Layout of audit journal entries
This section contains layout information for all entry types with journal code T in the audit (QAUDJRN) journal. These entries are controlled by the action and object auditing you define.
The journal entry layouts described in this appendix are similar to how one can define a physical file using DDS. For instance, a Binary (4) is defined to hold from 1 to 4 digits information with the storage requirement of two bytes, while a Binary (5) holds from 1 to 5 digits information with the storage requirement of 4 bytes. Languages such as RPG use and enforce these definitions. The system writes additional entries to the audit journal for such events as a system IPL or saving the journal receiver. The layouts for these entry types can be found in the Journal management topic.
Standard heading fields for audit journal entries QJORDJE2 Record Format (*TYPE2) contains the layout for fields that are common to all entry types when OUTFILFMT(*TYPE2) is specified on the DSPJRN command. This layout, which is called QJORDJE2, is defined in the QADSPJR2 file in the QSYS library.
Standard heading fields for audit journal entries QJORDJE4 Record Format (*TYPE4) contains the layout for fields that are common to all entry types when OUTFILFMT(*TYPE4) is specified on the DSPJRN command. This layout, which is called QJORDJE4, is defined in the QADSPJR4 file in the QSYS library. The *TYPE4 output includes all of the *TYPE2 information, plus information about journal identifiers, triggers, and referential constraints.
Standard heading fields for audit journal entries QJORDJE5 Record Format (*TYPE5) contains the layout for fields that are common to all entry types when OUTFILFMT(*TYPE5) is specified on the DSPJRN command. This layout, which is called QJORDJE5, is defined in the QADSPJR5 file in the QSYS library. The *TYPE5 output includes all of the *TYPE4 information, plus information about the program library, program ASP device name, program ASP device number, receiver, receiver library, receiver ASP device name, receiver ASP device number, arm number, thread ID, address family, remote port, and remote address.
AD (Auditing Change) journal entries through ZR (Read of Object) journal entries contain layouts for the model database outfiles provided to define entry-specific data. You can use the CRTDUPOBJ command to create any empty output file with the same layout as one of the model database outfiles. You can use the DSPJRN command to copy selected entries from the audit journal to the output file for analysis. Analyzing audit journal entries with query or a program provides examples of using the model database outfiles. See also the Journal management topic.