Re: Audit Journal for Spool files

[Jeff Young <jyoung0950@xxxxxxxxx>]

Rob,
Use the command DSPAUDJRNE ENTTYP(SF)   to get the print out.
You must have *SPLFDTA in your system auditing level (QAUDLVL).

Thanks,


On Fri, Sep 9, 2011 at 1:43 PM, <rob@xxxxxxxxx> wrote:

> I don't see the type 'D'
> I created the spool file in job: 490007/ROB/ROBHQ1
> and deleted it in job 490010/ROB/QPADEV000D
>
> Sequence  Code  Type  Object      Library     Job         Time
> 94551241   T     ZC                           ROBHQ1      13:23:28
> 94551242   T     SF                           ROBHQ1      13:23:28
> 94552370   T     SF                           QPADEV000D  13:23:56
> 94552371   T     ZC                           QPADEV000D  13:23:56
>
>            Entry specific data
> Column      *...+....1....+....2....+....3....+....4....+....5
> 00001      'DQ04079N058QSPL      *FILE             Q226774719Q'
> 00051      'PDSPJOB  0001P1        QUSRSYS   000001           '
> 00101      '                                                  '
> 00151      '                                                  '
> 00201      '                 ROBHQ1    ROB       490007       '
>
>
> Rob Berendt
> --
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>          Garrett, IN 46738
> Ship to:  Dock 108
>          6928N 400E
>          Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   Jeff Young <jyoung0950@xxxxxxxxx>
> To:     midrange-l@xxxxxxxxxxxx
> Date:   09/09/2011 12:50 PM
> Subject:        Audit Journal for Spool files
> Sent by:        midrange-l-bounces@xxxxxxxxxxxx
>
>
>
> I have a client that has all system auditing active.
> When I print out the journal data for type *SF (Spool File Action), I see
> spool files with type 'C' (created) and 'D' (deleted).
> Is there any way to determine the user and job associated with the 'D'
> action?
> All I seen in the journal display output is the same job and pgm that
> created the spool file, not the one that deleted it.
>
> Thanks,
>
> --
> Jeff Young
> Sr. Programmer Analyst
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.