Documentation Quick
Contents
1. NM NM MM MM WM WM WM This option uses the capabilities of i5 command CHGSECAUD which allows to create or update audit options Note Pay attention to the library which will be used to store the journal receiver It can be any user library as PMCSIUSR or a dedicated libray for journal receivers Documentation Quick CSi 8 QUICK CSi 7 Step 2 System value QCRTOBJAUD The system value QCRTOBJAUD allows to setup automatically the audit level for any new object created on the system Using option CHANGE would be recommended fot this system value Work with System Values System QSLFRA2 Position to Starting characters of system value Subset by Type F4 for list Type options press Enter 2 Change 5 Display System Option Value Type Description QCRTOBJAUD SEC Create object auditing Bottom Command gt F3 Exit F4 Prompt F5 Refresh F9 Retrieve F11 Display names only F12 Cancel The command WRKSYSVAL QCRTOBJAUT is displayed Use option 2 to modify the value Step 3 Secure Objects This step will secure the Quick CSi application giving ownership and creating the authorization list to protect objects and database Create user profile PMCSI o This profile will get the ownership of all the application Create authorization list PMCSI o This authorization list will be applied on all the objects of the application After running this step all objects of librarie2. i From date 2012 01 01 AAAA MM JJ tO Date gece rad 2012 12 31 AAAA MM JJ F3 Exit F12 Cancel gt Indiquer le nom de l utilisateur analyser gt Indiquer la p riode diter date de d but et la date fin Le fichier spool sera produit dans la file d attente de l utilisateur qui a ex cut la demande Le fichier spool s appelle PMCSIEDU La donn e utilisateur USRDTA contiendra le nom du profil utilisateur interrog On 2012 08 21 11 09 14 AUDIT ENTRIES BY USER PROFILE Period from 2012 08 20 19 18 39 User PMCSI Period to 2012 08 21 10 47 54 Date Time Ope Job name User Number Program Library Object 2012 08 16 07 00 00 599616 JS PMACG CVT PMCS 470764 QWTPIIPP RER 2012 08 16 07 00 00 675392 CD PMACG CVT PMCS 470764 QCMD QSYS CALL 2012 08 16 07 00 00 764400 CD PMACG CVT PMCS 470764 PMACGCHG PMACG RTVJOBA 2012 08 16 07 00 00 764480 CD PMACG CVT PMCS 470764 PMACGCHG PMACG RTVSYSVAL 2012 08 16 07 00 00 775552 CD PMACG CVT PMCS 470764 PMACGCHG PMACG RTVJOBA 2012 08 16 07 00 00 787392 CD PMACG CVT PMCS 470764 PMACGCHG PMACG RMVMSG 2012 08 16 07 00 00 787536 CD PMACG CVT PMCS 470764 PMACGCHG PMACG CHGJRN 2012 08 16 07 00 00 951104 CA PMACG CVT PMCS 470764 PMACGCHG PMACG PMACG0092 2012 08 16 07 00 00 951200 CO PMACG CVT PMCS 470764 PMACGCHG PMACG PMACG0092 2012 08 16 07 00 01 280096 CD PMACG CVT PMCS 470764 PMACGCHG PMACG RCVMSG 2012 08 16 07 00 01 280208 CD PMACG CVT PMCS 470764 PM
3. Documentation Quick CSi 32 QUIGK GSI 4 2 PRINTOUTS Quick CSi provides printouts Automatic reporting generated by the supervisor based on settings gt Printouts on demand from the menu 4 2 1 Automatic reporting Automatic printouts are generated by the supervisor Synthesis of journal entries The first report lists all type of journal entries and counts the number of entries for each one o Number of entries for every types of entry o Based on settings alert if the threshold is reached On 2012 08 21 10 48 12 AUDIT JOURNAL SYNTHESIS Period from 2012 08 20 19 18 39 Period to 2012 08 21 10 47 54 Alert Code Description Total entries threshold AD Object auditing attribute change 7 AF Authority failure 0 AP Program adopt 0 AU Attribute changed 0 CA Change of authority 691 CD Command string 1 292 CO Object created 240 CP User profile changed created or restored 4 dl CQ Change request description object change 0 CU Cluster operation 0 CV Connection verification 0 Exit points synthesis The second report proposes a synthesis of exit point operations Similar to the first report it counts the number of operations for each exit point On 2012 08 21 10 48 12 EXIT POINTS SYNTHESIS Period from 2012 08 20 19 18 39 Period to 2012 08 21 a 10 47 54 EE 3 147 25 TELNET entries 1843 REXEC entries 5 Native Database entries 23 SQL entries i 17 33 11 09 2012
4. Type choices press Enter Library s a s o w a a gt PMCSIARC Name generic NONSYS Device s s wo s 4 s e amp 4 Name SAVF MEDDFN for more values This option is based on a simple SAVLIB It is given just as an example Quick CSi backups will be included in the general backup plan of the company 21 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 3 3 PURGE DATA This option will allow to clean up data from archive libraries Clean up data PMCSICLN Type choices press Enter Clean up till G Ge 3 Date Archive library frk mg e PMCSIARC Name gt Indicates the limit date for clean up of data gt Indicates the archive library to clean up The default library for Archive is PMCSIARG But any Quick CSi archive lirary can be used by this command Note Data from the main library PMCSIUSR cannot be cleaned up by this command PMCSIUSR data must be first archived in a secondary library A backup of the archive library is strongly recommended before cleaning up the data Documentation Quick CSi 22 QUIGK GSI 3 4 DISPLAY MESSAGES Option 4 of the menu displays the messages from the message queue PMCSIUSR PMCSI The option is corresponding with the following command DSPMSG PMCSIUSR PMCSI Display Messages System QSLFRA2 QUEUES s s s s f PMCSI Program f DSPMSG Library PMCSIUSR Library i Severity 00 Delivery HOLD T
