Resolution
Fact: NetIQ Security Solutions for iSeries
Fact: v8.0
Fact: PSAudit
Fact: System Access Analysis
Fact: SAA
Symptom: Joblogs are not in the SAA database.
Symptom: The System Access Report does not include all jobs.
Cause: Logged data has been purged.
Fix: Purged SAA data can be restored if it was saved using the SAA menu option for "Purge Log Data" .
To restore purged SAA data, you must call a program (ALCL06) that will restore SAA files from tape media.
When you call ALCL06 to restore purged data, you must specify the tape device name containing the saved logs. The tape volume must have an internal label of PSAUDIT. The beginning and ending dates must be in format MMDDYY and enclosed in single quotes, as in the example below:
CALL ALCL06 (TAP01 '022805' '030105')
We strongly recommend you run the above command in batch, as in the following example, which restores SAA purged data from tape drive device TAP01 for date range Feb. 28, 2005 through March 1, 2005:
SBMJOB CMD(CALL ALCL06 (TAP01 '022805' '030105')) JOB(ALCL06) JOBD(PSAUDIT/AAJOBD) INLLIBL(*CURRENT) SYSLIBL(*CURRENT) JOBQ(QBATCH)