2008-10-20 如何記錄 Command CHGSYSVAL 的使用？

如何記錄 Command CHGSYSVAL 的使用？

原則上系統已經提供稽核日誌 (Audit journal)方式記錄任何更改系統值的行為。但那是要啟動稽核功能才有效，
況且啟動稽核功能也會對系統效能有些許影響。那要如何在不啟動稽核功能下，記錄Command CHGSYSVAL 的使用。

當使用 CHGSYSVAL 更改任何系統值，系統會寫一筆 MSGID CPF1806 訊系至 QHST History log，但是卻未寫入 QSYSOPR，
這使得要找是誰更改了系統值，都必須使用 DSPLOG MSGID(CPF1806)查詢，所以要如何將使用 CHGSYSVAL 的紀錄寫入 
QSYSOPR中？使用 Command Exit Point QIBM_QCA_CHG_COMMAND 指定程式記錄指令 CHGSYSVAL 的使用。
下述範例會將 CHGSYSVAL 指令執行字串送至 QSYSOPR。


File  : QCLSRC
Member: CHGCMDEXIT
Type  : CLP
Usage : CRTCLPGM PGM(your-lib/CHGCMDEXIT)
        ADDEXITPGM EXITPNT(QIBM_QCA_CHG_COMMAND) FORMAT(CHGC0100)   
                   PGMNBR(*LOW) PGM(your-library/CHGCMDEXIT)        
                   PGMDTA(*JOB 20 'CHGSYSVAL QSYS      ')           
        使用 CHGSYSVAL 更改系統值，DSPMSG QSYSOPR 會看到類似下述 Change system value 訊息：
        *** Change system value : 732619/VENGOAL/QPADEV001T CHGSYSVAL SYSVAL(QPFRADJ) VALUE('1'). 
        
        若欲移除設定執行：
        WRKREGINF
        
                              Work with Registration Information                       
                                                                               
Type options, press Enter.                                                     
  5=Display exit point   8=Work with exit programs                             
                                                                               
                           Exit                                                
     Exit                  Point                                               
Opt  Point                 Format    Registered  Text                          
 8   QIBM_QCA_CHG_COMMAND  CHGC0100     *YES     Change command exit programs  
     QIBM_QCA_RTV_COMMAND  RTVC0100     *YES     Retrieve command exit program 
     QIBM_QDB_OPEN         DBOP0100     *YES     Open Database File Exit Progr 
     QIBM_QHQ_DTAQ         DTAQ0100     *YES     Original Data Queue Server    
     QIBM_QIMG_TRANSFORMS  XFRM0100     *YES                                   
     QIBM_QJO_DLT_JRNRCV   DRCV0100     *YES     Delete Journal Receiver       
     QIBM_QLZP_LICENSE     LICM0100     *YES     Original License Mgmt Server  
     QIBM_QMF_MESSAGE      MESS0100     *YES     Original Message Server       
     QIBM_QMH_REPLY_INQ    RPYI0100     *YES     Handle reply to inquiry messa 
     QIBM_QNPS_ENTRY       ENTR0100     *YES     Network Print Server - entry  
     QIBM_QNPS_SPLF        SPLF0100     *YES     Network Print Server - spool  
                                                                       More... 
Command                                                                        
===>                                                                           
F3=Exit   F4=Prompt   F9=Retrieve   F12=Cancel                                 

                           Work with Exit Programs                             
                                                                               
Exit point:   QIBM_QCA_CHG_COMMAND     Format:   CHGC0100                      
                                                                               
Type options, press Enter.                                                     
  1=Add   4=Remove   5=Display   10=Replace                                    
                                                                               
              Exit                                                             
            Program     Exit                                                   
Opt          Number     Program        Library                                 
                                                                               
4                 1     CHGCMDEXIT     EXITPGM                                 
                                                                               
                                                                               
                                                                               
                                                                               
                                                                               
                                                                               
                                                                               
                                                                        Bottom 
Command                                                                        
===>                                                                           
F3=Exit   F4=Prompt   F5=Refresh   F9=Retrieve   F12=Cancel                    


或執行        RMVEXITPGM EXITPNT(QIBM_QCA_CHG_COMMAND) FORMAT(CHGC0100) PGMNBR(1)                       

/******************************************************************/
/*  Use the following CL command to create the CHGCMDEXIT pgm     */
/*  in a library of your choice.                                  */
/*                                                                */
/*    CRTCLPGM PGM(your-library/CHGCMDEXIT)                       */
/*             SRCFILE(your-library/source-file)                  */
/*                                                                */
/*  Use the following CL command to cause the CHGCMDEXIT pgm      */
/*  to be called each time anyone uses the CRTRPGPGM CL command.  */
/*                                                                */
/*    ADDEXITPGM EXITPNT(QIBM_QCA_CHG_COMMAND) FORMAT(CHGC0100)   */
/*               PGMNBR(*LOW) PGM(your-library/CHGCMDEXIT)        */
/*               PGMDTA(*JOB 20 'CHGSYSVAL QSYS      ')           */
/*                                                                */
/******************************************************************/
             PGM        PARM(&EXITINFO &RPLCMD &RPLLEN)
             DCL        &EXITINFO *CHAR 4000
             DCL        &RPLCMD   *CHAR 3950
             DCL        &RPLLEN   *CHAR 4
             DCL        &ALWCHG  *CHAR 1 /* change allowed ? */
             DCL        &OFFSET  *DEC (6 0) /* offset to command */
             DCL        &CMDLEN  *DEC (6 0) /* length of command */
             DCL        &CHGSYSVAL *CHAR 9 'CHGSYSVAL'
             DCL        &MSGTXT    *CHAR 256
             DCL        &JOB       *CHAR 10
             DCL        &JOBUSR    *CHAR 10
             DCL        &JOBNBR    *CHAR  6

             CHGVAR     VAR(%BIN(&RPLLEN)) VALUE(0) /* set return +
                          parameter to indicate the command has +
                          not been changed yet */

      /*  Extract values from the input parameter structure.     */
             CHGVAR     VAR(&ALWCHG) VALUE(%SST(&EXITINFO 49 1)) +
                          /* get command is allowed to be +
                          changed indicator */
             CHGVAR     VAR(&OFFSET) VALUE(%BIN(&EXITINFO 53 4)) +
                          /* get offset to command string */
             CHGVAR     VAR(&OFFSET) VALUE(&OFFSET + 1) /* add +
                          1 because CL offset start at 1 +
                          instead of 0 */
             CHGVAR     VAR(&CMDLEN) VALUE(%BIN(&EXITINFO 57 4)) +
                          /* get length of command string */

             IF         COND(&CMDLEN > 3930) THEN(RETURN) /* exit +
                          if the command is too big to fit in +
                          the return variable */

             CHGVAR     VAR(&RPLCMD) VALUE(%SST(&EXITINFO &OFFSET +
                          &CMDLEN)) /* copy input command to +
                          output parameter */

             IF         (&CMDLEN > 9 *AND  +
                         %SST(&RPLCMD 1 9) *EQ &CHGSYSVAL) DO
             RTVJOBA    JOB(&JOB) USER(&JOBUSR) NBR(&JOBNBR)
                         CHGVAR &MSGTXT +
                               ('*** Change system value :' *BCAT +
          &JOBNBR *CAT '/' *CAT &JOBUSR *TCAT '/' *CAT &JOB *BCAT +
                                 %SST(&RPLCMD 1 &CMDLEN))
             SNDPGMMSG  MSGID(CPF9898) MSGF(QCPFMSG) MSGDTA(&MSGTXT) +
                          TOUSR(*SYSOPR)
             ENDDO



             ENDPGM