5. gt Selection of fields List of all fields of the table gt Definition of Options Management of allowed options gt Filters Definition of filters column level gt Save the view Save the view as an object to be used directly or included in a user menu All modifications are dynamically included in the view allowing a validation before saving the view 41 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 5 2 1 Definition of fields Using option 2 of the menu fields can be defined for the view Select displayed fields gt Optional parameters for the field o Edit codes o Column heading o Fixed and variable fields fixed fields are always displayed and not affected by F10 F11 and F19 F20 o Definition of multiple view F10 F11 as a WRKSPLF presentation SELECTION OF FIELDS View VUEOL Test View Job 1 2 Modify 4 Remove Opt Seq Field Col Heading Len 8 10 JOSTEP STEP 9 0 8 20 JODATE DAT6 6 0 8 30 JOTIME TIME 6 0 8 40 JOJOB JOB 10 0 8 50 JOUSER USR 10 0 8 60 JONBR JOBNBR 6 0 8 70 JOCDE CACE 15 0 80 JOCPU CPU 11 0 A suivre F6 Add F2 Options Fl Top F12 Cancel Change the sequence of the field gt Modify option for the field gt Remove the field from the view Options 2 Modify Modification of the field attributes Column heading sequence edit code 4 Delete Remove the field for the view the field will not be displayed Documentation Quick CSi 42 QUICK CS
6. On demand Print audit entries Option 11 allows to print all entries for a specific type of entry and for a selected period LIST AUDIT ENTRIES PER TYPE Type of entry WW From date 2012 01 01 AAAA MM JJ to Date e Ed E 2012 12 31 AAAA MM JJ F3 Exit F12 Cancel gt Indicate the type of journal entry gt Indicate the period from date to date The spool file will be created in the job output queue The spool file is named PMCSIEDE The user data will be CSI xx xx selected operation code On 2012 08 21 11 08 39 AUDIT ENTRY ANALYSIS Period from 2012 08 20 19 18 39 Type of entry Period to 2012 08 21 10 47 54 Description User profile changed Date Time Job name user Number Program Library Object 2012 08 16 21 00 00 703984 USERFORM PMCSI_USR1 470957 FORMATION1 2012 08 16 21 00 01 273488 USERFORM PMCSI_USR1 470957 FORMAT ION2 2012 08 16 21 00 01 325440 USERFORM PMCSI_USR1 470957 FORMATION3 2012 08 16 21 00 01 411536 USERFORM PMCSI_USR1 470957 FORMAT ION4 2012 08 17 21 00 00 754368 USERFORM PMCSI_USR1 471115 FORMATION1 2012 08 17 21 00 01 308960 USERFORM PMCSI_USR1 471115 FORMATION2 2012 08 17 21 00 01 380208 USERFORM PMCSI_USR1 471115 2012 08 17 21 00 01 467040 USERFORM PMCSI_USR1 471115 35 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 4 2 1 On demand Entries per Object L dition par type de poste permet de produire un ra
7. QIBM_QTMX_SVR_REQ REXEC request validation Activation of an exit program for Native Data Base exit points o QIBM QZDA INIT Database server Entry o QIBM QZDA RON Database Server object information Activation of an exit program for SQL exit points o QIBM QZDA SQL1 Database server SQL access Documentation Quick CSi 18 3 QUIGK GSI OPERATIONS The Operations menu proposes all options referring to the management of the supervisor and includes options for backups and archive processes OSLFRA2 65117EA Quick CSi 9 08 12 PM CSI 11 42 28 CSI Operation menu Selec 1 2 3 ws Opt t one of the following options Archive CSi data 6 Start sub system PMCSI Backup archive data 7 End sub system Purge data 8 Display sub system PMCSI 9 Start supervisor Display EDH messages 10 End supervisor Receiver recovery ion or command gt F3 19 Exit F4 Prompt F9 Repeat F12 Cancel Archive CSi Data o Export data from the main library to secondary archive library Backup archived data o Backup of archive libraries on tapes Clean up archive data o Clean up archived data based on date Display messages o Display operation messages from the message queue PMCSIUSR PMCSI Recovery on receiver o Recovery option to retrieve information from old journal receiver used during first installation or after a restore operation of receivers Manage sub system PMCSI o Sta
8. TRADER S Les solutions QUICK S0OFTWARE LINE Automatic reporting Detailed For every type of journal entry based on the settings it is possible to generate a report with the list of operation On 2012 08 21 10 48 29 AUDIT JOURNAL ANALYSIS CODE OM Object management change Period from 2012 08 20 19 18 39 Period to 2012 08 21 10 47 54 Date Time Job name User Number Program Library Object 2012 08 21 02 58 59 165632 EDHMONITOR PMSOFTICE 447141 EDHMMSGQ PMEDHTOOLS FIC132 2012 08 21 03 17 59 651696 EDHMONITOR PMSOFTICF 447141 EDHMMSGQ PMEDHTOOLS FIC132 2012 08 21 03 18 09 608384 EDHMONITOR PMSOFTICF 447141 EDHMMSGQ PMEDHTOOLS FIC132 2012 08 21 03 19 01 804240 EDHMONITOR PMSOFTICF 447141 EDHMMSGQ PMEDHTOOLS FIC132 2012 08 21 08 31 49 167280 QPADEVOOOT PMCS 471622 QCMD OSYS PMCSIEDS 2012 08 21 08 31 49 167312 QPADEVOOOT PMCS 471622 QCMD OSYS QABO4E78D6 2012 08 21 08 33 51 223680 QPADEVOOOT PMCS 471622 QCMD SYS PMCSIEDS 2012 08 21 08 33 51 223728 QPADEVOOOT PMCS 471622 QCMD SYS QAB0504A83 2012 08 21 08 40 18 868480 QPADEVOOOT PMCS 471622 QCMD OSYS PMCSIEDS 2012 08 21 08 40 18 868528 QPADEVOOOT PMCS 471622 QCMD os7s QAB0561141 2012 08 21 08 41 03 405120 QPADEVOOOT PMCS 471622 QCMD QSYS PMCSIEDS 2012 08 21 08 41 03 405152 QPADEVOOOT PMCS 471622 QCMD OSYS QAB056BB22 2012 08 21 08 44 34 816704 QPADEVOOOT PMCS 471622 QCMD QSYS PMCSIEDS Documentation Quick CSi 34 QUIGK GSI 4 2 2
9. done by the same application all over the days Available options gt O No The report will not use filters 1 Yes The report will use filters gt J Job Only filters based on job name are used gt U Users Only filters based on user profile name are used Alert and Threshold The alert level allows highlighting if there is more operations than expected for the selected type of entry Activating thois option a special information will appear on the automatic report comparing the number of operation and the threshold Available options gt O No No threshold for this type of entry gt 1 Yes A threshold is defined and the number of operation is controlled for the period Indicate a value for the threshold 0 is accepted Documentation Quick CSi 14 QUICK CSi amp 2 4 MANAGEMENT OF FILTERS The amount of entries generated by the audit journal is sometimes very important some applications are doing repetitive action every second Even you have to archive them in case of control it would be interesting to ignore them from the automatic reports avoiding a lot of unused pages You can define filters for the automatic reporting function Filters are based on two different criteria Filter on the user profile name Filter on the job name 2 4 1 Definition of filters Option 6 of the menu displays the following screen Quick CSi DEFINITION OF FILTERS Indicate name or generic name to be omitted Pres
