You're looking for joblogs. Don't start with that. Instead, do a DSPLOG
encompassing the time from when the ENDSBS was issued and when the
subsystem ended. Let me give you a sample
12:05 subsystem QINTER told to end
12:05 job DSP01 ended
12:05 job DSP02 ended
12:05 job DSP03 ended
12:05 job DSP04 ended
12:05 job DSP05 ended
12:05 job DSP07 ended
12:05 job DSP08 ended
12:16 job DSP06 ended
12:16 subsystem QINTER ended.
This tells you that the job DSP06 was the last one hanging. It's the one
to concentrate on.
But I do like Chuck's ALCOBJ idea. Much simpler than using the work
management APIs to retrieve job/subsystem status!