Re: Displaying ST type audit journal entries

>Looks like a bug - but service tools use had been auditable for 3 years
>now. And there is a record type for it, so it should be there, I think.
>
>At 08:23 AM 6/12/2003 -0500, you wrote:
>>Why isn't ST a valid ENTTYP when doing a DSPAUDJRNE?  It works for DSPJRN
>>JRN(QSYS/QAUDJRN) ENTTYP(ST) but not DSPAUDJRNE.
>>
>>Bryan Burns

Vern,

It may look like a bug, but it is documented in the help text of the
command. The help text for DSPAUDJRNE says:

  The audit entries for which you can run reports is a subset of the
  audit entries that may be generated.  For information on all of the
  possible audit entries, see Chapter 9 of the Security Reference
  manual.

Also even for audit records that are supported, there may be some fields
that are not copied from the audit journal by DSPAUDJRNE. For example, it
does not list fields to identify stream files for most audit records. In my
opinion the reason that DSPAUDJRNE does not do everything is that there are
limited resources to spend on this and there are other ways to get the
information.

You can get the complete audit information by using DSPJRN and the
appropriate output file. The names of the outfiles are documented in
Appendix F of the Security Reference Manual for each type of audit record.
So, to copy the ST audit records into a file in library QTEMP  first run
command CRTDUPOBJ OBJ(QASYSTJ5) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(QTEMP)
to create the output file in the correct format, and then run DSPJRN
JRN(QAUDJRN) JRNCDE((T)) ENTTYP(ST) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5)
OUTFILE(QTEMP/QASYSTJ5) to copy the audit data to the file. You can then
query the audit data and produce your own custom report.

Ed Fishel,
edfishel@xxxxxxxxxx