Tracking deleted spool files ?

[Guest.Visitor]

Can they be tracked as to who and when a user deleted spool files ? The problem we are having is that we may have a malcious user who is deleting spool file reports. Most of our printer outq's are shared for ease of use and being a small company we have only secured a handfull. Case in point is that one of our accountants ran some reports on 12/31/2000 for a year end summary he needs to do. they cannot be be redone without restoring the data files from backup. Needless to say we have moved him to a secure outq now. Any help would be appreciated.

[Guest.Visitor]

Check out the following article: href="http://www.midrangecomputing.com/mc/articles/9902FocusSpooled.pdf">

Who's been messing with my spooled files?

[Guest.Visitor]

Your clean up program may be autodeleting these. Check out how many days you are saving spooled files.

[Guest.Visitor]

Our cleanup program does not delete spool files. Anyone else have any thoughts on this ?

[J.Pluta]

You can audit spool file deletion. When you do find out who is doing it, just remember that it might not be malicious. Wiping out spooled files is as easy as the following: DLTSPLF FILE(*SELECT) SELECT(*ALL) Ta da! No more spooled files...

[nycsusan@hotmail.com]

When you do find out who is doing it, just remember that it might not be malicious. Wiping out spooled files is as easy as the following: DLTSPLF FILE(*SELECT) SELECT(*ALL) Another way, an even easier way IMO, to accidentally delete a SPLF is to simply print one that is not set to SAVE(*Yes) or HOLD(*YES). After it spools to the printer, it's gone. And you are really stuck if the printer jams or if someone walks off with your output! And how do you audit SPLF deletion??? You said that it's possible, but you didn't explain HOW ....

[Guest.Visitor]

And how do you audit SPLF deletion??? You said that it's possible, but you didn't explain HOW .... See Shannon's Article: href="http://www.midrangecomputing.com/mc/articles/9902FocusSpooled.pdf">http:// www.midrangecomputing.com/mc/articles/9902FocusSpooled.pdf

[J.Pluta]

And how do you audit SPLF deletion??? You said that it's possible, but you didn't explain HOW .... Shannon's article in his previous post.