The System i operating system comes with a couple of commands that allow you to see the contents of the audit journal. The Display Audit Journal Entry (DSPAUDJRNE) command copies the entries to a display or report. However, the command has not been updated for a few years, and it misses some of the newer entry types and formats. The Display Journal (DSPJRN) command can dump any journal receiver to an outfile (database file). In both cases, the result is an unformatted file that you can massage using your favorite query tool, such as SEQUEL.

The problem with both of these approaches is that they do not include other sources on the system that track a job or user and their associated entries to create a complete audit trail. To fully investigate a security event, you might also need to look for information in QSYSOPR and QHST. In addition, the exit point history for critical servers—such as FTP, ODBC, JDBC, and so on—can provide valuable information. If you have all of these sources, you can more accurately piece together the trail for a job or user on the system.

Robot/SECURITY Uncovers the Transactions

Robot/SECURITY can take the security-related events for a date range, job, or user from multiple sources on the system and build exactly the output you desire. You can select from a list of potential system sources, such as QAUDJRN, QHST, and QSYSOPR (see Figure 1). In addition, the Robot/SECURITY database contains usage data for the common communication server exit points. It also maintains detailed log entries for user actions during profile exchange operations. You select the sources of information to include. The result is that your auditor gets a clear picture of what was accessed on the system.

Figure 1: You can select from multiple sources of security-related events on your system. (Click images to enlarge.)

From Security Sources to the Detail

When you click Run, Robot/SECURITY interrogates your system to obtain the detailed entries. After all sources are checked, it displays the information in a graphical display directly on your PC. The entries are summarized by source type and include a counter of the number of entries from each source (see Figure 2). QAUDJRN is further broken down by entry type for each audited area, such as PW (Password Failure) or AF (Authority Failure). Robot/SECURITY's Forensics Analysis Utility also offers a data filter that allows you to limit the data shown to the entries that meet the criteria you specify; for example, you can display only entries related to a specific file or library.

Figure 2: Robot/SECURITY shows the detail transactions for a user over a specified time period.

Robot/SECURITY is really five security products in one package; Forensics is just one part of the product. Give it a trial to see the other components, which include exit point monitoring, QAUDJRN monitoring, security auditing, and profile exchange. Call 800.328.1000 to request a demo or a FREE 30-day trial. And check out Help/Systems' other offerings in the MC Showcase Buyer's Guide.

Tom Huntington is Executive Vice President of Technical Solutions at HelpSystems, and has been with the company for nearly 30 years. He works with business alliances, acquisitions and large customer relationships and ensures that the HelpSystems software works with other major software and hardware vendors worldwide.

Tom often speaks on enterprise scheduling, security, automation topics, IBM i technology, and the HelpSystems products, and hosts technical presentations on a variety of automation topics. He is the author of the HelpSystems IBM i Marketplace Survey and has written articles on automated operations, security, cloud computing, and business intelligence for leading trade journals and newsletters. He was named an IBM Champion in 2016, 2017, 2018, 2019, and 2020 for over three decades of advocation and thought leadership on the IBM i platform.

Contact Tom at This email address is being protected from spambots. You need JavaScript enabled to view it..