Re: General ideas on researching deleted records

[Hoteltravelfundotcom <hoteltravelfun@xxxxxxxxx>]

It turns out that they think the records never got created. invoice records
start as order records and then move to invoice, so they think that in that
process some did not make it, Journaling
was on the master file but was turned off in 2002.

I will recommend that we re instate the journaling.

On Fri, May 15, 2015 at 5:26 AM, <rob@xxxxxxxxx> wrote:

> Gosh how I hate file maintenance programs that leave printer files open
> for as long as the person stays signed on and in that program (days,
> weeks, etc).  Hate those objects locked messages while our HA software is
> replicationg (which, in our case, these messages seem to be exclusively
> these spool files).
> And those printouts are one of the first things people delete because no
> one looks at them anyway.  They just clutter up the output queue.
> Besides, there's like a bazillion ways to update a file outside of
> standard file maintenance programs, or upddta, so I don't count on file
> maintenance spool logs to give me results.
> Give me journalling any day of the week over those.
>
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   "midrange" <franz9000@xxxxxxxxx>
> To:     "'Midrange Systems Technical Discussion'"
> <midrange-l@xxxxxxxxxxxx>
> Date:   05/13/2015 09:35 PM
> Subject:        RE: General ideas on researching deleted records
> Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
>
>
>
> One more possibility is that your "next invoice #" logic was reset, and
> you
> overwrote the 2 days of invoices... You did not indicate if it was most
> recent 2 days or last week 2 days (which should be in your backup) or last
> year 2 days.
>
> Does your security journal  QAUDJRN  audit *DELETE or *CHANGE ?
> I would also suggest developers only have their own test data in another
> library or partition, and  READ ONLY to production data.
>
> Btw... years ago did an analysis of a system to determine how a fraud was
> committed, and it was as simple as users X and Y using an accounting
> program
> (at 3am) to remove millions in transactions, they removed all the spools,
> but didn't know a change history was captured in a file users did not know
> existed. So if your apps have a "delete invoice" function or a purge
> invoice
> (where user could pass date parms), see what the app does.
>
> Jim
>
> -----Original Message-----
> From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> Hoteltravelfundotcom
> Sent: Wednesday, May 13, 2015 3:43 PM
> To: Midrange Systems Technical Discussion
> Subject: General ideas on researching deleted records
>
> HI This is a general and long shot question.
>
> It seems we have lost 2 days of invoices from a particular file.
>
> How to research what caused this?
>
> Developers are the primary suspects of course or rather process of elim.
> while most
> devs would never do some of these I am trying to see what may have
> happened
> and how to locate any logs of these: by all means let me know if my
> thinking
> is completely wrong and how it should be looked for.
>
> MY thinking is records get deleted by a dev if there is
>
> 1.any program (rpg/cl ?)  that outputs to that file 2. A Cpyf to that
> file,
> overlaying blanks i guess.
> 3. command but a dltf would be halted bec logicals exist.
> 4. Upddta. this shop uses upddta a lot, not just developers. but then it
> has
> to be F23 and a lot of those.
>
> Thank you for any concrete info I acknowledge this is a fuzzy topic if
> this
> is fully off topic please remove.
>
> Thank you,
> Joe
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> unsubscribe,
> or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> moment to review the archives at http://archive.midrange.com/midrange-l.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>