QAUDJRN track spool writer changes

We have a situation where a spool writer for a printer (PRT01) suddenly gets changed to point to someone's personal OutQ (QGPL/JSMITH). No one seems to know how this is occurring, but it has happened multiple times.

I want to use QAUDJRN to track down how this is happening. This brings us to two questions...:


1. What parms do I set QAUDJRN with to gather the appropriate information to track this?
These are my current settings:
QAUDCTL(*AUDLVL *OBJAUD)
QAUDLVL(*SPLFDTA *DELETE *SECURITY *SYSMGT *AUTFAIL)


2. When it occurs again, what parms do I use with DSPJRN to search for the cause?


I've read that you cannot track changes to a spool writer with QAUDJRN. Is that true?

Any guidance would be appreciated.

~TA~