AUDIT - How to find out who deleted IFS object

By kimot, 27 December, 2022

If you want to know who deleted the object in IFS. You have to do few steps.

1. Create output file in appropriate format

CRTDUPOBJ OBJ(QASYDOJ5) FROMLIB(QSYS) OBJTYPE(*FILE) 
TOLIB(YourLibrary) NEWOBJ(OutputFileName)

2. Use DSPJRN command to extract audit records into file created in previous step

DSPJRN JRN(QAUDJRN) 
RCVRNG(AuditLibrary/Receiver *CURRENT) 
JRNCDE((T)) ENTTYP(DO) 
OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5) 
OUTFILE(YourLibrary/OutputFileName)

Be aware of using correct journal receiver/s which contains time when object was deleted.

3. Use SQL to show only records you are interested. In this case everything in directory /QFPNWSSTG

SELECT Dotstp,
       Dojob,
       Douser,
       Donbr,
       Doradr,
       Dorport,
       Dootyp,
       Doasp,
       Dopnm
  FROM YourLibrary.YourFile
  WHERE Dopnm LIKE '/QFPNWSSTG/%';