10. exit program PMCSI_EP1 17 2 5 3 Remove an exit program PMCSI_EPR 18 2 5 4 List of Managed exit points Lamimnmseuuiinsavannnenenvnnde 18 3 OPERATIONS Leed 19 RE Gan 20 ar BACKUPS vred 21 3 3 PR FN en 22 3 4 DENNE 23 3 5 RECOVERY ON A JOURNAL RECEIVER uwnnnnennnnnennnnnennnnnennnnnennnnnvnnensvnnnnennnne 24 3 6 MANAGE SUB SYSTEN PMICSI rss semmsenti tions 25 2 6 1 Start SS SEAT eek iene 29 3 6 2 FOSSEN DEEN 25 3 6 3 Work with Subsystem Jobs 25 3 7 MANAGE THE SUPERVISOR sennnennnnnennnnnennnnnnnnnnnnnnnnennnnnennnnnennnnnennnnnennnnunnnne 26 3 7 1 Start the SUperv SOr en 26 3 7 2 End the ET 26 Documentation Quick CSi 2 QUICK CSi 7 MANAGEMENT OF DATA siissicnviccccncececssetvatinasscessacdebsesdeedeceusasees 27 4 1 QUERY FUNCTION icstensiscavicarscstecseinatiannicadndainasinansiasdianiindpapaaastpcadieriuabive 28 4 1 1 Query by type of journal entry 28 4 1 2 Display TUNES eee een eee ene ee es 29 4 1 3 Associated Spool NES sunne tendseisncreiaenseleniueeeiade 30 4 1 4 AUDIT by CCC i secs sacs den met me 31 4 1 5 AUDIT by user profile estimated 32 4 2 FAT UNN 33 4 2 1 Automatic reporting NENNEN 33 4 2 2 On demand Print audit entries ee 35 4 2 1 On demand Entries per Object kee 36 4 2 1 On demand Enrties per User profile 37 PM PAGE INTERROGATION i musnrnnnnvnnnnnnnnnnnnnevnnnnnnnnnennnnnnnnnnr 38 Sole SELECT RECORDS sacecctecwccsenicndednctecceta
11. gt restore in case of auditor requests N q 5 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 1 5 MAIN MENU The command PMCSI displays the main menu QSLFRA2 65117EA Quick CSi 29 08 12 PM CSI 15 47 25 CSi Control and Security for System i v12 0812 Select one of the following options 1 Parameters 2 Exploitation 3 Work with collected data Option or command gt F3 Exit F4 Prompt F9 Repeat F12 Cancel The menu gives access to the three following sub menus gt Installation and settings o Definition of audit and Quick CSi parameters gt Operation menu o Management of the supervisor Archive and clean up options gt Work with collected data o Queries and reporting option on Quick CSi database Documentation Quick CSi QUIGK GSI 2 INSTALLATION AND SETTINGS Option 1 of the main menu gives access to the Installation and Setting menu QSLFRA2 65117EA Quick CSi 9 08 12 PM CSI 11 41 36 CSI Settings Select one of the following options General parameters Control Accesses 1 Create Audit journal 11 Work with exit points 2 Activate Audit Objects 3 Activate Audit Profiles Manage AUDIT Security of Data 4 Planning of processings Define files ese teast etess 5 Manage AUDIT entries 6 Define filters Option or command gt F3 Exit F4 Invit F9 Rappel F12 Annuler The menu gives access to the following opt
12. keep the journal receivers before automatic deletion 0 No deletion be Quick CSi Note Pay attention to the journal receivers management Are they dedicated to Quick CSi or are they shared with other application HA replication Do they need to be backed up before deletion Documentation Quick CSi QUICK CSi amp 2 3 MANAGE AUDIT TYPE OF ENTRYS The management of journal type of entrys allows to define the specific options for each type of entry The screen shows all the type of entrys types are groups by domain helping for the definition MANAGE TYPE OF ENTRYS 2 Modify 5 Display Slt Grp Code Description Gst Prt Alr _ AUD xxxxx Audit management _ AUD AD Object auditing attribute change a 0 0 _ AUD GR General purpose audit record 0 0 _ AUD ZC Audit object change 0 0 _ AUD ZR Audit read access 0 0 _ AUT x x Authorization management _ AUT AF Authority failure 1 0 0 _ AUT AP Program adopt 0 0 _ AUT CA Change of authority 1 0 _ AUT IS Internet security management 0 0 _ AUT JD CHGJOBD of user value 1 0 0 _ AUT OW Object ownership change 1 1 0 More F3 Exit F5 Refresh F12 Cancel All types of entry are listed by domain For each type we can see directly the selected options gt Management of the type of entry by Quick CSi Automatic reporting gt Threshold for alerts 2 3 1 Define options for type of entry Selecting a type of entry the following win
13. 1 Additional views F19 F20 Left Right 29 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 4 1 3 Associated spool files Option S Spools displays all the spool files generated by the supervisor if the automatic reporting is defined for this type of entry Work with All Spooled Files Type options press Enter 1 Send 2 Change 3 Hold 4 Delete 5 Display 6 Releas 7 Messages 8 Attributes 9 Work with printing status Device or Total Cur Opt File User Queue User Data Sts Pages Page Copy _ PMCSI PRT PMCSI PMCSI CSI CO RDY 212 1 _ PMCSI PRT PMCSI PMCSI CSI CO RDY 163 1 o PMCSI PRT PMCSI PMCSI CSI CO RDY 26 1 N PMCSI_PRT PMCSI PMCSI CSI CO RDY 26 1 PMCSI PRT PMCSI PMCSI CSI CO RDY 38 _ PMCSI PRT PMCSI PMCSI CSI CO RDY 9 a PMCSI PRT PMCSI PMCSI CSI CO RDY 37 1 E PMCSI PRT PMCSI PMCSI CSI_CO RDY 51 T PMCSI_PRT PMCSI PMCSI CSI CO RDY 37 1 More Parameters for options 1 2 3 or command gt F3 Exit F10 View 4 F11 View 2 F12 Cancel F22 Printers F24 More keys The display is corresponding with command WRKSPLF selecting all spool files with a User Data CSI xx xx corresponding with the selected type of enrty This example is showing all spool files for the DO operation Delete Object Documentation Quick CSi 30 QUIGK GSI 4 1 4 AUDIT by Object The extraction process generates a specific database based on object names It allows que
