Spool file journalling

This is a multipart message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
I am having a problem tying the spool writer job's action against a spool
file with one of the spool files it is handling.  This was a memo designed
for internal use, but then I stumbled.  I was wondering if there was a way
to tie these together.

Due to some missing spool files we have turned on spool file journalling
on one of our systems.  This will tell you many things about spool files,
like:
Entry   Type   Description
PO       D     Printer output was printed directly to a printer.
PO       R     Output was sent to a remote system to print.
PO       S     Printer output was spooled and printed.
SF       A     A spooled file was read by someone other than the owner.
SF       C     A spooled file was created.
SF       D     A spooled file was deleted.
SF       H     A spooled file was held.
SF       I     An in-line file was created.
SF       R     A spooled file was release.
SF       U     A spooled file was changed.
Here is a sample:
DSPAUDJRNE ENTTYP(PO SF) FROMTIME('10/29/02' '09:01:00') OUTPUT(*PRINT)

>From the QPQUPRFIL related to the 'PO' type entries:
  Entry User       Status Job        Job        Job    User       Output
OUTQ       Device     Device Device...
  type  profile           name       user       number profile    queue
library    name       type   model ...
PO  R   QSPLJOB      D    ROBS1      ROB        196045 ROB        P1
QUSRSYS

>From the QPQUPRFIL related to the 'SF' type entries:
  ENTRY USER       FILE       FILE       SPOOL      SHORT  OUTPUT OUTPUT
JOB        JOB        JOB   ...
  TYPE  PROFILE    NAME       LIBRARY    FILE       SPOOL  QUEUE LIBRARY
NAME       USER       NUMBER...
SF  C   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
ROBS1      ROB        196045
SF  U   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
ROBS1      ROB        196045
SF  A   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
   QSPLJOB    177169
SF  D   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
   QSPLJOB    177169
By the above you can see I 'C'reated a spool file.  'U'pdated it to a
different output queue.  It was 'A'ccessed by the spool writer program.
And since SAVE(*NO) was on the spool writer program 'D'eleted it. Granted,
this data was on our development machine.  And the only way I could tie
the first two entries with the second two was by time.  On our production
machine this will be a lot tougher.  File name and file library are
worthless columns.

I worked some more on trying to tie these together.  I also tried the
command
DSPJRN JRN(QAUDJRN) FROMTIME('10/29/02' '09:01')
And if you dance on several function keys you can tie this together.
However none of the *OUTFILE formats seem to be able to tie any of this
together.  The *PRINT option is but ugly.

Any suggestions?  The following URL mentions a tool that I do not have,
but I am loathe to get it without seeing the output.

See also:
http://makeashorterlink.com/?S6CE51542
http://www-912.ibm.com/s_dir/slkbase.nsf/c5100f8165ec3eb386256c230059fbac/6a55b3977b17cc2b862565c2007d4658?OpenDocument&Highlight=0,8000840

Rob Berendt
--
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin