What is audited (logged) on IBM i is controlled by several system values, user profile settings and object configurations. You can audit actions on a system-wide basis or for an individual user. You can also audit the use or modification of objects. Let’s take a look.
If auditing isn’t enabled on your system, the easiest way to get started is to run the Change Security Auditing (CHGSECAUD) command. If it doesn’t exist, the system-required journal – QAUDJRN – is created in QSYS, an audit journal receiver attached and a default set of system-wide actions to audit are configured.
CHGSECAUD QAUDCTL(*OBJAUD *NOQTEMP *AUDLVL)
IBM i Auditing is enabled when you change the QAUDCTL system value to something other than *NONE. Adding the *AUDLVL value means that actions specified in the QAUDLVL system value or at the user level via the Change User Auditing (CHGUSRUAD) command are enabled. Adding *OBJAUD allows for the auditing of the reads or changes to individual objects. Finally, the value of *NOQTEMP means that some actions on objects in a job’s QTEMP library will not be audited. (See the topic ‘Choosing not to audit QTEMP objects’ in Chapter 9 of the IBM i Security Reference manual to understand what is and is not audited in the QTEMP library.)
You can also configure audit journal in IBM i Navigator using "Auditing Configuration" under "Audit Journal" in the "Security" menu:
Notes:
The system requires that QAUDJRN be created into the QSYS library.
We recommend that you create a separate library for your audit journal receivers and secure the library. End users should not have access to this information! The system will always write an audit journal entry even if the user taking the action that causes an entry has no authority to the journal and receivers.
Do not store your audit journal receivers in QSYS. QSYS is rarely in an organization’s backup strategy so it’s possible that journal receivers in QSYS aren’t being backed up!
The type of actions that can be audited is long and vast. The most comprehensive documentation for these values is Chapter 9 of the IBM i Security Reference manual. You will want to read through the list to understand your options but a good place to start is with IBM’s (and Kisco System’s) recommended list. (This is also the default set of actions configured when running CHGSECAUD.)
When modifying QAUDLVL using the Change System Value (CHGSYSVAL) command, be aware that you can specify more values than will fit! This is because some of the values such as *SECURITY now have values that are a subset of the overall *SECURITY category – these values *SECCFG, *SECDIRSRV, *SECIPC, *SECNAS, *SECRUN, *SECSCKD, *SECVFY and *SECVLDL allow you to narrow the scope of the security-related activities that are logged. If you experience this limit, simply specify *AUDLVL2 in your list of values for QAUDLVL. This signals the operating system to look for more values in QAUDLVL2. Now you can continue your list of actions to audit in the QAUDLVL2 system value.
Dealing with this possible limit and green screen commands in general, is often clunky. So you may prefer to configure auditing using the Navigator for i interface. Sign in, click on the open padlock -> Audit Journal -> Auditing configuration as shown below.
Now you can configure QAUDCTL simply by checking the appropriate boxes and configure system-wide action auditing by clicking the action’s slide bar. Behind the scenes, this display handles the issue with specifying too many actions for QAUDLVL and will specify them in QAUDLVL2 and add the continuation value *AUDLVL2 to QAUDLVL.
Original Kisco U content updated by:
Carol Woodbury
IBM i Security Advisor
Kisco Systems
RELATED POSTS
BROWSE KISCO U
PRODUCT CONTENT
