Users with powerful authorities can have the keys to your entire system. An *ALLOBJ user can do almost anything — access any file, change any object, run any command. The best practice for these users is to limit the number of them, then make sure you know when they are accessing your system.
Related: Discovering profiles with special authorities
Our IBM i monitoring software (iEventMonitor) includes built-in watch tasks to identify, log and alert for specific user login activities.
Use the iEventMonitor User Profile Watch task to log and alert for logins from individual profiles. For example, the powerful QSECOFR admin profile should rarely be used for interactive login. We strongly recommend alerting for any login from this profile.
To do this in iEventMonitor, just create a new User Profile Watch Task and specify QSECOFR as the Profile to Watch.
Set Report Initial Status to NO to simply receive notifications for any future logins. If you have configured shifts in iEventMonitor then you also have the option to only run this watch task during a specific shift.
Finally, you may want to automate certain other actions when the login is detected. You can code and map your own custom exit programs to your watch task, then iEventMonitor will pass data to your program and run it every time the watch task generates an alert.
New in iEventMonitor 9.12 — use the Privileged User Watch Task to log and alert for logins from ANY user profile with special authorities.
You can specify the Authority Levels you want to alert for. *ALLOBJ being the highest risk profile, we recommend that setting at a minimum. All the other settings are the same as described above.
Logins from these profiles look like this in the iEventMonitor activity log:
Existing customers can request the 9.12 PTF from support@kisco.com
User Profile monitoring is just one of many features included with the product. iEventMonitor is a light weight, 100% native IBM i solution for system and security monitoring and alerting. Refer to the product website for more information.
RELATED POSTS
BROWSE KISCO U
PRODUCT CONTENT