14. ACGCHG PMACG CHGDTAARA 2012 08 16 07 00 01 290400 ZC PMACG CVT PMCS 470764 PMACGCHG PMACG PMACGINF 2012 08 16 07 00 01 290496 CD PMACG CVT PMCS 470764 PMACGCHG PMACG CHGDTAARA 2012 08 16 07 00 01 290656 ZC PMACG CVT PMCS 470764 PMACGCHG PMACG PMACGINF 37 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 9 PM PAGE QUERIES PM PAGE is a query function for DB2 files It is embedded in Quick CSi to offer query functions around the database Basic functions gt gt Query database files Filtering at column level Search position in the file Dynamic format of the displayed view Multiple views F10 F11 as managed in WRKSPLF command Management of option available on records Creation of independent view object which can be used in CLP menus Documentation Quick CSi 38 QUICK CSi amp 5 1 SELECT RECORDS The first functionality of PM PAGE is to select records on multiple criteria Putting the cursor on a column and using function key F2 a window is displayed allowing defining a selection Define a selection on a Field Field JOJOB Job name 10 A O Test tested value limited to character A EQ F12 Cancel The window shows the detail of the selected field JOJOB the text description and the length of the field gt Indicate a comparison test and a value EQ Equal NE Different than a LT Lower than m LE Lower or equal su GT Gre
15. QUICK CSi 7 Controle amp S curit pour IBM System i SIMPLE amp PERFORMANT TRADER S Les solutions QUICK SOFTWARE LINE 21 Rue Rollin 75005 Paris France T l 33 0 1 53 10 27 50 Fax 33 0 1 43 26 26 42 www quick software line com TRADER S Les solutions QUICK SOFTWARE LINE CONTENTS Te e ei Te A KE 4 Mets AUDIT JOURNAL kassan 4 1 2 QUICK CSI FUNCTIONS sanmemnmdnunmnmmmi mm nnmnnn nnmnnn 4 12 Tracing operationis eenegen 4 1 2 2 Tracing Access on the system 4 1 3 QUERY USING PM PAGE AER eeh et eege eebe sek 4 Tid GENERAL SCHEME scans annees eau eee EEEn saaier 5 1 5 MAIN MENU EE 6 2 INSTALLATION AND SETTINGS maunnnnnnnnnnnvrnnnnnnnnnevnnnnnnnnernnnnnnnnr 7 2 1 INSTALLATION amp SETTINGS asennnnvennnnnnnnnnvnnnnnvnnnnnnnnnnnennnnnennnnnennnnnennnnsnnnnner 8 2 1 1 Create Audit and set System Values ENNEN 8 2 1 2 Activate Audit on Objedis nmivessmuemmisinskkvnnikenaiovnnkae 10 2 1 3 Activate Audit on User profiles 11 2 2 SCHEDULE THE BEE 12 2 3 MANAGE AUDIT TYPE OF ENTRYS ccccesecceesecceeseccenseecenseccenseceessesenneesees 13 2 3 1 Define options for type of entry 13 2 4 MANAGEMENT OF FILTERS sennnennnnnennnnnennnnnnnnnnnnnnnnnnnnnnennnnnennnnnennnnnnnnnnunnnne 15 2 4 1 Definition of filters Luasaermsesmmneseee ea ide due 15 2 4 2 Use filters for reporting un 16 2 5 MANAGE EXIT POINTS eerste 17 2 5 1 Activate exit programs 17 2 5 2 Activate an
16. ands done by selected user profile The option proposes to activate the audit on user profiles ACTIVATE AUDIT ON PROFILES User profiles ALL Submit a batch job 1 1 Yes F3 Exit F12 Cancel Indicates a name a generic name or ALL A CHGUSRAUD with option CMD will be done for every selected profiles The option can run interactively or submitted as a batch job 1 Yes A batch job is submitted to activate audit 0 No The CHGUSRAUD runs in interactive mode 11 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 2 2 SCHEDULE THE PROCESS The audit journal traces all operation in real time Quick CSi will periodically extract these data from journal receivers depending on the company needs and rules This option mainly defines the periodicity of the data extraction MANAGEMENT OF DATA HARVEST Last process Process date DEEN 2012 08 29 From receiver PMEDHJRN AUDRCV0219 To receiver PMEDHJRN AUDRCV0219 Periodicity ss esse mess aie e et hours Keep journal receivers days 0 Ignored F3 Exit F12 Cancel The displayed window shows information about the last process P riodicity Indicate a periodicity of data extraction Minimum is 1 hour Maximum is 24 hours The value will be used when the supervisor will restart if already active Keep journal receivers Quick CSi can automates the clean up of journal receivers Indicate the number of days to
17. ater than GE Greater or equal LC Character test us LO Lookup contain stream NO Nor does contain stream 39 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE The user view is an object created dynamically which will contain all query parameters for a specific table All options available in PM PAGE can be stored in a user view File name Definition of the file name and library and associated member Security option User authorization This function allows to define if the user can modify the view Display mode Display can be done in a full screen of in a sized window gt Displayed fields The view can display all the fields of the table or a limited subset of fields gt Allowed options The view contain the definition of option which can be used at record level 5 Display 2 Modify gt Filters on fields The view can include filtering on columns Documentation Quick CSi 40 QUICK CSi 7 IA From the main screen using function key F8 the setting window is displayed giving access to the different options DEFINITION OF THE USER VIEW General parameters Definition of fields Selection of fields Definition of options Filters Save the view VO O1 amp WNE Option _ F3 Exit F12 Cancel General parameters General parameters for security and display format gt Definition of fields Definition of displayed fields with column heading and options
