Tweet
Go to the iSeries Info center at: http://publib.boulder.ibm.com/iserie...2924/index.htm and search on QAUDRJRN. That may help get you started. To view entries use DSPJRN JRN(QAUDJRN). You can use Date/Time to narrow down your selection and also Journal Code and Type (as well as some other parms). The Help on Journal Code and Type isn't so great when prompting the command. So just hit enter and when you get a list of entries, position the cursor to Code or Type and then press Help (F1). You'll get a nice list with brief explanations for every Code/Type combo. To see the Receiver Directory use WRKJRNA JRN(QAUDJRN) and then press F15. Retention depends on how long the Receivers stay on your system. Many installations keep Receivers on the system for n number of days after they are Saved and then Delete the Receiver. Mike
-
-
Where is the output from QAUDLVL stored?
You need to query the journal receiver(s) attached to the journal file QAudJrn in library QSys. The Journal Receiver's name is configurable, but often follows the naming standard AudRcv9999. I recall that decoding the Journal Receiver information was a real bear. I used simple green screen commands and the trick was to know which Journal Entry Type contained the events you wanted. If you are auditing a lot of different event types you may have problems. Apparently there are some tools out there that can help. I'm pretty sure that I heard there was a QUsrTool utility that could filter the event types. Didn't use it myself though. -
Where is the output from QAUDLVL stored?
On level 5.1, if I set QAUTCTL to *AUDLVL and set QAUDLVL to *DELETE, all files not in QTEMP that are deleted are recorded. I haven't been able to determine where that deletion information is stored or the amount of information that is kept. Is this information simply a log that is kept in QHST, or is it kept elsewhere? Thank you all, MartyComment
-
Where is the output from QAUDLVL stored?
Thank you both for the help. You've pointed me to the manual SC41-5302. Looks like I will need to use Journaling. I was hoping to avoid that.Comment
Comment