Re: Audit Journal for Spool files

The "entry specific data" [JOESD] records the "owner" of the spool file [to include the job that created]. That same information will appear for that spool file irrespective of 'D'=Delete, 'C'=Create, etc.. The journal entry details are what record the job, user, and program that were responsible for the entry being deposited in the journal.

Per reference to DSPAUDJRNE for entry type SF, the T-SF entries, refer to the DSPFFD QASYSF* for the file field definitions which are available to the reports [used to and may still be *QRYDFN]. The SFPGM, SFUSPF, SFNBR, SFUSER, SFJOB are presumably what is of interest; i.e. "the user and job associated with the 'D' action" should be described by: PGM(SFPGM), USRPRF(SFUSPF), JOB(SFNBR/SFUSER/SFJOB)

If the "canned report" does not show those columns in DSPAUDJRNE, then options might be either customizing the report or utilizing a different interface such as DSPJRN or CPYAUDJRNE and then selecting the specific data of interest from the output file may be desired.
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlanalyzeaud.htm
Note caveat of support [deprecated] for DSPAUDJRNE in above
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlanalyzeaud.htm

See the "Heading fields common to all entry types." in the following documentation.

QASYSFJE, QASYSFJ4, and QASYSFJ5 file field descriptions:
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzarl/rzarlf55.htm

Regards, Chuck

On 09-Sep-2011 11:51 , Jeff Young wrote:

Use the command DSPAUDJRNE ENTTYP(SF) to get the print out. You must
have *SPLFDTA in your system auditing level (QAUDLVL).

On Fri, Sep 9, 2011 at 1:43 PM,<rob@xxxxxxxxx> wrote:

I don't see the type 'D'
I created the spool file in job: 490007/ROB/ROBHQ1 and deleted it
in job 490010/ROB/QPADEV000D

Sequence Code Type Object Library Job Time
94551241 T ZC ROBHQ1 13:23:28
94551242 T SF ROBHQ1 13:23:28
94552370 T SF QPADEV000D 13:23:56
94552371 T ZC QPADEV000D 13:23:56

Entry specific data
Column *...+....1....+....2....+....3....+....4....+....5
00001 'DQ04079N058QSPL *FILE Q226774719Q'
00051 'PDSPJOB 0001P1 QUSRSYS 000001 '
00101 ' '
00151 ' '
00201 ' ROBHQ1 ROB 490007 '

Jeff Young on 09/09/2011 12:50 PM wrote:

I have a client that has all system auditing active.
When I print out the journal data for type *SF (Spool File
Action), I see spool files with type 'C' (created) and 'D'
(deleted).
Is there any way to determine the user and job associated with
the 'D' action?

All I seen in the journal display output is the same job and pgm
that created the spool file, not the one that deleted it.