Re: Journaling?

On 05-Oct-2016 10:04 -0500, Boyle, Doreen wrote:

I'm running dspjrn on QAUDJRN with entry type CA. I don't know a
time frame. I'm a little rusty on using DSPJRN.

The Display Journal (DSPJRN) is not the easiest way to search; because that feature is so generic, many people will lack the full understanding. As such, the OS provided the [since deprecated] command Display Audit Journal Entries (DSPAUDJRNE) later supplanted by the Copy Audit Journal Entries (CPYAUDJRNE) as a feature for more directly extracting the /auditing/ details directly from the QAUDJRN *JRN in QSYS. In the latter, after the output file is produced with the data, then query [or browse] the data for relevant records.

For the Journaled file parms I put *ALL for the file and for Library
I put the name of the library I'm interested in knowing who changed.
It's been running awhile, I'm keeping an eye on disk.

That would be an example of a /misuse/ of the DSPJRN, as an attempt to get the details of interest :-( Use the CPYAUDJRNE.

FWiW: Looking for or gathering any entries [for an object] and review just for the library name, in both the audit output and history output, might be a way to find some activity on the library object; if not two overwhelming the amount of occurrences, finding out what happened by inference of other work on that library name might be possible by looking at job names and program names. Computer forensics can be so fun ;-)

p.s. Is the library name a system library, or a non-system library? The name could be of relative important to determine an origin; e.g. if the library name is that of a user name created for a /product/ installed [or even since removed].