18. dow is displkayed OPTIONS FOR TYPE OF ENTRY Group sheas AUD Code Husnes GR Description General purpose audit record Manage entries O No 1 Yes Automatic reporting 0 No 1 Yes Filters for report O No 1 Yes J Job U User Threshold Threshold F12 Cancel The type of entry is displayed with the group and text description 13 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE Foe each type of entry define the following options Manage the entry The option allows excluding a type of entry from the general management of Quick CSi If a type of entry is excluded all corresponding entries from the audit journal would be ignored during data extraction By default all types of entry are selected with option 1 If a type of entry is excluded it is displayed in RED on the list of the main screen Available options gt O No This type of entry will be ignored by Quick CSi gt 1 Yes This type of entry is managed by Quick CSi by default Automatic reporting Using this option Quick CSi will provide a detailed list of all operations corresponding with this type Available options gt O No Quick CSi will not produce automatic report for the type of entry 1 Yes A detailed list will be generated by Quick CSi after extraction of data Filters for reporting The filters allows to ignore some entries from the detailed report most of the time repetition of operations
19. e filters J Job Only filters based on job name are used U Users Only filters based on user profile name are used lolololr 000060 Documentation Quick CSi 16 QUICK CSi 7 2 5 MANAGE EXIT POINTS 2 5 1 Activate exit programs TCP IP offers a lot of functions to access system and data TELNET FTP Remote SQL This option allows to activate exit programs on some different exit points of the system allowing to trace all external access to the system and data The exit points managed by Quick CSi are linked with TCP IP services Adding or removing an exit program needs to end and restart the corresponding service MANAGE EXIT POINTS 1 Turn ON TELNET Exit point FTP connections Remote command REXEC Native Database SOL SEELEN Reeg lo o o o k F3 Exit F12 Cancel For each service indicate Option 1 to activate the exit program Option 0 to de activate the exit program When a definition is changed for one service a command will be prompted corresponding with the selected option gt PMCSI EPI Install an exit program gt PMCSI EPR Remove an exit program 2 5 2 Activate an exit program PMCSI EPI Option 1 used in front of one service will prompt the command PMCSi EPI This command will do the following Add one or multiple exit programs for the selected service gt If selected the command will end and restart t
20. first time Documentation Quick CSi 24 QUICK CSi 7 3 6 MANAGE SUB SYSTEM PMCSI From the operation menu options 6 7 and 8 allow to manage the sub system PMCSI 3 6 1 Start sub system This option stats the sub system gt STRSBS SBSD PMCSIUSR PMCSI 3 6 2 End sub system This option ends the sub system gt ENDSBS SBS PMCSI Note ENDSBS is used with option CNTRLD allowing ending normally the jobs 3 6 3 Work with Subsystem Jobs This option displays the jobs running in the sub system PMCSI gt WRKACTJOB SBS PMCSI Work with Active Jobs OSLFRA2 29 08 12 16 27 41 CPU 3 2 Elapsed time 01 29 21 Active jobs 444 Type options press Enter 2 Change 3 Hold 4 End 5 Work with 6 Release 7 Display message 8 Work with spooled files 13 Disconnect Current Opt Subsystem Job User Type CPU Function Status PMCSI QSYS SBS 0 0 DEQW PMCSI BCH 0 0 DLY 06 00 00 DLYW NS Supervisor job Bottom Parameters or command gt F3 Exit F5 Refresh F7 Find F10 Restart statistics F11 Display elapsed data F12 Cancel F23 More options F24 More keys 25 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE Daily the sub system will always show the job PMCSI SPV which is the supervisor in charge of the extraction of data and automatic reporting The sub system would also show specific jobs as archive or clean up processes 3 7 MANAGE THE SUPERVISOR Options 9 and 10 allow to manage the
21. he corresponding service CAUTION Ending and restarting a service can generate trouble for active connection Pay a special attention for TELNET service Ending this sevice can end you current session but also ALL TELNET sessions running on the system Use restraint mode to do this operation 17 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE ed Ai 2 5 3 Remove an exit program PMCSI EPR Option 0 used in front of one service will prompt the command PMCSI EPR This command will do the following Remove one or multiple exit programs for the selected service gt If selected the command will end and restart the corresponding service CAUTION Ending and restarting a service can generate trouble for active connection Pay a special attention for TELNET service Ending this sevice can end you current session but also ALL TELNET sessions running on the system Use restraint mode to do this operation 2 5 4 List of managed exit points Activation of an exit program for FTP and TFTP exit points o QIBM_QTMF_SVR_LOGON FTP Server logon o QIBM QTMF CLIENT REQ FTP Client Request Validation o QIBM QTMF SERVER REQ FTP Server request validation o QIBM QTOD SERVER REQ TFTP Server request validation Activation of an exit program for TELNET exit point o QIBM QTG DEVINIT Telnet device initialization Activation of an exit program for REXEC exit points o QIBM QTMX SVR LOGON REXEC server logon o
22. i amp 5 2 1 Save the view definition The definition and all settings are saved in an object called a user view This view will be used directly with the command PMPAG The definition will be available for modification for authorized users SAUVEGARDE DE LA DEFINITION View CSI JOBOI Library PMCSI Replace view 1 0 No 1 Yes F3 Exit F4 Invit F12 Cancel gt Indicate the name of the view and the library gt Indicate if the existing view will be replaced Press enter to create the view The view will be stored in the selected library as a user space USRSPC object 43 11 09 2012
