Architecture / Visibility

IBM i Audit Tools, QAUDJRN, and Security Logging

QAUDJRN is the native source of security events. An IBM i audit tool does not replace it. The tool makes those events readable, alerts on what matters, forwards them to the wider security stack, and leaves proof that somebody reviewed them.

Last verified

QAUDJRN Is the Source, Not the Finished Answer

QSYS/QAUDJRN records security-relevant activity when QAUDCTL and QAUDLVL are configured for the events you need. It can show failed authority checks, profile and system-value changes, object activity, save and restore work, and other events that matter during an investigation.

The journal is strong evidence and difficult reading. Raw receivers are not a practical daily security console. That is why the useful design separates collection from interpretation instead of asking an administrator to scan journal entries by hand.

  1. Collect

    QAUDJRN records system security events. Object journals record changes inside selected application files.

  2. Normalize

    Audit software turns entry types and raw fields into understandable events with users, objects, time, and action.

  3. Decide

    Rules separate routine noise from failed authority, profile changes, sensitive data activity, and other events worth attention.

  4. Deliver

    Reports, alerts, and SIEM forwarding put the event where the responsible person already works.

  5. Prove review

    Tickets, acknowledgements, escalation notes, and retained reports show that detection led to a decision.

What to Collect First

Useful audit coverage starts with a question, not every possible event

QuestionNative sourceEvidence to keep
Who is failing authority checks?QAUDJRN authority-failure entriesUser, job, object, service, time, and repeated pattern
Who changed a powerful profile or security value?QAUDJRN security-change entriesBefore and after value, actor, approval, and ticket
Who created, deleted, saved, or restored an object?QAUDJRN object and save/restore entriesObject, library, actor, job, destination, and business reason
Who changed a sensitive business record?Object journaling on the application fileRecord key, before and after image, user, program, and time
Who used a network service to reach data?Exit-point logs plus relevant audit entriesService, source, user, requested object, rule result, and exception
Who reviewed the event?Audit tool, SIEM, or ticket systemOwner, disposition, escalation, and close time

QAUDJRN and Object Journaling Do Different Jobs

QAUDJRN answers system-security questions. Object journaling answers data-change questions inside selected files. A profile change belongs in the security audit journal. A before-and-after image of a changed customer record belongs in the journal attached to that application file.

QAUDJRNSystem and security events controlled through QAUDCTL and QAUDLVL.
Object journalRecord-level changes for chosen database files and application data.
Exit-point logService-level decisions for FTP, database access, DDM, and remote commands.
SIEM or case recordThe review, escalation, and response evidence created outside the IBM i.

Is There a QAUDJRN Alternative?

Not for the native security events QAUDJRN is designed to record. A commercial product can collect, filter, enrich, report, and forward those events. It may also add exit-point records, file-integrity monitoring, privileged-session evidence, and its own event store. That makes it a better working surface, not a substitute for configuring the native source correctly.

Be careful when a product demonstration starts with a polished dashboard and skips the source configuration. Ask which QAUDCTL and QAUDLVL values it expects, which entry types it reads, how quickly it detects a new receiver, and what happens when collection stops.

When IBM i Audit Software Earns Its Cost

Native collection compared with a working audit product

NeedNative starting pointWhat software should add
Readable reviewJournal display and query commandsClear event names, useful fields, saved views, and scheduled reports
Fast detectionManual journal reviewRules, thresholds, suppression, real-time alerts, and escalation
Wider security contextEvents remain on the IBM iReliable forwarding to the SIEM with source details preserved
Compliance evidenceRaw receivers and exportsRepeatable reports, review history, exception records, and retention controls
Collection healthAn administrator notices a gapAlerts for stopped jobs, missed receivers, broken forwarding, and time drift
Change accountabilityTechnical event onlyOwner, approval reference, business reason, and response record

A Review Routine People Will Actually Keep

Name the owner

One person or team receives the alert, decides what it means, and records the outcome.

Start with high-value events

Powerful-profile changes, repeated authority failures, security-value changes, save activity, and collector failure deserve attention before broad noise.

Tune with real traffic

Run rules against normal application work before enforcement so expected batch and service activity is understood.

Test the whole chain

Create a controlled event and confirm it appears in QAUDJRN, reaches the tool, triggers the rule, reaches the reviewer, and creates a record.

Auditing without review is storage. Review without collection health is confidence built on a silent gap. Test both the event and the delivery chain on a schedule.

Vendors Covering This Control

Precisely (Assure Security)

Precisely's Assure Security suite is the broadest single-vendor IBM i security platform on the market, spanning multi-factor authentication, encryption, compliance monitoring, and access control in one licensing family. It is the platform we point mid-size and enterprise IBM i shops to first when they need one vendor covering the most ground.

Strengths

  • Widest single-suite coverage: MFA, encryption, exit point control, and compliance monitoring under one console
  • Strong native IBM i journal-based monitoring with real-time SIEM forwarding (Splunk, QRadar, Sentinel)
  • Assure Encryption supports field-level and full-database encryption without application changes in most cases
  • Established install base and long IBM i-specific engineering history (originated from Townsend Security and Syncsort lineage)

Limitations

  • Suite pricing and licensing complexity increases as modules are added; full-suite cost is not the cheapest entry point
  • MFA client coverage for legacy green-screen sessions requires exit-point configuration that takes real implementation time
  • Reporting UI is functional but less modern than some newer point-solution dashboards

Best fit: Mid-size to enterprise IBM i shops that want one vendor for MFA, encryption, and compliance monitoring rather than stitching together point products.

Cilasoft

Cilasoft is a France-based IBM i security vendor best known for QJRN/400 (journal-based auditing and compliance) and its anti-ransomware detection module. It has a long track record in European IBM i shops and growing presence elsewhere.

Strengths

  • QJRN/400 is a mature, well-regarded journal auditing and reporting engine
  • Anti-ransomware module specifically watches for IFS-side encryption behavior originating from network shares, a real and growing IBM i attack vector
  • Strong compliance reporting templates for European regulatory frameworks (GDPR-adjacent controls)

Limitations

  • Smaller North American market presence and partner network than Fortra, Precisely, or Raz-Lee
  • Product line is narrower (auditing and anti-ransomware) rather than a full security suite
  • English-language documentation and support resources are less extensive than French-language resources

Best fit: IBM i shops, especially in Europe, prioritizing journal-based audit reporting and IFS ransomware detection specifically.

Raz-Lee Security (iSecurity)

Raz-Lee's iSecurity suite covers firewall/exit-point control, antivirus, auditing, encryption, and MFA in a modular product line that is popular with mid-market IBM i shops, particularly in Europe. iSecurity Firewall and iSecurity Audit are the most commonly deployed modules.

Strengths

  • iSecurity Firewall gives real-time, rule-based exit-point control with strong logging detail
  • Native IBM i antivirus scanning (iSecurity Anti-Virus) is a differentiator versus vendors that rely on IFS-only scanning
  • Modular licensing lets smaller shops buy only the modules they need rather than a full suite
  • Strong presence and support infrastructure in European IBM i markets

Limitations

  • US market share and analyst mindshare trail Fortra and Precisely
  • Documentation and UI conventions can feel dated compared to Precisely's newer interfaces
  • MFA module is a newer addition to the suite with a shorter track record than Fortra's or Precisely's MFA products

Best fit: Mid-market shops, especially in Europe, that want modular exit-point firewall and native antivirus scanning without committing to a full enterprise suite.