Re: Displaying Journal Data for an IFS object

Rob,
1. The solution you provided using SQL is just what I was looking for.
2. This would only by used by the IT staff and associates to research
issues like "why is this file not in the directory (aka Who Deleted in
manually and ran :-) )'

Many thanks again for all your help.


Jeff Young
Sr. Programmer Analyst

On Mon, Jan 23, 2017 at 3:02 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

Any chance you can say something to your customers:
"if you want this new function then you need to be running on 7.1 with TR
xxx and DB2 group xxx applied or higher"
or some such thing?


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Rob Berendt <rob@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/23/2017 02:47 PM
Subject: Re: Displaying Journal Data for an IFS object
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



md '/deleteme'
CRTJRNRCV JRNRCV(ROB/IFS)
CRTJRN JRN(ROB/IFSJRN) JRNRCV(IFS)
STRJRN OBJ(('/deleteme')) JRN('/qsys.lib/rob.lib/ifsjrn.jrn')
SUBTREE(*ALL)
EDTF STMF('/deleteme/sample.txt')
STRJRN OBJ(('/deleteme')) JRN('/qsys.lib/rob.lib/ifsjrn.jrn')
SUBTREE(*ALL)
1 of 2 objects have started journaling.
Had to start journalling on the new file...
EDTF STMF('/deleteme/sample.txt')

SELECT entry_timestamp, journal_code, journal_entry_type,
path_name,
object_file_name
FROM TABLE (
DISPLAY_JOURNAL( 'ROB', 'IFSJRN')) AS JT
;

Object file name always seems to be blank and the file name is in the
directory but other than that oddity looks good.

ENTRY_TIMESTAMP,JOURNAL_CODE,JOURNAL_ENTRY_TYPE,PATH_NAME,OBJECT_FILE_NAME
2017-01-23-14.36.42.459952,J,PR,,
2017-01-23-14.37.04.780192,B,JT,/deleteme,
2017-01-23-14.37.04.807696,B,OF,/deleteme,
2017-01-23-14.37.04.808352,B,CS,/deleteme,
2017-01-23-14.37.21.110288,C,BC,,
2017-01-23-14.37.21.138832,C,SC,,
2017-01-23-14.37.21.139312,B,B0,/deleteme,
2017-01-23-14.37.21.139680,B,B1,/deleteme,
2017-01-23-14.37.21.149072,C,PC,,
2017-01-23-14.37.21.153024,C,CM,,
2017-01-23-14.37.21.154064,C,EC,,
2017-01-23-14.38.39.429776,B,OF,/deleteme,
2017-01-23-14.38.39.431632,B,JT,/deleteme/sample.txt,
2017-01-23-14.38.39.432560,B,CS,/deleteme,
2017-01-23-14.38.45.486400,B,OF,/deleteme/sample.txt,
2017-01-23-14.38.53.844752,B,CS,/deleteme/sample.txt,
2017-01-23-14.38.53.844976,B,OF,/deleteme/sample.txt,
2017-01-23-14.38.53.846192,B,TR,/deleteme/sample.txt,
2017-01-23-14.38.53.846816,B,WA,/deleteme/sample.txt,
2017-01-23-14.38.53.846960,B,CS,/deleteme/sample.txt,

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Jeff Young <jyoung0950@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/23/2017 02:29 PM
Subject: Re: Displaying Journal Data for an IFS object
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,
The problem with DSPJRN is that it does not present human readable
information regarding the path/file that the transaction is for.
Would the SQL service get that information for a normal journal using the
path name in the WHERE clause?


Jeff Young
Sr. Programmer Analyst

On Mon, Jan 23, 2017 at 1:52 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

Then, if you can't use the journal SQL service Display_Journal, I
recommend DSPJRN. I do not believe that has been deprecated like the
DSPAUDJRNE command has.



Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Jeff Young <jyoung0950@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 01/23/2017 01:36 PM
Subject: Re: Displaying Journal Data for an IFS object
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Thanks Rob, but your example uses the system audit journal. What if the
customer does not have that turned on?
The IFS Directory is journaled. Will your example work for a normal
journal?


Jeff Young
Sr. Programmer Analyst

On Mon, Jan 23, 2017 at 11:25 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

You could try messing with CPYAUDJRNE. DSPAUDJRNE is really

deprecated.

Need something official on that? It's available.

http://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/
rzarl/rzarlanalyzeaud.htm
<snip>
Note: IBM® has stopped providing enhancements for the DSPAUDJRNE

command.

The command does not support all security audit record types, and the
command does not list all the fields for the records it supports.
</snip>

You'll see this same paragraph going back to at least 6.1. Just try

the

drop down at the top of that page and select 6.1.



Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Jeff Young <jyoung0950@xxxxxxxxx>
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxx>

Date: 01/23/2017 11:13 AM
Subject: Re: Displaying Journal Data for an IFS object
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,
Is there any other method to get the information I want if the system

does

not have that service?
I have no control over what release or PTF level the customers system

is

at.


Jeff Young
Sr. Programmer Analyst

On Mon, Jan 23, 2017 at 11:08 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

Remember to check here for DB2 service availability
https://www.ibm.com/developerworks/community/
wikis/home?lang=en#!/wiki/IBM%20i%20Technology%20Updates/
page/DB2%20for%20i%20-%20Services


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)

mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our

affiliate

link: http://amzn.to/2dEadiD

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: http://amzn.to/2dEadiD