RE: OUTQ getting cleared and cannot figure out how or why. -- MIDRANGE-L

As it turns out, we have been merging printers and moving outqs and one of our users is moving ALL spoolfiles from one outq to a 'save' outq ... unbeknownst to everyone - even his supervisor.
Apparently, this was something he did for an old outq that has been merged into this new outq, so he continued to this for the new outq.

The *SPLFDTA QAUDLVL was the key to finding this activity and then finding the user.

Thanks Jim F and everyone for the help.

Paul

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob Berendt
Sent: Tuesday, April 8, 2025 9:04 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: OUTQ getting cleared and cannot figure out how or why.

I will attest to that additional auditing function. I've used it for just such a hunt.

On Mon, Apr 7, 2025 at 4:37 PM Paul Therrien via MIDRANGE-L < midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

Thanks Jim, I'll take a look at *SPLFDTA option.

My responses to your suggestions are in line..

Paul Therrien

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Jim Franz
Sent: Monday, April 7, 2025 4:12 PM
To: Midrange Systems Technical Discussion
<midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: OUTQ getting cleared and cannot figure out how or why.

Paul,

1. Any chance spools written to a different outq than what is expected?
- We can see the SPLFs on HOLD and *SAV today. Tomorrow they
will be gone.
2. do any of the spools go to SAV status after printing (if not, can
you set one to do that so if did print (even though you're not finding
the report, system may think it printed) and it would be left in queue.
- yes we have spool files on *SAV 3. make sure queue object
not created (and being recreated every day....
- Current spool job on this outq/writer was start on 4/1 (6
days
ago) - So no not recreated - otherwise I would think the writer job
would have failed.
4. have you run an on demand report to printer to see it prints ok -
its not unheard of for printer with lots of memory taking in many
reports into memory then someone reboots the printer. Many printer
control panel can be accessed to check last reboot date time..
- reports are printing fine.
5. One of the options in system value QAUDLVL is *SPLFDTA (so activity
would be in security journal QAUDJRN )
- looking at this option now.

QAUDLVL
Security auditing level
Auditing options - Help

*SPLFDTA
Spooled file functions are audited. The following are
some examples:
o Create, delete, display, copy, hold, and release a
spooled file
o Get data from a spooled file (QSPGETSP)
o Change spooled file attributes (CHGSPLFA command)

Jim Franz

On Mon, Apr 7, 2025 at 3:34 PM Paul Therrien via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

We are on V7R4.
We have an OUTQ that keeps getting cleared or has its spoolfiles
deleted sometime in the early morning. And we cannot figure out by
whom

or by what.

I have auditing on the DLTSPLF and CLROUTQ commands and see no
evidence of anyone issuing CLROUTQ to this outq or execution of
DLTPSPLF command against its spoolfiles.

Looking for ideas on how to find the culprit and how to stop this
from happening.
As always, any help appreciated.

Here it the outq description:

5770SS1 V7R4M0 190621 MBIBOOKS 04/07/25

15:24:47

EDT
Queue: P15150 Library: QUSRSYS
Status:
Writer active . . . . . . . . . . . : Y
Writer name(s) if active . . . . . . : P15150
Output queue held . . . . . . . . . : N
Maximum spooled file size:
Number of pages . . . . . . . . . . : *NONE
Starting time . . . . . . . . . . . :
Ending time . . . . . . . . . . . . :
Writers to autostart . . . . . . . . . : 1
Display any file . . . . . . . . . . . : *NO
Job separators . . . . . . . . . . . . : 0
Operator controlled . . . . . . . . . : *YES
Order of files on queue . . . . . . . : *FIFO
Data queue . . . . . . . . . . . . . . : *NONE
Library . . . . . . . . . . . . . . :
Authority to check . . . . . . . . . . : *OWNER
Remote system . . . . . . . . . . . . : *NONE
Remote printer queue . . . . . . . . . :
Queue for writer messages . . . . . . :
Library . . . . . . . . . . . . . . :
Connection type . . . . . . . . . . . :
Internet address . . . . . . . . . . . :
Destination type . . . . . . . . . . . :
VM/MVS class . . . . . . . . . . . . . :
FCB . . . . . . . . . . . . . . . . . :
Host print transform . . . . . . . . . :
User data transform . . . . . . . . . :
Library . . . . . . . . . . . . . . :
Manufacturer type and model . . . . . :
Workstation customizing object . . . . :
Library . . . . . . . . . . . . . . :
Image configuration . . . . . . . . . : *NONE
Destination options . . . . . . . . . :
Print separator page . . . . . . . . . :
User defined option . . . . . . . . . : *NONE
User defined object:
Object . . . . . . . . . . . . . . . : *NONE
Library . . . . . . . . . . . . . :
Object type . . . . . . . . . . . . :
User driver program . . . . . . . . . : *NONE
Library . . . . . . . . . . . . . . :
Spooled file ASP . . . . . . . . . . . : *SYSTEM
Text description . . . . . . . . . . . : Default output queue for
printer P15150

This is the prtwtr description for:

Writer . . . . . . . : P15150 User . . . . . . . . : QSPLJOB
Number . . . . . . . : 168102

Started by user . . . . . . . . . . . : PCS_OPR
Status:
Writing . . . . . . . . . . . . . . : N
Waiting on message . . . . . . . . . : N
Held . . . . . . . . . . . . . . . . : N
End pending . . . . . . . . . . . . : N
Hold pending . . . . . . . . . . . . : N
Between files . . . . . . . . . . . : Y
Between copies . . . . . . . . . . . : N
Waiting for data . . . . . . . . . . : N
Waiting for device . . . . . . . . . : N
On job queue . . . . . . . . . . . . : N
File being written . . . . . . . . . . :
File number . . . . . . . . . . . . :
Job that created file . . . . . . . . :
User . . . . . . . . . . . . . . . :
Number . . . . . . . . . . . . . . :
Job system name . . . . . . . . . . . :
Spooled file created:
Creation date . . . . . . . . . . . :
Creation time . . . . . . . . . . . :
Page being written . . . . . . . . . :
Total pages . . . . . . . . . . . . . :
Copies left to produce . . . . . . . :
Total copies . . . . . . . . . . . . :
Device . . . . . . . . . . . . . . . . : P15150
Printer device type . . . . . . . . . : *SCS
Number of separators . . . . . . . . . : *FILE
Drawer for separators . . . . . . . . : *FILE
Allow direct print . . . . . . . . . . : *NO
Align page . . . . . . . . . . . . . . : *WTR
Initialize Printer . . . . . . . . . . : *WTR
Output queue . . . . . . . . . . . . . : P15150
Library . . . . . . . . . . . . . . : QUSRSYS
Output queue status . . . . . . . . . : RELEASED
Form type . . . . . . . . . . . . . . : *ALL
Message option . . . . . . . . . . . : *INQMSG
Automatically end writer . . . . . . . : *NO
Message queue . . . . . . . . . . . . : QSYSOPR
Library . . . . . . . . . . . . . . : QSYS
Changes pending:
Next output queue . . . . . . . . . :
Library . . . . . . . . . . . . . . :
Next form type . . . . . . . . . . . :
Message option . . . . . . . . . . :
Next file separators . . . . . . . . :
Next separator drawer . . . . . . . :
Changes take effect . . . . . . . . :

Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
ain=lists.midrange.com n=lists.midrange.com or email:
MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
n=lists.midrange.com or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
n=lists.midrange.com or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.