Re: wrkimgclg, no output(*print) option

On 19-Aug-2014 09:04 -0500, rob@xxxxxxxxx wrote:

<<SNIP>> what options do I take on DSPJRN to find just what I
want? That this image catalog got unloaded.

The Security Gd would include the layouts for the entries; what activity logs the entry type should also be described. But to make the process easier, the Security component provides an alternate interface to visually\hand-parsing the Entry Data of the Display Journal (DSPJRN) output. The Copy Audit Journal Entries (CPYAUDJRNE) command is part of the interface; in the past there was a Display Audit Journal Entries (DSPAUDJRNE) command, but that feature was deprecated, although the *QRYDFN objects that support the output files may still be available for reporting purposes.

<http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_71/cl/cpyaudjrne.htm>
_Copy Audit Journal Entries_ (CPYAUDJRNE)

<http://www.ibm.com/support/knowledgecenter/ssw_ibm_i_71/cl/dspaudjrne.htm>
_Display Audit Journal Entries_ (DSPAUDJRNE)

<http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_71/rzarl/rzarlsecaudje.htm>
_Security auditing journal entries_
"This topic provides information about the journal entries that are written for the action auditing values specified on the QAUDLVL and QAUDLVL2 system values and in the user profile.

It shows:
• The type of entry written to the QAUDJRN journal.
• The model database output file that can be used to define the record when you create an output file with the DSPJRN command. Complete layouts for the model database outfiles are found in Layout of audit journal entries.
• The detailed entry type. Some journal entry types are used to log more than one type of event. The detailed entry type field in the journal entry identifies the type of event.
• The ID of the message that can be used to define the entry-specific information in the journal entry.
..."

09:52:28 CHGOBJAUD OBJ(VRTCLG) OBJTYPE(*IMGCLG) OBJAUD(*ALL)
Object auditing value changed for VRTCLG in QUSRSYS type *IMGCLG.
09:52:29 LODIMGCLG IMGCLG(VRTCLG) OPTION(*UNLOAD)
Image catalog VRTCLG unloaded from device VRTDEV.
09:52:32 LODIMGCLG IMGCLG(VRTCLG) OPTION(*LOAD) DEV(VRTDEV)
Image catalog VRTCLG loaded in device VRTDEV.

DSPJRN JRN(QAUDJRN) FROMTIME(081914 095228) TOTIME(081914 095232)
JOB(011788/ROB/QPADEV0001)
shows 66 journal entries!
Sequence Code Type
16366 T AD
16423 T JS
16424 T LD
16425 T ZR
16426 T JS
16427 T LD
16428 T LD
16429 T LD
16430 T LD
16431 T JS
16432 T LD
16433 T LD
...

<<SNIP>>

Most likely, after changing a specific object to have *ALL object auditing, the entry to look for\at is the T-ZR (Read of Object) journal entry with the following documenting the layout:
<http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_71/rzarl/rzarlf78.htm>
_ZR (Read of Object) journal entries_
"This table provides the format of the ZR (Read of Object) journal entries. ..."

The parent topic for the above topic is:
<http://www.ibm.com/support/knowledgecenter/api/content/ssw_ibm_i_71/rzarl/rzarllayout.htm>
_Layout of audit journal entries_
"This section contains layout information for all entry types with journal code T in the audit (QAUDJRN) journal. These entries are controlled by the action and object auditing you define. ..."