Auditing Fun

[LiQuiD_FuSioN]

There was a file or DB file edited, I believe through DBU. I can see the "record deleted" journal entry using an outfile with ZC type & just by using a plain "DSPJRN" option to view on green screen. That's neat, but.. how can I see what was actually deleted & who deleted it though? I can see what records were added, like I can see my own login & what was added but that feels rather limited as well. Thank you!

[jj_dahlheimer]

Working with journals takes a bit of work, I have never had to do it much so I won't be a lot of help but DBU also has a way to view journals that I think makes it easier. I think you dbu the journal receiver and change the dbu type to *jrn.

[jtaylor___]

I find it much easier to use DSPJRN into an outfile in QTEMP.

[john.sev99]

You can see the user that changed the entry by pressing F10 on the journal entry display. You can also output the journal to a file (you can copy the model file to qtemp and output to that) and query the output file to locate the data. If you use the *TYPE5 outfile format (and hence the corresponding QASYZCJ5 model file) you'll also get the users IP address if that is desired.
However, to find out what record was deleted, as far as I'm aware you can't get this from the system audit journals. You will need to journal the file and look at the journal associated with the file for the record delete entry.

[Viking]

As a side note, you may want to turn on auditing in DBU. See starting on page 56 of this PDF manual: https://www.dodbu.com/documentation/DBUDoc.pdf

Then it's easier to see what was changed, when, and by whom.

[tomliotta]

Are both before- and after-images being recorded in the journal for that file? If before-images weren't enabled, then the deleted record isn't recorded.