RE: Spool file journalling

Rob:

I'm not sure exactly what your question is, so I'll respond with what I think 
you want to know.

It seems to me that you're not using the command(s) that will give the best 
result. Rather than DSPAUDJRNE, try DSPJRN *OUTFILE instead. For the *outfile, 
use CRTDUPOBJ to duplicate the system model file for audit journal 'SF' entries 
in *TYPE4 format -- QASYSFJ4.

Create the duplicate file, do the DSPJRN into it as the *outfile, and then look 
at the three fields named SFSJOB, SFSUSR and SFSNBR. Those give spoolfile job 
name, user and number. They might provide the link you're looking for.

Also, if you're doing job accounting, check the accounting journal for the 'SP' 
entries. When I'm missing spoolfiles, that's usually my first source of info.

I think DSPAUDJRNE just isn't reporting enough info for you. Maybe it hasn't 
been updated, maybe it never handles *TYPE4 format, whatever. To me, it's a 
handy tool, but often sacrifices detail.

Tom Liotta

midrange-l-request@midrange.com wrote:

>   6. Spool file journalling (rob)
>
>I am having a problem tying the spool writer job's action against a spool
>file with one of the spool files it is handling.  This was a memo designed
>for internal use, but then I stumbled.  I was wondering if there was a way
>to tie these together.
>
>Due to some missing spool files we have turned on spool file journalling
>on one of our systems.  This will tell you many things about spool files,
>like:
>Entry   Type   Description
>PO       D     Printer output was printed directly to a printer.
>PO       R     Output was sent to a remote system to print.
>PO       S     Printer output was spooled and printed.
>SF       A     A spooled file was read by someone other than the owner.
>SF       C     A spooled file was created.
>SF       D     A spooled file was deleted.
>SF       H     A spooled file was held.
>SF       I     An in-line file was created.
>SF       R     A spooled file was release.
>SF       U     A spooled file was changed.
>Here is a sample:
>DSPAUDJRNE ENTTYP(PO SF) FROMTIME('10/29/02' '09:01:00') OUTPUT(*PRINT)
>
>From the QPQUPRFIL related to the 'PO' type entries:
>  Entry User       Status Job        Job        Job    User       Output
>OUTQ       Device     Device Device...
>  type  profile           name       user       number profile    queue
>library    name       type   model ...
>PO  R   QSPLJOB      D    ROBS1      ROB        196045 ROB        P1
>QUSRSYS
>
>From the QPQUPRFIL related to the 'SF' type entries:
>  ENTRY USER       FILE       FILE       SPOOL      SHORT  OUTPUT OUTPUT
>JOB        JOB        JOB   ...
>  TYPE  PROFILE    NAME       LIBRARY    FILE       SPOOL  QUEUE LIBRARY
>NAME       USER       NUMBER...
>SF  C   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
>ROBS1      ROB        196045
>SF  U   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
>ROBS1      ROB        196045
>SF  A   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
>   QSPLJOB    177169
>SF  D   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
>   QSPLJOB    177169
>By the above you can see I 'C'reated a spool file.  'U'pdated it to a
>different output queue.  It was 'A'ccessed by the spool writer program.
>And since SAVE(*NO) was on the spool writer program 'D'eleted it. Granted,
>this data was on our development machine.  And the only way I could tie
>the first two entries with the second two was by time.  On our production
>machine this will be a lot tougher.  File name and file library are
>worthless columns.
>
>I worked some more on trying to tie these together.  I also tried the
>command
>DSPJRN JRN(QAUDJRN) FROMTIME('10/29/02' '09:01')
>And if you dance on several function keys you can tie this together.
>However none of the *OUTFILE formats seem to be able to tie any of this
>together.  The *PRINT option is but ugly.
>
>Any suggestions?  The following URL mentions a tool that I do not have,
>but I am loathe to get it without seeing the output.
>
>See also:
>http://makeashorterlink.com/?S6CE51542
>http://www-912.ibm.com/s_dir/slkbase.nsf/c5100f8165ec3eb386256c230059fbac/6a55b3977b17cc2b862565c2007d4658?OpenDocument&Highlight=0,8000840

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertechgroup.com


__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now! 
http://channels.netscape.com/ns/browsers/download.jsp

Get your own FREE, personal Netscape Mail account today at 
http://webmail.netscape.com/