RE: General ideas on researching deleted records

One more possibility is that your "next invoice #" logic was reset, and you
overwrote the 2 days of invoices... You did not indicate if it was most
recent 2 days or last week 2 days (which should be in your backup) or last
year 2 days.

Does your security journal  QAUDJRN  audit *DELETE or *CHANGE ? 
I would also suggest developers only have their own test data in another
library or partition, and  READ ONLY to production data. 

Btw... years ago did an analysis of a system to determine how a fraud was
committed, and it was as simple as users X and Y using an accounting program
(at 3am) to remove millions in transactions, they removed all the spools,
but didn't know a change history was captured in a file users did not know
existed. So if your apps have a "delete invoice" function or a purge invoice
(where user could pass date parms), see what the app does. 
 
Jim

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Hoteltravelfundotcom
Sent: Wednesday, May 13, 2015 3:43 PM
To: Midrange Systems Technical Discussion
Subject: General ideas on researching deleted records

HI This is a general and long shot question.

It seems we have lost 2 days of invoices from a particular file.

How to research what caused this?

Developers are the primary suspects of course or rather process of elim.
while most
devs would never do some of these I am trying to see what may have happened
and how to locate any logs of these: by all means let me know if my thinking
is completely wrong and how it should be looked for.

MY thinking is records get deleted by a dev if there is

1.any program (rpg/cl ?)  that outputs to that file 2. A Cpyf to that file,
overlaying blanks i guess.
3. command but a dltf would be halted bec logicals exist.
4. Upddta. this shop uses upddta a lot, not just developers. but then it has
to be F23 and a lot of those.

Thank you for any concrete info I acknowledge this is a fuzzy topic if this
is fully off topic please remove.

Thank you,
Joe
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.