Joblog Authority

[centill...@my-deja.com]

Has anybody tried to debug a Production job and went to view the joblog
and received the message "Not authorized to display job log." At my
shop, mgmt is securing the AS/400 object authority and the Pgmr's are
having difficulty in debugging applications because the joblog is
inaccessible. We already have the User Profiles setup with minimum
authority, but we do have the *JOBCTL Special Authority value. What is
the keyword in the CHGUSRPRF command which will allow access to view a
joblog???

Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.

[Tim]

Anyone with *JOBCTL special authority can view any job's job log. Except
that,
only a user with *ALLOBJ authoriy can view the job log of another user that
has *ALLOBJ authority.

<centill...@my-deja.com> wrote in message
news:7jped4$v2h$1...@nnrp1.deja.com...

[Marty Winkler]

I am not totally sure of you security setup, but any time a user with
*ALLOBJ authority runs a job no one with less authority can view the
*joblog. Our solution was to remove *ALLOBJ from everyone.

[Yann METAIRIE]

And what about the *SPLCTL authority ? A joblog is a spool ?

BR

Yann

Marty Winkler a écrit dans le message <376103B0...@aktion.com>...

[Christian GSTALDER]

Hi again Yann ;-),

No, centille is looking at an active job's joblog (DSPJOB option 10 or
DSPJOLOG).

So it's not a spool.

BTW, did you get my Email?

--
<cgst...@nospam.chpg.mc>

Christian Gstalder
Yann METAIRIE a écrit dans le message <7jr6th$9a1$1...@mars.worldonline.fr>...

[Terry Herrin]

On Fri, 11 Jun 1999 08:40:16 -0400, Marty Winkler
<mwin...@aktion.com> wrote:
>I am not totally sure of you security setup, but any time a user with
>*ALLOBJ authority runs a job no one with less authority can view the
>*joblog. Our solution was to remove *ALLOBJ from everyone.

This was not an option for us, as some of the joblogs in question were
being created by jobs running under profiles which *have* to have
*ALLOBJ authority. My solution was to create a new command called
DSPANYLOG, which accepts the same parameters in the same manner as the
DSPJOBLOG command. The new command executes a CL program which
accepts the incoming parameters and does a DSPJOBLOG using the given
parameters. Any messages are received and passed back to the previous
calling program in the stack. The CL program is owned by QSECOFR and
adopts owner authority.

Terry Herrin
Sr. Programmer/Analyst
New Hanover Regional Medical Center
Wilmington, NC

[gostr...@fcci-group.com]

In article <m2Z73.423$4p2...@news.rdc1.ne.home.com>,

"Tim" <scot...@home.com.xyz> wrote:
> Anyone with *JOBCTL special authority can view any job's job log.
Except
> that,
> only a user with *ALLOBJ authoriy can view the job log of another
user that
> has *ALLOBJ authority.
>

That is not true. We have two profiles that we use for running batch
jobs that programmers cannot view the joblogs. ( We have others but
only have problems with these two.) Both profiles have a user class of
*USER. One profile has only *JOBCTL special authority and the other
has special authority of *NONE. The group profile does not have any
special authority either.

[Tim]

Your analysis must be mistaken. According to the CL Command reference:

1. To display a job log, the user must have special job control authority
(*JOBCTL), or the job must have the same user name as the person running
this command.

2. To display a job that is running for the security officer or a member of
the security officer group, the user also must have *ALLOBJ special
authority.

But don't take my word for it:

http://publib.boulder.ibm.com/cgi-bin/bookmgr/BOOKS/QB3AU402/2.1.182

<gostr...@fcci-group.com> wrote in message
news:7k8j0b$olh$1...@nnrp1.deja.com...

[gostr...@fcci-group.com]

In article <42Y93.712$4p2...@news.rdc1.ne.home.com>,

Are you trying to say that IBM's reference books are never wrong?

[Tim]

It is more likely that you are wrong than the reference books.

Since joblog authority has always worked this way

<gostr...@fcci-group.com> wrote in message
news:7kr4o8$cmv$1...@nnrp1.deja.com...

[Thomas]

Gostrander:

IMHO...

He's not necessarily saying they're never wrong; but if they don't match
what's happening at your site, you should be speaking with IBM support
and getting it fixed (either your system or the documentation).

As useful as it can be to point out in the NG that your site contradicts
the documentation, it does no one any good to go beyond that. By
mentioning the contradiction, you raise the possibility of a needed PTF
or a documentation fix. As soon as you know your situation doesn't match
the manuals, you should start on getting things right -- unless it's not
your job.

Tom Liotta

In article <7kr4o8$cmv$1...@nnrp1.deja.com>,

--
Tom Liotta
AS/400 systems programmer

[gostr...@fcci-group.com]

In article <oZ8c3.1034$4p2...@news.rdc1.ne.home.com>,

"Tim" <scot...@home.com.xyz> wrote:
> It is more likely that you are wrong than the reference books.
>
> Since joblog authority has always worked this way

I can gaurantee that the docs are wrong here. We have had several very
knowedgeable people working on this for at least two years. I am
currently working with IBM support on these authority problems.

[gostr...@fcci-group.com]

In article <7ks852$q48$1...@nnrp1.deja.com>,

Thomas <tho...@inorbit.com> wrote:
> Gostrander:
>
> IMHO...
>
> He's not necessarily saying they're never wrong; but if they don't
match
> what's happening at your site, you should be speaking with IBM support
> and getting it fixed (either your system or the documentation).
>
> As useful as it can be to point out in the NG that your site
contradicts
> the documentation, it does no one any good to go beyond that. By
> mentioning the contradiction, you raise the possibility of a needed
PTF
> or a documentation fix. As soon as you know your situation doesn't
match
> the manuals, you should start on getting things right -- unless it's
not
> your job.
>

The "smiley face" didn't go through. The comment was meant to be
humorous.

I am working with IBM on the authority problems.