Re: Audit Journal for Spool files

[CRPence <CRPbottle@xxxxxxxxx>]

  The "entry specific data" [JOESD] records the "owner" of the spool 
file [to include the job that created].  That same information will 
appear for that spool file irrespective of 'D'=Delete, 'C'=Create, etc.. 
 The journal entry details are what record the job, user, and program 
that were responsible for the entry being deposited in the journal.

  Per reference to DSPAUDJRNE for entry type SF, the T-SF entries, 
refer to the DSPFFD QASYSF* for the file field definitions which are 
available to the reports [used to and may still be *QRYDFN].  The SFPGM, 
SFUSPF, SFNBR, SFUSER, SFJOB are presumably what is of interest; i.e. 
"the user and job associated with the 'D' action" should be described 
by: PGM(SFPGM), USRPRF(SFUSPF), JOB(SFNBR/SFUSER/SFJOB)

  If the "canned report" does not show those columns in DSPAUDJRNE, 
then options might be either customizing the report or utilizing a 
different interface such as DSPJRN or CPYAUDJRNE and then selecting the 
specific data of interest from the output file may be desired.
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlanalyzeaud.htm
  Note caveat of support [deprecated] for DSPAUDJRNE in above
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlanalyzeaud.htm

  See the "Heading fields common to all entry types." in the following 
documentation.

QASYSFJE, QASYSFJ4, and QASYSFJ5 file field descriptions:
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlf55.htm

Regards, Chuck

On 09-Sep-2011 11:51 , Jeff Young wrote:
> Use the command DSPAUDJRNE ENTTYP(SF) to get the print out. You must
> have *SPLFDTA in your system auditing level (QAUDLVL).
>
> On Fri, Sep 9, 2011 at 1:43 PM,<rob@xxxxxxxxx>  wrote:
> > I don't see the type 'D'
> > I created the spool file in job: 490007/ROB/ROBHQ1 and deleted it
> > in job 490010/ROB/QPADEV000D
> >
> > Sequence  Code  Type  Object      Library     Job         Time
> > 94551241   T     ZC                           ROBHQ1      13:23:28
> > 94551242   T     SF                           ROBHQ1      13:23:28
> > 94552370   T     SF                           QPADEV000D  13:23:56
> > 94552371   T     ZC                           QPADEV000D  13:23:56
> >
> >             Entry specific data
> > Column      *...+....1....+....2....+....3....+....4....+....5
> > 00001      'DQ04079N058QSPL      *FILE             Q226774719Q'
> > 00051      'PDSPJOB  0001P1        QUSRSYS   000001           '
> > 00101      '                                                  '
> > 00151      '                                                  '
> > 00201      '                 ROBHQ1    ROB       490007       '
> >
> > Jeff Young on 09/09/2011 12:50 PM wrote:
> > > I have a client that has all system auditing active.
> > > When I print out the journal data for type *SF (Spool File
> > > Action), I see spool files with type 'C' (created) and 'D'
> > > (deleted).
> > > Is there any way to determine the user and job associated with
> > > the 'D' action?
> > >
> > > All I seen in the journal display output is the same job and pgm
> > > that created the spool file, not the one that deleted it.