Resolution
System Auditing and Reporting (SAR)
fact
PSAudit 7.5
fact
PSAudit 8.0
fact
SQL/QRY Monitor
fact
NetIQ Security Solutions for iSeries
fact
VigilEnt Security Agent for iSeries
symptom
Error CPI0002: 'Error in exit program PSAUDIT/SAR0503B'
symptom
PSDetect does not send alerts for SQL or Query command usage.
symptom
PSAudit SQL/QRY Monitor does not send alerts.
symptom
I'm not receiving alerts when SQL or Query commands are used.
cause
PSAudit SQL/QRY Monitor is configured to send alerts when SQL or Query commands are used, but PSDetect job PSDALTMON is not active in subsystem ZPSD to receive the alerts.
fix
If you have configured PSAudit SQL/QRY Monitor to send alerts when SQL or Query commands are used, then PSDetect job PSDALTMON must be active in subsystem ZPSD to receive the alerts from a PSDetect data queue, otherwise the data queue exceeds its maximum size.
To clear this error condition you must clear the PSDetect data queue and optionally configure PSAudit SQL/QRY Monitor to not send alerts when SQL or Query commands are used.
To clear the data queue, run the following command:
CALL PGM(QCLRDTAQ) PARM('PSM100Q' 'PSDETECT')
To configure PSAudit SQL/QRY Monitor to not send alerts when SQL or Query commands are used, refer to the steps below:
- Starting from PSMENU, select options 1, 1, 7, and 28.
- Enter a 9 (=End Alert) under the 'Opt' column of the first record.
- Press F13, press Enter.