RE: Spool file journalling -- MIDRANGE-L

This is a multipart message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
Thank you Tom!

I followed your advice.

CRTDUPOBJ OBJ(QASYSFJ4)
          FROMLIB(*LIBL)
          OBJTYPE(*FILE)
          TOLIB(ROB)
          NEWOBJ(DSPJRN)

DSPJRN JRN(QAUDJRN)
       FROMTIME('10/29/02' '09:01')
       TOTIME('10/29/02' '09:10')
       ENTTYP(SF)
       OUTPUT(*OUTFILE)
       OUTFILFMT(*TYPE4)
       OUTFILE(ROB/DSPJRN)

Set up a Query using:
Seq   Field             Text
  10  SFTSTP            Timestamp of entry
  20  SFETYP            Type of entry
  30  SFENTT            Entry type
  40  SFJOB             Name of job
  50  SFUSER            User of job
  60  SFNBR             Number of job
  70  SFLNBR            Spool file number
  80  SFSJOB            Name of spool file job
  90  SFSUSR            User of spool file job
 100  SFSNBR            Number of spool file job
This, and the timestamp field, were just the ticket!
ENTRY  TYPE  JOB         JOB          JOB      SPOOL   SPOOL       SPOOL
 SPOOL
TYPE         NAME        USER         NUMBER   NUMBER  JOB         JOB
JOB
                                                       NAME        USER
NUMBER
  C     SF   ROBS1       ROB         196,045   000001  ROBS1       ROB
196045
  U     SF   ROBS1       ROB         196,045   000001  ROBS1       ROB
196045
  A     SF   P1          QSPLJOB     177,169   000001  ROBS1       ROB
196045
  D     SF   P1          QSPLJOB     177,169   000001  ROBS1       ROB
196045
By the above you can see I 'C'reated a spool file.  'U'pdated it to a
different output queue.  It was 'A'ccessed by the spool writer program.
And since SAVE(*NO) was on, the spool writer program 'D'eleted it.

There is a lot more information in there, like old/new number of copies,
etc.

Rob Berendt
--
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin




qsrvbas@netscape.net (Tom Liotta)
Sent by: midrange-l-admin@midrange.com
10/29/2002 10:41 PM
Please respond to midrange-l

        To:     midrange-l@midrange.com
        cc:
        Fax to:
        Subject:        RE: Spool file journalling


Rob:

I'm not sure exactly what your question is, so I'll respond with what I
think you want to know.

It seems to me that you're not using the command(s) that will give the
best result. Rather than DSPAUDJRNE, try DSPJRN *OUTFILE instead. For the
*outfile, use CRTDUPOBJ to duplicate the system model file for audit
journal 'SF' entries in *TYPE4 format -- QASYSFJ4.

Create the duplicate file, do the DSPJRN into it as the *outfile, and then
look at the three fields named SFSJOB, SFSUSR and SFSNBR. Those give
spoolfile job name, user and number. They might provide the link you're
looking for.

Also, if you're doing job accounting, check the accounting journal for the
'SP' entries. When I'm missing spoolfiles, that's usually my first source
of info.

I think DSPAUDJRNE just isn't reporting enough info for you. Maybe it
hasn't been updated, maybe it never handles *TYPE4 format, whatever. To
me, it's a handy tool, but often sacrifices detail.

Tom Liotta

midrange-l-request@midrange.com wrote:

>   6. Spool file journalling (rob)
>
>I am having a problem tying the spool writer job's action against a spool
>file with one of the spool files it is handling.  This was a memo
designed
>for internal use, but then I stumbled.  I was wondering if there was a
way
>to tie these together.
>
>Due to some missing spool files we have turned on spool file journalling
>on one of our systems.  This will tell you many things about spool files,
>like:
>Entry   Type   Description
>PO       D     Printer output was printed directly to a printer.
>PO       R     Output was sent to a remote system to print.
>PO       S     Printer output was spooled and printed.
>SF       A     A spooled file was read by someone other than the owner.
>SF       C     A spooled file was created.
>SF       D     A spooled file was deleted.
>SF       H     A spooled file was held.
>SF       I     An in-line file was created.
>SF       R     A spooled file was release.
>SF       U     A spooled file was changed.
>Here is a sample:
>DSPAUDJRNE ENTTYP(PO SF) FROMTIME('10/29/02' '09:01:00') OUTPUT(*PRINT)
>
>From the QPQUPRFIL related to the 'PO' type entries:
>  Entry User       Status Job        Job        Job    User       Output
>OUTQ       Device     Device Device...
>  type  profile           name       user       number profile    queue
>library    name       type   model ...
>PO  R   QSPLJOB      D    ROBS1      ROB        196045 ROB        P1
>QUSRSYS
>
>From the QPQUPRFIL related to the 'SF' type entries:
>  ENTRY USER       FILE       FILE       SPOOL      SHORT  OUTPUT OUTPUT
>JOB        JOB        JOB   ...
>  TYPE  PROFILE    NAME       LIBRARY    FILE       SPOOL  QUEUE LIBRARY
>NAME       USER       NUMBER...
>SF  C   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
>ROBS1      ROB        196045
>SF  U   ROB        Q04079N001 QSPL       QSYSPRT     0001  P2 QUSRSYS
>ROBS1      ROB        196045
>SF  A   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
>   QSPLJOB    177169
>SF  D   QSPLJOB    Q04079N001 QSPL       QSYSPRT     0001  P1 QUSRSYS P1
>   QSPLJOB    177169
>By the above you can see I 'C'reated a spool file.  'U'pdated it to a
>different output queue.  It was 'A'ccessed by the spool writer program.
>And since SAVE(*NO) was on the spool writer program 'D'eleted it.
Granted,
>this data was on our development machine.  And the only way I could tie
>the first two entries with the second two was by time.  On our production
>machine this will be a lot tougher.  File name and file library are
>worthless columns.
>
>I worked some more on trying to tie these together.  I also tried the
>command
>DSPJRN JRN(QAUDJRN) FROMTIME('10/29/02' '09:01')
>And if you dance on several function keys you can tie this together.
>However none of the *OUTFILE formats seem to be able to tie any of this
>together.  The *PRINT option is but ugly.
>
>Any suggestions?  The following URL mentions a tool that I do not have,
>but I am loathe to get it without seeing the output.
>
>See also:
>http://makeashorterlink.com/?S6CE51542
>http://www-912.ibm.com/s_dir/slkbase.nsf/c5100f8165ec3eb386256c230059fbac/6a55b3977b17cc2b862565c2007d4658?OpenDocument&Highlight=0,8000840

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertechgroup.com


__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now!
http://channels.netscape.com/ns/browsers/download.jsp

Get your own FREE, personal Netscape Mail account today at
http://webmail.netscape.com/
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.