Re: Identifying what job is calling QSH

Correct me if I'm wrong but doesn't every journal entry have this row:
Job . . . . . . . . : 740726/MIMIXOWN/JRNMGR

There's also this:
CHGOBJAUD OBJ(QSHELL/QSH) OBJTYPE(*CMD) OBJAUD(*ALL)
CHGOBJAUD OBJ(QSHELL/strQSH) OBJTYPE(*CMD) OBJAUD(*ALL)
qsys/qsh
DSPJRN JRN(QAUDJRN) FROMTIME(102815 1328)
Sequence Code Type Object Library Job
5248318 T CD ROBS1
5248319 T GS ROBS1

I journaled the 'root' command in qshell. When I executed the proxy
command in qsys it still logged the audit.
Entry specific data
*...+....1....+....2....+....3....+....4
'CQSH QSHELL *CMD NQSYS/QSH'
You can see the root lib and the proxy lib.
Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : CD - Command string

Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 10/28/15
Time . . . . . . . . : 13:28:13.187792
...
Job . . . . . . . . : 756649/ROB/ROBS1

Is the fact that "Object" and "Type" are blank? I can see where that
might make your life difficult. At that time you'll have to look at the
"entry specific data".
The GS entry tells you less. The object fails to appear, even in the
"entry specific data", of the GS entry.

Rob Berendt