IBM Support

Auditing Trace Operations.

How To


Summary

How do you audit Trace Operations on the System?

Objective

To Audit Trace Operations on the System. 

Environment

IBM i 7.6 - Base,
IBM i 7.5 - SF99950 Level 1,
IBM i 7.4 - SF99704 Level 20,
IBM i 7.3 - SF99703 Level 28.

Steps

According to the Security Reference manual,  the IBM i Operating System provides the ability to audit Trace Operations on the System. 
This document describes how to enable auditing for Trace Operations and how to analyze the results.
 

First, verify that the QAUDJRN journal exists and that you are tracking for *SERVICE operations. Use the DSPSECAUD command and make sure the following settings are configured on your system:
 

Security journal QAUDJRN exists . . . . . :  YES    
Current QAUDCTL system value  . . . . . . : *AUDLVL
Current QAUDLVL system value  . . . . . . : *SERVICE
 
If not listed, use the CHGSECAUD command to add them to your system.  The value *SERVICE  for the QAUDLVL system value is required to Audit Trace Operations.
 
Analyzing the Results. 
 
Step 1:  Using the Run SQL Scripts tool, run the following SQL Statement:
 
SELECT ENTRY_TIMESTAMP,
       QUALIFIED_JOB_NAME,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       SERVICE_TOOL,
       SERVICE_TOOL_DETAIL,
       TARGET_QUALIFIED_JOB_NAME,
       TARGET_JOB_NAME,
       TARGET_JOB_USER,
       TARGET_JOB_NUMBER,
       TARGET_JOB_USER_IDENTITY,
       TRCTCPAPP_OPTION,
       APPLICATION_TRACED
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_ST(STARTING_TIMESTAMP => CURRENT DATE - 30 DAYS) -- adjust the time frame
        )
    WHERE SERVICE_TOOL IN ('AR', 'DC', 'EC', 'PC', 'SC', 'SJ', 'TA', 'TC', 'TE', 'TI', 'TS', 'WE', 'WS', 'WT', 'WW')
 
NOTE: 
  • Adjust the Time Frame
  • The following commands are audited:
    • DLTCMNTRC, ENDCMNTRC, PRTCMNTRC, STRCMNTRC, STRSRVJOB, TRCTCPAPP, TRCCNN, ENDTRC, ENDPEX, TRCJOB, TRCINT,STRTRC, STRPEX, TRCJOB, ENDWCH, STRWCH,WRKTRC and WRKWCH.
 
Sample Results.
 
image-20250724091122-1
 
 
 
 

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3.0;7.4.0;7.5.0;7.6.0"}]

Document Information

Modified date:
26 November 2025

UID

ibm17240527

Page Feedback