Auditing suspended after maintenance

So, I'm running V6R1M0 and I'm a bit behind rolling out my maintenance. I am just getting to TL12122 and will be moving on some of the later versions later this month. We applied the maintenance with the Saturday night/Sunday morning IPL and everything went fine. I looked through the logs on Monday morning and nothing out of the ordinary. I just happened to be working on a WebSphere problem and went to look in the QAUDJRN for some of the entries but didn't find anything.. ANYTHING. From the time the system was IPL'd Sat/Sun there were no entries written.

I verified:
QAUDCTL was still *AUDLVL
QAUDLVL still had *PGMFAIL, *AUTFAIL and *SECURITY.
I looked at QAUDJRN and verified that it had an active receiver.
A quick check of ASP1 and I was at 82%, so there plenty of storage (even though the machine would have crashed or been unresponsive before that).

I tested logging in with my user id and giving it a bad password. I logged back in and checked QAUDJRN for a T/AF record for my ID, nothing. I changed an objects owner and then changed it back. Again, looked for my ID in QAUDJRN and nothing.

I ended up opening a ticket with IBM. The first thing they asked me to do was go have the system create a new journal receiver. The only entry was the J/PR for a new receiver. In the end they had me change QAUDCTL to *NONE and then back to *AUDLVL and *NOQTEMP. That kicked started it into collecting. I've asked them how this could happen but haven't gotten a response yet.


As this ever happened to anyone? This seems like a major problem. If I hadn't happened to be working on a problem, it might have been months before I noticed it. I guess it may have been quicker as we have folks that look through those daily or ever other day.

Not really looking for what the best values are for QAUDCTL/QAUDLVL but more about the journaling stopping.

Thanks


Mike Smith



________________________________
Confidentiality: This transmission, including any attachments, is solely for the use of the intended recipient(s). This transmission may contain information that is confidential or otherwise protected from disclosure. The use or disclosure of the information contained in this transmission, including any attachments, for any purpose other than that intended by its transmittal is strictly prohibited. Unauthorized interception of this email is a violation of federal criminal law. If you are not an intended recipient of this transmission, please immediately destroy all copies received and notify the sender.