23. ions gt 1 3 Installation o Create audit objects and set system values o Activate audit on application objects o Activate audit on user profiles v Ja Scheduler Define periodicity for data collection O y Wu Management of audit type of entrys Define options for audit type of entrys O y O Define filters Create filters to omit journal entries O gt 11 Management of access points o Activate exit points to control system accesses gt Database files definition o Not available 7 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 2 1 INSTALLATION amp SETTINGS The installation options 1 to 3 allows to set up audit on the system These options are optional if the audit is already active on the system 2 1 1 Create Audit and set System Values Step 1 Audit journal and options The first step will create the audit journal QAUDJRN in library QSYS and update the system values associated with this function Change Security Auditing CHGSECAUD Type choices press Enter QAUDCTL system value Auditing values ALL SAME ALL NONE CREATE SAME ALL DFTSET DELETE OBJMGT SECURITY SAVRST AUTFAIL NETCMN PGMADP PGMFAIL SYSMGT Initial journal receiver Name Library sue Ge de GOE OG Name CURLIB Bottom F3 Exit F4 Prompt F5 Refresh F12 Cancel F13 How to use this display F24 More keys
24. ndicate the name of the library the name of the object and type Press Enter 31 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 5 AUDIT by user profile The extraction process generates a specific database based on object names It allows querying a specific object displaying all operation done for this object PMPAG Interrogation File PMCSI_US PMCSIUSR Mbr PMCSI US View PMCSI US PMCSI Fmt CSIUSRR Select option then press Enter 5 Display Entry User Code Time stamp _ ARCAD CD 2012 08 28 01 00 00 272224 _ ARCAD CD 2012 08 28 01 00 00 540640 _ ARCAD CD 2012 08 28 01 00 00 548304 _ ARCAD CD 2012 08 28 01 00 00 557728 _ ARCAD CD 2012 08 28 01 00 00 561648 _ ARCAD CD 2012 08 28 01 00 00 561744 _ ARCAD CD 2012 08 28 01 00 00 562368 _ ARCAD ZC 2012 08 28 01 00 00 601280 _ ARCAD ZC 2012 08 28 01 00 00 637456 _ ARCAD CD 2012 08 29 01 00 00 217232 Parameter or Command D but gt F2 Select F3 Exit F4 Invite F6 Position to F7 Chg file F8 Para F24 The table is organized by User profile Time stamp Operations are displayed using this Sequence Function key F6 gives position to a specific object Reach File PMCSI US CSi Journal entries User Format CSIUSRR Red 1389 Enter the value for the different fields Field Text Value USUSER User PMCSI USTSTP Entry type 2012 08 29 01 00 00 217232 Indicate the name of the library name of the object and type Press Enter
25. pport de toutes les op rations li es un objet sp cifique LIST AUDIT ENTRIES PER TYPE Libraty vayseslvrereds Name ois Sd BAe es ds TYPES sed belie sue 6 8806 From date 2012 01 01 AAAA MM JJ From Date 02 04 0000 2012 12 31 AAAA MM JJ F3 Exit F12 Cancel gt Indiquer les r f rences de l objet biblioth que nom et type de l objet gt Indiquer la p riode diter date de d but et la date fin Le fichier spool sera produit dans la file d attente de l utilisateur qui a ex cut la demande Le fichier spool s appelle PMCSIEDO La donn e utilisateur USRDTA contiendra le nom de l objet interrog On 2012 08 21 11 08 52 AUDIT ENTRIES BY OBJECT Period from 2012 08 20 19 18 39 DECHE sas sas S Period to 2012 08 21 10 47 54 Libr ry sade ae Type of Object Date Time Ope Job name User Number Program Library Object 2012 08 21 09 12 50 465568 ZC QPADEVOOOT PMCSI 471622 QDZTDO0001 OTEMP 2012 08 21 09 12 50 465568 ZC QPADEVOOOT PMCSI 471622 QDZTDO0001 OTEMP 2012 08 21 09 12 50 465744 ZC QPADEVOOOT PMCSI 471622 QDZTDO0001 OTEMP 012 08 21 09 12 50 465744 ZC QPADEVOOOT PMCSI 471622 QDZTDO0001 OTEMP Documentation Quick CSi 36 QUIGK GSI 4 2 1 On demand Enrties per User profile L dition par type de poste permet de produire un rapport de toutes les op rations li es un profil utilisateur sp cifique PRINT AUDIT ENTRIES PER USER User profile
26. process for the selected type of entry Documentation Quick CSi 28 QUICK CSi 7 4 1 2 Display entries Option 5 in front of a type of entry displays all records corresponding with this type of operation CO Create object in this example PMPAG Interrogation File CSI CO PMCSIUSR Mbr CSI CO View CSI CO PMCSI Fmt QASYCOJ5 Select option then press Enter 5 Display Job User Job Type Timestamp name name number CO 2012 08 09 00 00 02 416512 PMGUIV311 QTMHHTTP 468939 CO 2012 08 09 00 00 02 417488 TRADERS QTMHHTTP 468941 CO 2012 08 09 00 00 02 419104 PMGUI QTMHHTTP 468931 CO 2012 08 09 00 00 02 420000 PMGUI QTMHHTTP 468938 CO 2012 08 09 00 00 02 420864 ADMIN QTMHHTTP 468925 CO 2012 08 09 00 00 02 424480 IWADFT QTMHHTTP 468926 CO 2012 08 09 00 00 02 426112 ZENDSVR QTMHHTTP 468942 CO 2012 08 09 00 00 02 427680 PMSD QTMHHTTP 468930 CO 2012 08 09 00 00 02 431296 TRADERS QTMHHTTP 468951 CO 2012 08 09 00 00 02 434944 PMSD QTMHHTTP 468935 Parameter or Command D but gt F2 Select F3 Exit F4 Invite F6 Position to F7 Chg file F8 Para F24 Records are displayed sorted by data time of the operation The field Time Stamp giving the information is formatted as AAAA MM JJ HH MM SS ssssss 5 Display Display the detail of the operation S Spools Display associated spool files produced by the supervisor F2 Select cursor position column F10 F1
