Re: How to find member deletion in Audit Journal

FWiW: If the database *FILE object were audited to include changes, then a T-ZC entry [with an indication of what member action; requires *OBJAUD enabled] would be recorded for member actions. Be aware that what appears to be a removed member may actually be of another origin than RMVM. For example, if delete actions were audited per QAUDLVL and the database *FILE object had been deleted or renamed and then re-created, then a T-DO would have been logged such that the file could then have been restored with its original name from an old copy [or created] without that member, thus T-CO for *CREATE and T-OR for *SAVRST, or T-OM for *OBJMGT could record the object name. And as with the T-ZC for remove, consider the member may have been renamed [RNMM] instead; rename could be a side effect of restore with allowed differences.

Regards, Chuck

Steve McKay wrote:

It appears that the 'F' journal entry appears in the journal that
the file is specifically journaled to - not QAUDJRN. I was
looking for a way to determine who/what deleted the member by
using QAUDJRN since the file in question is not journaled.

Steve McKay wrote:

We had a member deleted from a file sometime within the last
month. I have tapes containing all of the QAUDJRN receivers
from that time. My QAUDLVL system value has most (but not
all events) being journaled. Can I find out who or what
deleted the member? If so, how? If not, why?