March 14, 2012 - Vol 2, Issue 6
Carsten's Security Code for IBM i
Managing the Online Retention of Audit Data using RMVJRNRCV
Code By Carsten Flensburg Article by Dan Riehl
With Downloadable Source Code
When you decide to begin auditing security related events on your system to the QAUDJRN journal, or when you start journaling changes to physical files, data areas or data queues, you must also decide how you are going to manage the online retention of the journal's receivers.
The journal receivers are the storage areas used for the audit records generated by system auditing or database journaling. If left unchecked, these journal receivers will continue to expand in size and number, and may ultimately consume all of your available disk space.
When you want to control how long journal receivers are available online, you will want to "age" the receivers. For example, if you want to keep five days' worth of transactions online, you can either manually delete the old receivers or run the RMVJRNRCV(Remove Journal Receivers) command presented here.
The Remove Journal Receivers (RMVJRNRCV) command lets you age the receivers and optionally connect the journal to a new receiver.
You can run this command from a command line, or better yet, place the command in your job scheduler to ensure daily or weekly "Aging" of your journal receivers.
You can use this command to manage all of your journals, including QAUDJRN and database journals to perform an intelligent deletion of old receivers.Here's a view of the RMVJRNRCV command prompt:
Remove Journal Receivers (RMVJRNRCV) Type choices, press Enter. Journal . . . . . . . . . . . . ______ Name Library . . . . . . . . . . . *LIBL Name, *LIBL, *CURLIB Journal receiver retain days . . *NONE 1-999, *NONE Journal receivers to retain . . *NONE 1-999, *NONE Force receiver deletion . . . . *NO *NO, *YES Change journal receiver . . . . *NO *NO, *YES Journal receiver: Journal receiver . . . . . . . *GEN Name, *SAME, *GEN Library . . . . . . . . . . Name, *LIBL, *CURLIB Journal receiver . . . . . . . Name, *GEN Library . . . . . . . . . . Name, *LIBL, *CURLIB Sequence option . . . . . . . . *CONT *CONT, *RESET
The command performs a clean-up process against the specified journal's receiver directory. You can specify the number of journal receivers to retain, the number of days (since detachment), or a combination of both.
The force parameter controls whether the journal receivers should be saved to be eligible for deletion and, for remote journals, whether replication should occur.
Optionally, you can have the CHGJRN command run to change the journal receiver (before directory clean up).
Carsten has also included the Sequence option so you can ensure that the journal entry numbering is continued, regardless of the current default value on the CHGJRN command.
For more details about command parameters and command usage, refer to the help panel group.
The following source code is included in the download Zip file. Review the source code headers for compile instructions and additional documentation.
Member Name Source Description CBX959 RPGLE Remove Journal Receivers -- CPP CBX959H PNLGRP Remove Journal Receivers -- Help CBX959V RPGLE Remove Journal Receivers -- VCP CBX959X CMD Remove Journal Receivers -- CMD
Note:As with all new programs, test these routines thoroughly before placing them into a production environment. No warranty is expressed or implied.
About the Author
Carsten lives in Copenhagen, Denmark, with his wife, Dorthe, and his two children, Julian and Emilie.