How does SQL/QRY monitor in PSAudit work? (NETIQKB52164)

  • Document ID:7752164
  • Creation Date:02-Feb-2007
  • Modified Date:21-Jan-2014
    • Micro Focus Products:
      Security Solutions for iSeries

Environment

NetIQ Security Solutions for iSeries 8.1
NetIQ Security Solutions for iSeries 8.0
VigilEnt Security Agent for iSeries
PSAudit
SQL/QRY Monitor

Situation

How does SQL/QRY monitor in PSAudit work?
How does SQL/QRY monitor work?
What exit program does SQL/QRY monitor work through?

Resolution

SQL/QRY monitor works through our exit program SAR0503B1 on the QIBM_QCA_RTV_COMMAND exit point. This exit point identifies if one of the query commands listed in the Work with SQL/QRY Auditing screen is being used and if the Audit flag is set to *YES. (To access the Work with SQL/QRY Auditing screen, from PSMENU, select options 1, 1, 7, and 28.)

If one of the query commands is used, the job running in the SQL/QRY subsystem ZPSAMON starts the IBM Database Monitor for that job and collects all query-related information. The IBM Database Monitor continuously writes this information to an outfile, which the ZPSAMON subsystem picks up and writes as entries in QAUDJRN. Our report triggers on QAUDJRN.