPE(*PGM) OBJAUD(*ALL)        
With object auditing turned on for the program, when a user presses the ESC key, a ZR auditing entry is posted.
Extracting the ZR report 
To view the ZR entries, we will use table QSYS2.DISPLAY_JOURNAL.  Run the following SQL statement:
SELECT JOURNAL_ENTRY_TYPE,
       OBJECT,
       ENTRY_TIMESTAMP,
       JOB_NAME,
       JOB_USER,
       JOB_NUMBER
    FROM TABLE (
            QSYS2.DISPLAY_JOURNAL(
                JOURNAL_LIBRARY => 'QSYS',
                JOURNAL_NAME => 'QAUDJRN',
                STARTING_RECEIVER_NAME => '*CURCHAIN', JOURNAL_ENTRY_TYPES => 'ZR', STARTING_TIMESTAMP => '2021-10-25 20:00:00',
                ENDING_TIMESTAMP => '2021-10-25 22:45:00')
        )
    WHERE OBJECT LIKE 'QEZMAIN%'
  • Replace the STARTING_TIMESTAMP and ENDING_TIMESTAMP to contain the timeframe you want to look at
  • Replace the program name in OBJECT LIKE with the attention program you wanted to look at (If *ASSIST is set, set this to QEZMAIN%)
Running the SQL through ACS->Run SQL Scripts, the results look like this:
image 11893

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB57","label":"Power"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions"}]

Document Information

Modified date:
26 October 2021

UID

ibm16508734

Page Feedback