IBM i *IOSYSCFG Audit Failures - Version 7.6

Starting with IBM i version 7.6, the audit journal behavior for *IOSYSCFG (Input/Output System Configuration) special authority failures has changed. This document explains the new audit record types and the additional authorization requirements introduced in this release.

Key Changes in Version 7.6

Audit Record Type Change

In IBM i 7.6, when a user lacks authority to perform I/O system configuration operations, the system generates GR-F (Function Usage) audit records instead of the traditional AF-K (Authority Failure) entries.

Function Usage Identifier

The relevant function usage identifier for I/O system configuration operations is:

Function ID: QIBM_IOSYSCFG_VIEW
Function Name: View Input/Output System Configuration

Authorization Requirements

Required Authority

Users must have one of the following to perform I/O system configuration operations:

1. *IOSYSCFG special authority, OR
2. Access to the QIBM_IOSYSCFG_VIEW function usage identifier

Affected Commands

Commands that require this authorization include (but are not limited to):

• WRKCFGSTS - Work with Configuration Status
• Display Configuration List (DSPCFGL) 
• Display Class-of-Service Desc (DSPCOSD) 
• Display Controller Description (DSPCTLD) 
• Display Device Description (DSPDEVD) 
• Work with Configuration Lists (WRKCFGL)
• Other I/O system configuration commands

Understanding GR-F Audit Records

What is a GR-F Record?

GR-F audit journal entries are generated when:

• A user attempts to use a function that requires specific function usage authority
• The user does not have the required function usage identifier access
• The operation is denied due to insufficient authorization

Key Fields in GR-F Records

When reviewing GR-F audit records for *IOSYSCFG operations, look for:

GR-F Record Structure

GR-F audit records for function usage contain:

• ENTRY_TYPE: Set to F for Function Usage entries
• FUNCTION_NAME: Contains the function ID (e.g., QIBM_IOSYSCFG_VIEW) - identifies which specific function the user attempted to access
• ACTION and ACTION_DETAIL: Describe the specific operation attempted

Monitoring and Auditing

SQL Query to Monitor GR-F Failures

Use the following SQL query to identify users attempting I/O system configuration operations without proper authority:

SELECT ENTRY_TIMESTAMP,
       USER_NAME,
       JOB_NAME,
       QUALIFIED_JOB_NAME,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       ACTION,
       ACTION_DETAIL,
       FUNCTION_NAME
FROM TABLE(SYSTOOLS.AUDIT_JOURNAL_GR(
    STARTING_TIMESTAMP => CURRENT TIMESTAMP - 7 DAYS
))
WHERE ENTRY_TYPE = 'F'
  AND FUNCTION_NAME = 'QIBM_IOSYSCFG_VIEW'
ORDER BY ENTRY_TIMESTAMP DESC;

Interpreting Results

Each record indicates:

• Who attempted the operation (USER_NAME)
• When the attempt occurred (ENTRY_TIMESTAMP)
• Which function they tried to use (FUNCTION_NAME = QIBM_IOSYSCFG_VIEW)
• Which job made the attempt (QUALIFIED_JOB_NAME)
• What action was attempted (ACTION and ACTION_DETAIL)
• Entry type (ENTRY_TYPE = F for Function Usage)

These GR-F records capture all attempts to use the QIBM_IOSYSCFG_VIEW function, providing visibility into who is attempting to access I/O system configuration operations.

Sample Report Output

Below is an example of what the query results look like:

Granting Access

Option 1: Grant *IOSYSCFG Special Authority

CHGUSRPRF USRPRF(username) SPCAUT(*IOSYSCFG)

Use Case: Appropriate for system administrators who need broad I/O configuration access.

Option 2: Grant Function Usage Access

/* Grant user access to the function usage identifier */
CHGFCNUSG FCNID(QIBM_IOSYSCFG_VIEW) 
          USER(username) 
          USAGE(*ALLOWED)

Use Case: Appropriate for users who need limited, specific access to view I/O configuration without full *IOSYSCFG authority.

CHGFCNUSG FCNID(QIBM_IOSYSCFG_VIEW) 
          USER(JSMITH) 
          USAGE(*ALLOWED)

Best Practices

Security Recommendations

1. Principle of Least Privilege
   • Grant function usage access (QIBM_IOSYSCFG_VIEW) rather than *IOSYSCFG special authority when possible
   • Reserve *IOSYSCFG for administrators who need comprehensive I/O configuration capabilities
2. Regular Auditing
   • Monitor GR-F audit records regularly to identify unauthorized access attempts
   • Review users with *IOSYSCFG authority periodically
   • Audit function usage identifier access lists
3. Documentation
   • Document which users have been granted access and why
   • Maintain a record of business justifications for access grants
4. Alerting
   • Consider implementing automated alerts for repeated GR-F failures
   • Investigate patterns of unauthorized access attempts

Migration Considerations

When upgrading to IBM i 7.6:

1. Update Monitoring Scripts
   • Modify existing audit monitoring to look for GR-F records instead of AF-K
   • Update security reports to reflect the new audit record type
2. Review Existing Authority
   • Identify users who currently have *IOSYSCFG
   • Determine if function usage access would be more appropriate
3. Test Applications
   • Verify that applications using I/O configuration commands function correctly
   • Ensure service accounts have appropriate authorization

Related Documentation

• IBM i 7.6 WRKCFGSTS Command Reference
• SYSTOOLS.AUDIT_JOURNAL_GR Table Function
• IBM i Security Reference (SC41-5302)
• IBM i Audit Journal Reference

Summary

IBM i 7.6 introduces a more granular approach to I/O system configuration security through function usage identifiers. The shift from AF-K to GR-F audit records for *IOSYSCFG specifically provides better tracking of function-specific authorization failures.

Organizations should update their security monitoring processes to accommodate this change and consider using function usage identifiers for more precise access control.