27. rt sub system PMCSI o End sub system PMCSI o Display jobs from the sub system PMCSI Start supervisor o Submit the supervisor which will collect data 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 3 1 ARCHIVE The archive function allows to export data from the main library PMCSIUSR to an archive library It would be done for Limit the size of the main database giving better performance for queries gt Prepare organize backup of data gt Clean up Archive CSi data PMCSIARC Type choices press Enter Archive untill fk ew Date Archive library o oeo ko PMCSIARC Name gt Indicates the limit date for exportation of data gt Indicates the target archive library By default archive is done in PMCSIARC library The name of the library is free and any other name can be used for archive Exported data can be stored in different libraries for example one library per month PMCSI JAN PMCSI FEB All options dedicated for queries and print stay available for any library which will contain Quick CSi archived data Documentation Quick CSi 20 QUICK CSi 7 3 2 BACK UPS Depending on company rules audit information must be kept for a long time may be years Based on these rules backup of Quick CSi libraries must be well organized In case of a control auditors can ask to restore audit information Backups must be organized allowing answering any request Save Library SAVLIB
28. rying a specific object displaying all operation done for this object PMPAG Interrogation File PMCSI OB PMCSIUSR Mbr PMCSI OB View PMCSI OB PMCSI Fmt CSIOBJR Select option then press Enter 5 Display Object Object Entry Librar Name Type Code Time stamp SS SSEDHJRN RCV160 JRNRCV DO 2012 08 26 12 00 04 941872 SSEDHJRN RCV161 JRNRCV DO 2012 08 26 12 00 05 015744 _ SEDHJRN RCV162 JRNRCV DO 2012 08 26 12 00 05 078752 _ SEDHJRN RCV163 JRNRCV DO 2012 08 26 12 00 05 157840 _ SEDHJRN RCV164 JRNRCV ZC 2012 08 26 17 37 27 572752 SSEDHJRN RCV165 JRNRCV CA 2012 08 26 17 37 26 546112 SSEDHJRN RCV165 JRNRCV CO 2012 08 26 17 37 26 546192 _ SEDHJRN RCV165 JRNRCV ZC 2012 08 26 17 37 27 572144 _ SSEDHJRN RCV166 JRNRCV ZC 2012 08 28 19 03 24 175072 _ SEDHJRN RCV167 JRNRCV CA 2012 08 28 19 03 23 099696 Parameter or Command D but gt F2 Select F3 Exit F4 Invite F6 Position to F7 Chg file F8 Para F24 The table is organized by Library Object Object type Time stamp Operations are displayed using this sequence Function key F6 gives position to a specific object Reach File PMCSI OB CSi Journal entries Object Format CSIOBJR Red 530389 Enter the value for the different fields Field Text Value OBOLIB Library name SSEDHJRN OBONAM Object name RCV165 OBOTYP Object type IRNRCV OBTSTP Time stamp 2012 09 02 12 00 22 708992 I
29. s F9 to select the type of filter you want to create F3 Exit F5 Refresh F9 Select F12 Cancel Press F9 to select the type of filter you want to create FILTER CRITERIA 1 Job name 2 User profile name Option g F12 Cancel Select the criteria you want to define Note F9 is always available to switch between the different criteria 15 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE When the criteria is selected the following screen is displayed Quick CSi DEFINITION DES SELECTIONS ET OMISSIONS Indicate name or generic name to be omitted Criteria Users Filter Ar 0 User profile O user profile criteria r profile O QNOTES O PMSOFT A suivre F3 Exit F5 R afficher F9 S lection F12 Annuler Enter the values as name or genric name for the selected criteria d ba N Filters are optional and can be used for specific type of entry After you defined some filters use again the management of types of enrty to apply filters on the types of entry Options for type of entry Select how to use filters for the type of entry OPTIONS FOR TYPE OF ENTRY DECHE 53425 AUD COGS ss GR Description General purpose audit record 0 No 1 Yes 0 No 1 Yes 0 No 1 Yes J Job U User Threshold Manage entries Automatic reporting Filters for report Threshold Usage of Filter criteria 0 No The report will not use filters 1 Yes The report will us
30. s PMCSI and PMCSIUSR will have the following right definition Owner PMCSI gt PUBLIC rights EXCLUDE gt Authorization list PMCSI 9 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 2 1 2 Activate Audit on Objects After the audit is started on the system it must be activated on application objects and database It is recommended to activate it on all objects of ALLUSR libraries but the system manager can defined it based on a sub set of libraries or applications The following window is displayed ACTIVATE AUDIT ON OBJECTS tAbrartes sus ss ALL Submit a batch job 1 1 Yes F3 Exit F12 Cancel gt Indicates a name of a library or a generic name A CHGOBJAUD will be executed for each object of the selection The option can run interactively or submitted as a batch job 1 Yes A batch job is submitted to activate audit 0 No The CHGOBJAUD runs in interactive mode Audit can be activated step by step depending on the availability of applications Note CHGOBJAUD will modify every object of the selection This operation can impact the next backup of the libraries if a SAVCHGOBJ is used all objects will be included in the next backup Documentation Quick CSi 10 QUICK CSi amp 2 1 3 Activate Audit on User profiles To complete the audit protection it is also possible to activate audit capability on user profiles Using CMD level on user profiles the audit will trace all comm
31. supervisor 3 7 1 Start the supervisor Option 9 starts the supervisor The job will be in charge of the data collection from the audit journal and associated reporting based on parameters SUBMIT SUPERVISOR Indicates time for first collect and press Enter Time for first collect 6 00 00 0 Immediate process F3 Exit F12 Cancel Indicate the time of the first extraction of data Following extraction will be done depending on the periodicity defined in the general parameters 3 7 2 End the supervisor Option 10 ends the supervisor A command ENDJOB is submitted for the active supervisor job Documentation Quick CSi 26 QUICK CSi amp 4 MANAGEMENT OF DATA Option 3 of the main menu displays the following menu QSLFRA2 65117EA Quick CSi gea 9 08 12 ro Bibliotheque de 11 42 14 F donn es V12_0817 CSI Manage collected data Library sss PMCSIUSR Select one of the following options Queries Printout 1 Audit by Type of entry 11 Audit by Type of entry 2 Audit by Object 12 Audit by Object 3 Audit by User 13 Audit by User 18 PMCSI sub system jobs 19 Work with Spool files Option or command gt F3 Exit F4 Prompt F9 Repeat F12 Cancel The menu proposes three options to query the data and three options for printouts gt Queries o Query by type of journal entry o Query by Object o Query by User profile gt Printouts o Printouts by t
