Re: Who messed with the spool file?

[Ed Fishel <edfishel@xxxxxxxxxx>]

Rob Berendt wrote on 12/13/2006 08:40:32 AM:

> DSPJRN JRN(QAUDJRN) RCVRNG(ZAUDJR1077) JOB(366816/LAURIER/SAF330)
> Sequence  Code  Type  Object      Library     Job         Time
> 88857251   T     ZC                           SAF330       6:45:00
> 88857252   T     SF                           SAF330       6:45:00
> 88857276   T     ZC                           SAF330       6:45:02
> 88857277   T     SF                           SAF330       6:45:02
>
> SF = Spool File
> Looks like it went to output queue P1, the default one that is locked
down
> tighter than Fort Knox.
>  *...+....1....+....2....+....3....+....4....+....5
> 'CQ04079N026QSPL      *FILE             Q297026721S'
> 'AF330O   0001P1        QUSRSYS   000001           '
> '                                                  '
> '                                                  '
> '                 SAF330    LAURIER   366816       '
>
> Anyway, it should not have automatically printed.
>
> How do I search this audit journal for more activity on this spool file?

If you think the spooled file may have been printed then you could look at
your PO (Printed Output) audit records. The *PRTDTA value will need to be
specified in the QAUDLVL or QAUDLVL2 system value for the PO audit records
to be written to the audit journal.

If your system is at V5R4 then you can use CPYAUDJRNE  ENTTYP(SF PO) to
copy both the SF and PO audit records to physical files in QTEMP or another
library you specify. From there you can use whatever query tool you wish to
search audit data in the physical files.

If you do not have V5R4 then you can should use CRTDUPOBJ to create the
QASYPOJ5 and QASYSFJ5  physical files (prototype copies can be found in
library QSYS) and then use DSPJRN  with OUTFILFMT(*TYPE5) to copy the SF
and PO audit records to your physical files. This will produce the same
audit data as the CPYAUDJRNE command.

Ed Fishel,
edfishel@xxxxxxxxxx