Saving and deleting audit journal receivers
You should regularly detach the current audit journal receiver and attach a new one.
Overview:
- Purpose:
- Attach a new audit journal receiver; Save and delete the old receiver
- How To:
-
- CHGJRN QSYS/QAUDJRN JRNRCV(*GEN)
SAVOBJ (to save old receiver)
- DLTJRNRCV (to delete old receiver)
- Authority:
- *ALL authority to journal receiver *USE authority to journal
- Journal Entry:
- J (system entry to QAUDJRN)
- Note:
- Select a time when the system is not busy.
You should regularly detach the current audit journal receiver
and attach a new one for two reasons:
- Analyzing journal entries is easier if each journal receiver contains the entries for a specific, manageable time period.
- Large journal receivers can affect system performance and take valuable space on auxiliary storage.
It is suggested to have the system manage receivers automatically. You can specify this by using the Manage receiver parameter when you create the journal.
If you have set up action auditing and object auditing to log many different events, you might need to specify a large threshold value for the journal receiver. If you are managing receivers manually, you might need to change journal receivers several times a day. If you log only a few events, you might want to change receivers to correspond with the backup schedule for the library containing the journal receiver.
You use the CHGJRN command to detach a receiver and attach a new receiver.