Important Updates to Cybersecurity Software
HelpSystems is updating the names of our cybersecurity software, including the Powertech product line. Don’t worry—the functionality of your products won’t change.
See the new names here > New, Clearer Names for HelpSystems Security Software.
To track system audit journal events, activate the IDTAUDxx4 or IDTAUDxx5 file in the DATATHREAD library that corresponds to the event you want to monitor. To configure this, use Option 11 within Database Monitor for IBM i.
For example, to monitor for invalid passwords, track IDTAUDPW4. You should only track ADDS to those files, never updates (which will never happen) and deletes (which are cleared hourly). These files already exist in DATATHREAD and are there to receive the system audit journal reader (IDT475) event entries.
Those writes the IDTAUDxx files cause the Database Monitor for IBM i trigger to fire, and that's how transactions are delivered into the system.
Also, be sure the ALWSYSJRM parameter is set to Y in Option 12 within Database Monitor for IBM i, and that the IDT475 job is running in the DATATHREAD subsystem.
Note: For complete details, see the Data Thread Administrator's Guide.
Still have questions? We can help. Submit a case to Technical Support.