On 19-Aug-2014 09:04 -0500, rob@xxxxxxxxx wrote:
<<SNIP>> what options do I take on DSPJRN to find just what I
want? That this image catalog got unloaded.
The Security Gd would include the layouts for the entries; what
activity logs the entry type should also be described. But to make the
process easier, the Security component provides an alternate interface
to visually\hand-parsing the Entry Data of the Display Journal (DSPJRN)
output. The Copy Audit Journal Entries (CPYAUDJRNE) command is part of
the interface; in the past there was a Display Audit Journal Entries
(DSPAUDJRNE) command, but that feature was deprecated, although the
*QRYDFN objects that support the output files may still be available for
_Copy Audit Journal Entries_ (CPYAUDJRNE)
_Display Audit Journal Entries_ (DSPAUDJRNE)
_Security auditing journal entries_
"This topic provides information about the journal entries that are
written for the action auditing values specified on the QAUDLVL and
QAUDLVL2 system values and in the user profile.
• The type of entry written to the QAUDJRN journal.
• The model database output file that can be used to define the
record when you create an output file with the DSPJRN command. Complete
layouts for the model database outfiles are found in Layout of audit
• The detailed entry type. Some journal entry types are used to log
more than one type of event. The detailed entry type field in the
journal entry identifies the type of event.
• The ID of the message that can be used to define the entry-specific
information in the journal entry.
09:52:28 CHGOBJAUD OBJ(VRTCLG) OBJTYPE(*IMGCLG) OBJAUD(*ALL)
Object auditing value changed for VRTCLG in QUSRSYS type *IMGCLG.
09:52:29 LODIMGCLG IMGCLG(VRTCLG) OPTION(*UNLOAD)
Image catalog VRTCLG unloaded from device VRTDEV.
09:52:32 LODIMGCLG IMGCLG(VRTCLG) OPTION(*LOAD) DEV(VRTDEV)
Image catalog VRTCLG loaded in device VRTDEV.
DSPJRN JRN(QAUDJRN) FROMTIME(081914 095228) TOTIME(081914 095232)
shows 66 journal entries!
Sequence Code Type
16366 T AD
16423 T JS
16424 T LD
16425 T ZR
16426 T JS
16427 T LD
16428 T LD
16429 T LD
16430 T LD
16431 T JS
16432 T LD
16433 T LD
Most likely, after changing a specific object to have *ALL object
auditing, the entry to look for\at is the T-ZR (Read of Object) journal
entry with the following documenting the layout:
_ZR (Read of Object) journal entries_
"This table provides the format of the ZR (Read of Object) journal
The parent topic for the above topic is:
_Layout of audit journal entries_
"This section contains layout information for all entry types with
journal code T in the audit (QAUDJRN) journal. These entries are
controlled by the action and object auditing you define. ..."