How to tell who deleted IFS directory?

["Steve McKay" <steve.mckay@xxxxxxxxxxxxxx>]

Gang -

We had an 'adventure' this morning where someone deleted an IFS directory
containing web pages used on our Intranet web site.  No harm done - we
restored from a backup - but in trying to determine the who, how, and why,
we discovered that QAUDJRN type DO (delete object) had references to STMFs
being deleted but the directory/filename was *N/*N and the user ID was not
readable.

We're at V4R5 with most QAUDLVL options "on" (not *NETCMN, *OFCSRV,
*OPTICAL) and *QSECURITY 40.

How can we audit who deletes IFS files?

Thanks in advance,

Steve