IBM i Security and Systems Management News Bytes

December 20, 2012 – Help/Systems, a rapidly growing systems management, security, and business intelligence software company, celebrates its 30th year of business this month with over 43,000 active product licenses.

Founded in 1982 with two employees and a single product for automated job scheduling, the company has grown to 14 offices worldwide with more than 200 employees, 45 products, and 6,300 customers.

Janet Dryer, CEO of Help/Systems, attributes the company’s steady growth to a consistent strategy of agile product development, a rewarding work environment, and a strong commitment to providing world-class customer service and support.

Read the Help/Systems Press Release.

Raz-Lee Security, a leading provider of IBM i security, auditing and compliance solutions, announced today that its iSecurity suite has met the criteria required for attaining IBM certifications in the areas of PureSystems, Security Intelligence, Tivoli and Power Systems.

Raz-Lee Security, is a long-time member of IBM's PartnerWorld, and has partners with IBM in numerous countries worldwide, including the United States, Italy, Germany, Viet Nam, Japan, and Israel.

Read the Raz-Lee Press Release.

Security Shorts -

Important Objects that May Be Improperly
Excluded from your Backup Process

By Dan Riehl

In reviewing numerous systems, there are two categories of data that are routinely not backed up. These are journal receivers of the QAUDJRN journal and the system's History Log (QHST) files.

I believe that in many cases we think that the History Log files are being backed up, so this may be a surprise to you. But in the case of the QAUDJRN journal receivers, there can be many reasons why we don’t back these up regularly.

One common reason why QAUDJRN journal receivers are not saved is based on a High Availability software package in use. Certain HA packages will attempt to maximize disk space by deleting QAUDJRN journal receivers as soon as they are no longer needed by the HA software.

I have seen another common reason why these QAUDJRN journal receivers are not saved. When first setting up the QAUDJRN journal, the initial receiver is placed in the QSYS library, or other new library that begins with the letter 'Q', as in the library name QAUDJRN.

When we do our weekly backup, we select SAVLIB LIB(*ALLUSR). This will skip any library we have created that begins with the letter 'Q', including our QAUDJRN library.

IBM's definition of SAVLIB LIB(*ALLUSR)

*ALLUSR                                                    
    All user libraries are saved. 
    All user libraries with names that do not begin with the letter Q are saved.

Are You Saving QAUDJRN Journal Receivers

If you are auditing security-related events using the QAUDJRN journal, make sure you save the QAUDJRN journal receivers before deleting them. These are often needed when researching security events that have occurred on your system. If you delete the journal receivers before they are saved, your ability to track down changes to the system is severely degraded.

The journal receivers for QAUDJRN should be created in a library that is included in your backup plan. Do not create the QAUDJRN journal receivers in library QSYS, unless you use special processing to save these critical journal receivers.

Special handling of saving the QAUDJRN journal receivers, assuming the receivers reside in QSYS and start with the characters AUDRCV, could look like the following:

SAVOBJ OBJ(AUDJRN*) LIB(QSYS) DEV(TAP01) OBJTYPE(*JRNRCV)

If the receivers reside in a library other than QSYS, you can use your normal backup processes to save the entire library (AUDLIB), including all the journal receivers using the command:

SAVLIB LIB(AUDLIB) DEV(TAP01)

For a full backup, make sure to back up your QAUDJRN journal receivers.

Are You Saving The History Log (QHST) Files

The System History Log is a repository of special system messages that reflect the start and end of each job on the system and includes all important messages generated by user and IBM system jobs on the system. The History Log is the recorded history of the system and as such is a source of crucial information for the system administrator and IT auditor.

The History Log consists of a message queue and a set of data files that reside in the QSYS library. Because saving the QSYS library is typically only performed during a SAVSYS operation, you must make special provisions in your backup routines in order to save the content of the History Log (QHST).

You have probably seen the message that occasionally pops up on the System Operations message queue (QSYSOPR) that states:

CPF2456 - Log version QHST11095A in QSYS closed and should be saved.

As the message says, this log version data file should be saved.

The system creates new QHSTxxxxxxx Log data files as needed to record the content of the QHST LOG message queue.

You can view the current QHSTxxxxxxx data files on your system using the command:

WRKOBJ OBJ(QSYS/QHST*) OBJTYPE(*FILE)

The System Cleanup Options

Make sure these History Log files are backed up before they are deleted. The system automatically deletes these QHSTxxxxx data files according to your specifications on the CLEANUP Menu (GO CLEANUP) options for the number of days to retain "System Journals and System Logs."

This CLEANUP option is normally set to retain 30 days of history in the QHST log data files. Your system may have a different retention period. The QHSTxxxxx data files are deleted on this schedule even if they have not been previously saved.

To back up the QHST log files that currently reside on the system, use the command:

SAVOBJ OBJ(QHST*) LIB(QSYS) DEV(TAP01) OBJTYPE(*FILE)

For a more complete backup, save these QHST data files that reside in library QSYS.