Finding Missing Log Entries

If the LOGANALYZER report does not include log entries that you expected to be there, it might be due to one of the following reasons:

  • You might need to use the LOGGING (Logging Options) system command to enable logging of the specified log entry type. Refer to the System Log Programming Reference Manual for information about selecting the type of entry to be logged.

  • On systems with the Secure Access Control Module or Secure Accountability Facility, by default LOGANALYZER excludes entries with a usercode different from the usercode under which the LOGANALYZER process runs. This is the case even if LOGANALYZER is running under a privileged usercode.

    To see all log entries, it might be necessary to run LOGANALYZER under a privileged usercode and also to specify “USERCODE.” in the LOGANALYZER command. Refer to the discussion of the USERCODE option later in this section.

  • The MCP and log analysis software limits access to security-related log entries. Security sensitive TCP/IP records are written to the SECURITYLOG file (*SYSTEM/SECURITYLOG). Only privileged users can access this file. When security administrator status is authorized, only users with SECADMIN privilege can access it.

  • Log entries may be discarded due to a full LOG DL family. The system keeps track of the time periods when the logs are discarded and stores them in the log. Refer to the System Log Programming Reference Manual for more information. These time periods, if they exist, are displayed on the heading page.