Architecture / Visibility

IBM i Audit Journaling and Logging

IBM i has one of the most detailed native audit trails of any enterprise platform. Almost nobody uses it to its potential without help turning raw journal data into something reviewable.

Last verified

The Security Audit Journal (QAUDJRN)

QSYS/QAUDJRN is the system security audit journal, and when configured, it captures a detailed record of security-relevant events: sign-on attempts, authority failures, object creation and deletion, changes to user profiles, and more, all controlled by the QAUDCTL and QAUDLVL system values. Many systems either have QAUDJRN disabled entirely or configured with a minimal audit level that misses the events that matter most.

*AUTFAILAuthority failures worth investigating for probing behavior
*SECURITYSecurity-relevant system value and configuration changes
*CREATE / *DELETEObject creation and deletion, useful for change tracking
*SAVRSTSave/restore activity, relevant to data exfiltration risk

Object-Level Journaling vs. the Security Audit Journal

QAUDJRN captures system and security events. Application data files need their own object-level journaling (via STRJRNPF or equivalent) to capture record-level changes, before-and-after images of what actually changed in a table. This is a separate configuration decision from QAUDJRN, and it is what makes it possible to answer 'what exactly changed on this record and who changed it,' which QAUDJRN alone cannot answer for application data.

From Raw Journal Data to Something Reviewable

Raw journal receiver data is not human-reviewable at volume. This is where compliance monitoring and audit reporting products (QJRN/400 from Cilasoft, Powertech Compliance Monitor from Fortra, Assure Compliance Monitoring from Precisely, iSecurity Audit from Raz-Lee) earn their cost: they turn journal entries into structured reports, real-time alerts on specific event patterns, and SIEM-forwarded events that get reviewed alongside the rest of your security stack instead of sitting untouched on the IBM i box.

Auditing without review is just storage. The most common gap we see is not missing configuration, it's configured journaling with nobody assigned to actually review the output on a schedule. Decide who reviews what, how often, before you finish the technical configuration.

Vendors Covering This Control

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

  • Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
  • Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
  • Assure Encryption supports field-level and full-database encryption without application changes in most cases
  • Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

  • Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
  • MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
  • Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.

Cilasoft

Cilasoft is a France-based IBM i security vendor best known for QJRN/400 (journal-based auditing and compliance) and its anti-ransomware detection module. It has a long track record in European IBM i shops and growing presence elsewhere.

Strengths

  • QJRN/400 is a mature, well-regarded journal auditing and reporting engine
  • Anti-ransomware module specifically watches for IFS-side encryption behavior originating from network shares, a real and growing IBM i attack vector
  • Strong compliance reporting templates for European regulatory frameworks (GDPR-adjacent controls)

Limitations

  • Smaller North American market presence and partner network than Fortra, Precisely, or Raz-Lee
  • Product line is narrower (auditing and anti-ransomware) rather than a full security suite
  • English-language documentation and support resources are less extensive than French-language resources

Best fit: IBM i shops, especially in Europe, prioritizing journal-based audit reporting and IFS ransomware detection specifically.

Raz-Lee Security (iSecurity)

Raz-Lee's iSecurity suite covers firewall/exit-point control, antivirus, auditing, encryption, and MFA in a modular product line that is popular with mid-market IBM i shops, particularly in Europe. iSecurity Firewall and iSecurity Audit are the most commonly deployed modules.

Strengths

  • iSecurity Firewall gives real-time, rule-based exit-point control with strong logging detail
  • Native IBM i antivirus scanning (iSecurity Anti-Virus) is a differentiator versus vendors that rely on IFS-only scanning
  • Modular licensing lets smaller shops buy only the modules they need rather than a full suite
  • Strong presence and support infrastructure in European IBM i markets

Limitations

  • US market share and analyst mindshare trail Fortra and Precisely
  • Documentation and UI conventions can feel dated compared to Precisely's newer interfaces
  • MFA module is a newer addition to the suite with a shorter track record than Fortra's or Precisely's MFA products

Best fit: Mid-market shops, especially in Europe, that want modular exit-point firewall and native antivirus scanning without committing to a full enterprise suite.