32. tecedseueessessucasscnnsteneenastisennasteantcantucs 39 5 2 DEFINE A USER VIEW ark 40 BAL Crteate a E 41 FAT Definiti n Re ET EE 42 5 2 1 Save the view definition 43 11 09 2012 TRADER S Les solutions QUICK SOFTWARE LINE 1 CONCEPTS The audit part of Quick EDD HA will be used to trace system and application operations from the Audit journal Periodically the Quick CSi supervisor will collect data from the journal receivers and will produce automatic reporting for all the operations we would like to control Quick CSi will activate audit on the system for applications and user profiles if it is not already active Settings will allow defining how to supervise the different operations and will produce automatically the reports based on selection Quick CSi will manage the different steps gt Extraction Collect data from journal receivers and storage in Quick CSi database gt Gestion The journal receivers will be automatically managed by Quick CSi Clean up can also be automated gt Archivage The amount of data generated by the audit can be important It needs a well organization of data to be archived on tapes and staying available in case of auditor requests All operations of Quick CSi are processed in a dedicated sub system PMCSI They are submitted manually or automatically depending on settings Automatic reporting is done based on settiings Queries on the datatbese is also available from the menus in
33. teractive and reporting A specific option of Quick CSi allows to implement exit programs on different exit points of the system The exit programs will collect information for each access to the system through the fdifferent TCP IP functions FTP Telnet SQL The information will be converted as an audit journal entrie All access information will be available as any operation provided by the audit Interactive queries functions are based on a special module called PM PAGE This module can query any DB2 file allowing multi criteria for display and printouts See PM PAGE topic at the end of the document Documentation Quick CSi 4 QUICK CSi 7 1 4 GENERAL SCHEME The i5 Audit traces all operation done all audited objects and or by audited users PERIODIC The supervisor automaticall extracts data from journal PROCESS f gr receivers and store information in the period database The supervisor produces all reports based on settings from the period database After that data are copied to the main database of Quick CSi Filters Automatic REPORTING The database is available for all queries and reporting An ARCHIVE function allows to extract data from the main databse ARCHIVING to be stored into different databases allowing a better management of the storage and preparing a storage on tapes Fr Backups Archive libraries must C gt be stored on tapes allowing a
34. ype of journal entry o Printouts by Object o Printouts by User profile Data library On the top right the menu displays a specific field Library by default the main library PMCSIUSR This field can be modified to select any archive library created by Quick CSi 21 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE 4 1 QUERY FUNCTION Note All query functions are based on a specific module called PM PAGE allowing queries with multi criteria It includes capabilities to select columns and options for extraction and printouts This module is described at the end of this document 4 1 1 Query by type of journal entry Option 1 displays the list of type of journal entry DISPLAY AUDIT ENTRIES 5 Display S Spools Slt Code Description Gst Prt Alr _ D NDB exit point entry Native Data base 1 0 0 _ F FTP exit point entry 1 1 0 _ zb REXEC exit point entry 1 1 0 S SQL exit point entry 1 1 0 T TELNET exit point entry 1 0 0 _ AD Object auditing attribute change 1 0 0 AF Authority failure 1 0 0 AP Program adopt 1 0 0 _ AU Attribute changed 1 0 0 8 CA Change of authority 1 1 0 _ CD Command string 1 1 0 CO Object created 1 1 0 e o 0 F3 Exit F5 Refresh F12 Cancel Two options are available 5 Display o Display all records corresponding with the selected type of entry S Spools o Display all spool files generated by the automatic reporting
35. ype reply if required press Enter CSi Audit is now active on the system CSi User profile PMCSI has been created CSi Archive process submitted CSi Archive CSi data in library PMCSIARC till 2012 08 25 CSi Archive done in library PMCSIARC CSi Recovery will be done from receiver AUDRCV0219 CSi End of supervisor sent The message queue contains all messages generated by the supervisor and archive functions 23 11 09 2012 TRADER S Les solutions QUICK S0OFTWARE LINE This option allows to restart the extraction of data from a specific journal receiver RECOVERY FOR EXISTING RECEIVER Indicates the first journal receiver Audit journal receiver AUDRCV0219 Receiver library PMCSIJRN F3 Exit F12 Cancel Quick CSi manages automatically the journal receivers for the audit journal It will automates the replacement of journal receivers and the extraction of data from the receivers to the Quick CSi database After the installation of the product if audit already exist or after a system operation it can be required to give the position on a journal receiver allowing the supervisor to restart the extraction of data gt Indicates the name of the first journal receiver to be used by the supervisor The process will be done from this receiver to the current journal receiver associated to the audit journal QSYS QAUDJRN This option is mandatory before starting the journal receiver the
Download Pdf Manuals
Related Search