User cancels message then clears qsysopr 2

[Kozusnik]

A user with privileges cancels a job and immediately clears qsysopr. I did not have qsysopr msgq audited. I can't show who cleared the message queue or who cancelled the message. My audit journal shows a dspmsg qsysopr 1 second before the current first message in qsysopr. I have a very good suspicion, but no proof.

Any suggestions?

Thanks --- Mark

 

[jmd0252]

you can always put in a cl statement looking for that specific user..

 

[Kozusnik]

I have added auditing for qsysopr. Any ideas on how I can find what happened after the fact?

Thanks.

 

[jmd0252]

I have a stupid question, I guess,, why are the canceling the job?? Is it something they are not suppose to do,, and they get into it,, and then change their mind??

 

[Kozusnik]

I believe they were expecting a different message, cancelled what they thought was their message, then their butt puckered when they realized they have just killed the payroll backup job.

To remedy the situation (cover up), I think they cleared qsysopr. Unfortunately, it worked in their favor.

Mark

 

[MdnghtPgmr]

Kozusnik,

You might try the DSPLOG command. Prompt it with F4 to give time and date ranges.

HTH,
MdnghtPgmr

 

[jmd0252]

Yea,, try the dsplog,, I think it depends how the logging is setup in the cl. You could change the logging in the payroll backup job. Does your ERP system provide you with any tolls to furthur monitor security or responses?

 

[Kozusnik]

I can't believe I forgot about QHST.

That did the trick. I had to run it to the screen (not print) to F1 for the details.

Thank you very much!!!!!!!

Mark