Check for altered objects

This article describes how to use the Check Object Integrity (CHKOBJITG) command to look for objects that have been altered.

An altered object is usually an indication that someone is attempting to tamper with your system. You might want to run this command after someone has:

Restored programs to your system
Used dedicated service tools (DST)

When you run the command, the system creates a database file containing information about any potential integrity problems. You can check objects owned by one or more profiles, objects that match a path name, or all objects on the system. You can look for objects whose domain has been altered and objects that have been tampered with. You can recalculate program validation values to look for objects of type *PGM, *SRVPGM, *MODULE, and *SQLPKG that have been altered. You can check the signature of objects that can be digitally signed. You can check if libraries and commands have been tampered with. You can also start a integrated file system scan or check if objects failed a previous file system scan.

You can also recalculate program validation values to look for objects of type *PGM, *SRVPGM, *MODULE, and *SQLPKG that have been altered. Running the CHKOBJITG program requires *AUDIT special authority. The command might take a long time to run because of the scans and calculations it performs. You should run it at a time when your system is not busy.

Important: To prevent impacts to either performance or system operations, distribute ownership of objects to multiple profiles. Do not assign all (or nearly all) objects to only one owner profile.