Q: Do you know of a tool that can save, display, or print the actions of each signed-on user throughout the day? I know the history log shows the date and time that the user signed on to the AS/400 and whether there were any messages. However, I would also like to see the different jobs they ran (interactive and batch).
A: In V2R3, you can activate user-profile auditing, which causes the system to create a journal entry for each command entered by specified users. You can then display these journal entries to find out which commands a user has executed. Perform the following steps to activate this feature:
1. Check to see if library QSYS contains a journal called QAUDJRN. If so, skip to step 4.
CHKOBJ OBJ(QSYS/QAUDJRN) + OBJTYPE(*JRN)
2. Create a journal receiver. Give it any valid name and place it in any library.
CRTJRNRCV + JRNRCV(xxx/journal-receiver)
3. Create the system auditing journal. The journal must be called QAUDJRN and must be placed in library QSYS. Specify the journal receiver you created in step 2 in the JRNRCV parameter.
CRTJRN JRN(QSYS/QAUDJRN) JRNRCV(xxx/journal-receiver)
4. Change the auditing control system value to activate auditing.
CHGSYSVAL SYSVAL(QAUDCTL) + VALUE(*AUDLVL)
5. Change user auditing to log CL commands for the users you want to audit.
CHGUSRAUD USRPRF(user-profile) + AUDLVL(*CMD)
Now when you want to know which commands a user has executed, use the Display Journal (DSPJRN) command.
DSPJRN JRN(QSYS/QAUDJRN) + OUTPUT(*OUTFILE) + OUTFILE(xxx/file-name)
The *OUTFILE option creates a file which contains the entries. You can query this file to retrieve the records for a particular user and time period.