Using DSPJRN on QAUDJRN For IFS Folder History

[TheZenbudda]

I have a situation where an IFS folder was moved and we don't know how. I "think" the folder is audited (QAUDJRN) because the auditing value on the folder is *CHANGE. I am under the impression that I can use DSPJRN and dump to an outfile to see what activity occurred with the folder (and it's contents). However, I cannot seem to make sense of all the parameters in DSPJRN to product output that is easily descernable to the "common eye". I noticed that when I dumped the output to a file, the earliest date is today. Where is yesterday's stuff? What are the parameters required to display when a folder was moved and who moved it.

[Rocky]

The reason you aren't seeing anything prior to current day is because you're only looking at the recent receiver - Specify RCVRNG(*CURCHAIN) and you will see everything.

[TheZenbudda]

This was it! Thanks Rocky!

[john.sev99]

If object auditing is set to *CHANGE, the system will write a ZC entry type to the journals when it is changed. The details are in the entry specific data which isn't easy to read at times so IBM have supplied model output files for displaying the journals. These are of the form QASYxxJn. The xx is the entry type (you want the ZC ones) and the n is the outfile format (*TYPEn). I'd use *TYPE4 and above as it splits the data nicely. So, if you use *TYPE4 for the "Outfile format", you would use the model file QASYZCJ4.
To get your data, copy the model file to e.g. QTEMP. The DSPJRN parameters will be something like:
DSPJRN JRN(QAUDJRN) RCVRNG(*CURCHAIN) FROMTIME(<start date> <start time>) JRNCDE((T)) ENTTYP(ZC) OUTPUT(*OUTFILE) OUTFILFMT(*TYPEx) OUTFILE(QTEMP/QASYZCJx)
You can then query the output for your specific details.

[TheZenbudda]

This was it! Thanks John!

[Vectorspace]

IBM have also created an SQL table function to query the journal, which is great as you dan display in a nice big Run SQL Scripts window instead of a small green screen.
I've never tried querying a journal for IFS files/folders, and I don't have authority to QAUDJRN so I can't test it, but I assume it works just the same.

 select cast(entry_data as varchar(500)), x.*
FROM TABLE (
  QSYS2.Display_Journal(
            'JRNLIB', 'MYJRN',
            OBJECT_LIBRARY=>'OBJLIB', OBJECT_NAME=>'MYFILE',
            OBJECT_OBJTYPE=>'*FILE', OBJECT_MEMBER=>'*FIRST',
            STARTING_RECEIVER_LIBRARY=>'##JRNRCVLB',
            STARTING_RECEIVER_NAME=>'*CURCHAIN',
            STARTING_TIMESTAMP=>timestamp('2019-03-28-12.00.00')
    ) ) AS X

The "cast(entry_data as varchar(500))" returns the entry data as characters rather than a hex string

[bobc_00001]

BTW, that can easily be done by mistake by a user if they have the authority to move it, just by mousing wrong, and accidentally dragging it someplace