Re: How to find member deletion in Audit Journal

[CRPence <CRPbottle@xxxxxxxxx>]

  FWiW: If the database *FILE object were audited to include 
changes, then a T-ZC entry [with an indication of what member 
action; requires *OBJAUD enabled] would be recorded for member 
actions.  Be aware that what appears to be a removed member may 
actually be of another origin than RMVM.  For example, if delete 
actions were audited per QAUDLVL and the database *FILE object had 
been deleted or renamed and then re-created, then a T-DO would have 
been logged such that the file could then have been restored with 
its original name from an old copy [or created] without that member, 
thus T-CO for *CREATE and T-OR for *SAVRST, or T-OM for *OBJMGT 
could record the object name.  And as with the T-ZC for remove, 
consider the member may have been renamed [RNMM] instead; rename 
could be a side effect of restore with allowed differences.

Regards, Chuck

Steve McKay wrote:
> It appears that the 'F' journal entry appears in the journal that
> the file is specifically journaled to - not QAUDJRN.  I was
> looking for a way to determine who/what deleted the member by
> using QAUDJRN since the file in question is not journaled.
>
> > Steve McKay wrote:
> > > We had a member deleted from a file sometime within the last
> > > month.  I have tapes containing all of the QAUDJRN receivers
> > > from that time.  My QAUDLVL system value has most (but not
> > > all events) being journaled.  Can I find out who or what
> > > deleted the member?  If so, how?  If not, why?