Set up security auditing

This article describes how to set up security auditing, explains why it is important, and provides step-by-step instructions. The system collects security events in the QAUDJRN journal.

Setting up auditing requires *AUDIT special authority. To set up security auditing, do the following steps:

Create a journal receiver in a library of your choice by using the Create Journal Receiver (CRTJRNRCV) command. This example uses a library called JRNLIB for journal receivers.
```
CRTJRNRCV JRNRCV(JRNLIB/AUDRCV0001) +
          TEXT(’Auditing Journal Receiver’)
```
- Place the journal receiver in a library that is saved regularly. Do not place the journal receiver in library QSYS, even though that is where the journal will be.
- Choose a journal receiver name that can be used to create a naming convention for future journal receivers, such as AUDRCV0001. You can use the *GEN option when you change journal receivers to continue the naming convention. Using this type of naming convention is also useful if you choose to have the system manage changing your journal receivers.
- Specify a receiver threshold appropriate to your system size and activity. The size you choose should be based on the number of transactions on your system and the number of actions you choose to audit. If you use system change-journal management support, the journal receiver threshold must be at least 100 000 KB.
- Specify *EXCLUDE on the AUT parameter to limit access to the information stored in the journal.
Create the QSYS/QAUDJRN journal by using the Create Journal (CRTJRN) command:
```
CRTJRN JRN(QSYS/QAUDJRN) +
       JRNRCV(JRNLIB/AUDRCV0001) +
       MNGRCV(*SYSTEM) DLTRCV(*NO) +
       AUT(*EXCLUDE) TEXT(’Auditing Journal’)
```
- The name QSYS/QAUDJRN must be used.
- Specify the name of the journal receiver you created in the previous step.
- Specify *EXCLUDE on the AUT parameter to limit access to the information stored in the journal. You must have authority to add objects to QSYS to create the journal.
- Use the Manage receiver (MNGRCV) parameter to have the system change the journal receiver and attach a new one when the attached receiver exceeds the threshold specified when the journal receiver was created. If you choose this option, you do not have to use the CHGJRN command to detach receivers and create and attach new receivers manually.
- Do not have the system delete detached receivers. Specify DLTRCV(*NO), which is the default. The QAUDJRN receivers are your security audit trail. Ensure that they are adequately saved before deleting them from the system.
Set the audit level (QAUDLVL) system value or the audit level extension (QAUDLVL2) system value using the WRKSYSVAL command. The QAUDLVL and QAUDLVL2 system values determine which actions are logged to the audit journal for all users on the system.
Set action auditing for individual users if necessary using the CHGUSRAUD command.
Set object auditing for specific objects if necessary using the CHGOBJAUD and CHGDLOAUD commands.
Set object auditing for specific users if necessary using the CHGUSRAUD command.
Set the QAUDENDACN system value to control what happens if the system cannot access the audit journal.
Set the QAUDFRCLVL system value to control how often audit records are written to auxiliary storage.
Start auditing by setting the QAUDCTL system value to a value other than *NONE.

Note: The QSYS/QAUDJRN journal must exist before you can change the QAUDCTL system value to a value other than *NONE. When you start auditing, the system attempts to write a record to the audit journal. If the attempt is not successful, you receive a message and auditing does not start.

For more information, see the following topics in the iSeries™ Security Reference:

"Planning the Auditing of Actions"
"Planning the Auditing of Object Access"
"Audit End Action"