RE: DSPJRN entries for deleted spoolfiles

[Rob Berendt <rob@xxxxxxxxx>]

There's a miscommunication somewhere.

The only real entry code for SF is 'T'.
https://www.ibm.com/docs/en/i/7.4?topic=information-all-journal-entries-by-code-type

However, within this entry there are other type codes
https://www.ibm.com/docs/en/i/7.4?topic=entries-sf-action-spooled-file-journal

DSPJOB OUTPUT(*PRINT)
Creates
Sequence  Code  Type
17892827   T     SF 

DLTSPLF FILE(QPDSPJOB) JOB(*) SPLNBR(*LAST)
Creates
Sequence  Code  Type
17892852   T     SF

But if you notice the first character on each entry?
The first one is a C for Create
            Entry specific data       
Column      *...+....1....+....2....+.
00001      'CQ04079N012QSPL      *FILE

The second one is a D for Delete
            Entry specific data 
Column      *...+....1....+....2
00001      'DQ04079N012QSPL     
And this matches the description at the second URL above.

SELECT 
       entry_timestamp,
       sequence_number, system_sequence_number,
       object_type,
       cast(substring(entry_data,1, 1) as char(1) for bit data) as spool_operation,
       remote_address, remote_port,
       "CURRENT_USER", job_name, job_user, job_number, program_name,
       X.*
    FROM TABLE (
            QSYS2.Display_Journal('QSYS', 'QAUDJRN', -- Journal library and name
                JOURNAL_ENTRY_TYPES => 'SF', -- Journal entry types
                STARTING_TIMESTAMP => CURRENT TIMESTAMP - 1 HOURS -- Time period
            )
        ) AS x;


Rob Berendt