Editor's Note: Monday is a holiday to commemorate Memorial Day, so we're celebrating here with time away from the keyboard. We'll be back with a new report May 30.

We’re migrating from our 3000 legacy applications to an ERP system hosted on another environment. Management has decreed the HP 3000 apps must still be available for lookups, but nobody should be able to enter new data or modify existing data. Should I do the simplest thing and change all of the databases so that the write class list is empty?

Doug Werth replies:

One way to do this is to write a program in the language of your choice that does a DBOPEN followed by a DBLOCK of each database (this will require MR capability). Then the program goes into an infinite loop calling the PAUSE intrinsic. Any program that tries to update the database will fail to achieve a lock, rendering the databases read-only. Programs that call conditional locks will come back immediately with a failed lock. Unconditional locks will hang.

This has been a very successful solution I have used on systems where a duplicate copy of the databases is kept for reporting and/or shadowing using IMAGE log files.

Steve Dirickson agrees with the poster of the question:

Since very few developers write their apps to check the subsystem write flag that you can set with DBUTIL, changing the classes is your best bet. Make sure you do so by changing the current M/W classes to R/R so the existing passwords will still work for DBOPEN, and only actual put/update/delete operations will fail.

The Big Picture: If protection is required for the database, that protection should reside in the database if at all possible. As mentioned, this is easy with IMAGE.