When a user deletes a file using a remote DDM command, it doesn't match the object listed in the cor (NETIQKB31075)

fact
VigilEnt Security Agent for iSeries 5.4/7.0

fact
Remote Request Management

symptom
When a user deletes a file using a remote DDM command, it doesn't match the object listed in the corresponding Remote Request Management collected entry.

cause
If a remote DDM command is issued from another AS/400 and Remote Request Management is configured to collect the resulting request, the actual object operated upon is not captured against the corresponding collected entry.  However, the command that was issued is collected.  This is by design.

fix

To view the corresponding information in Remote Request Management refer to the following steps:

1. At a command line type PSMENU, press Enter.  The Pentasafe Product Access Menu will be displayed.
   
2. Select Option 1 PSSecure, press Enter.
   
3. Select Option 3 Remote Request Management, press Enter.
   
4. Select Option 2 Work with Collected Entries, press Enter.
   
5. Locate the 'DDM' collected entry ( Server=DDM and Function=COMMAND).
   
6. Select Option 10=Object, for the entry in question to display the remote command that was issued.  If the command was 'DLTF', you will see /QSYS.LIB/DLTF.CMD on the object screen. If a file was deleted  it will be listed on the 'All Delete Operations' report ( provided that OS/400 security journaling was active when the command was issued).

Formerly known as NETIQKB31075