How do I change the date format on a PSAudit security report? (NETIQKB46957)

goal
How do I change the date format on a PSAudit security report?

fact
VigilEnt Security Agent for iSeries 7.5

fact
VigilEnt Security Agent for PSAudit 7.5

fact
System Auditing and Reporting (SAR) 

symptom
Dates for transactions on PSAudit security reports are in the wrong format.

fix

The date format on the report header cannot be changed, but you can change the date format of transactions (records).

To change the date format of the transactions on a PSAudit security report:

1. Save the PSAudit/SAR (System Auditing and Reporting) query objects by typing the following commands on the iSeries command line, pressing Enter after each:

   CRTSAVF  QGPL/SARQRYOBJB TEXT('save PSAudit/SAR *QRYDFN objects before change')

   SAVOBJ  OBJ(*ALL)  LIB(PSAUDIT)  DEV(*SAVF)  OBJTYPE(*QRYDFN) SAVF(QGPL/SARQRYOBJB)

2. Type the following command and press Enter to create the QTEMP files referenced by the queries:

   CALL  PSAUDIT/AUDITFILES

   Alternatively, you can run the report interactively to create the QTEMP file used by the query you want to change.

3. Type WRKQRY and press Enter.
4. Select option 2 (=Change), and then specify the query name, such as AAQYPW.
5. Ensure the library name is PSAUDIT.
6. Press Enter.
7. Select Define result fields, and then press Enter.
8. Redefine the date format as appropriate. If the query definition has not been modified by the end user, the date format is printed as YY/MM/DD. The year starts in byte 1, the month in byte 3, and the day in byte 5 of the transaction date field respective to the particular query definition. To redefine a date result field from MM/DD/YY to YY/MM/DD format, change the values in the Expression column from the following:

   substr(pwdate, 3, 2) || '/' || substr(pwdate, 5, 2) || '/' || substr(pwdate, 1, 2)

   to the following:

   substr(pwdate, 1, 2) || '/' || substr(pwdate, 3, 2) || '/' || substr(pwdate, 5, 2)

9. Press Enter.
10. Press F3.
11. Specify Y for Save definition and 3 for Run option, and then press Enter.

note

Save any changed queries you want to keep since they will be replaced by any future agent upgrades.

Formerly known as NETIQKB46957