AUDIT JOURNAL table function common information
Each of the AUDIT_JOURNAL_xx table functions returns information from the audit journal specific to an individual entry type. The invocation of every function and the first set of columns returned by the function are identical. This common information is described in this section.
- *USE authority to the audit journal and to all requested journal receivers, and
- *OBJEXIST authority to the audit journal
The function name, identified as AUDIT_JOURNAL_xx in the syntax diagram, represents any of the audit journal functions. For example, to invoke the AUDIT_JOURNAL_PW function, replace the xx with PW.
- starting-receiver-name
- A character or graphic string expression that identifies the name of the starting journal
receiver. The special values *CURRENT, *CURCHAIN, *CURAVLCHN, and *CURSEQCHN are supported.
Otherwise, starting-receiver-name must identify a valid journal receiver.
If no journal receiver is specified, *CURAVLCHN is used.
- ending-receiver-name
- A character or graphic string expression that identifies the name of the ending journal
receiver. The special value *CURRENT is supported. Otherwise, ending-receiver-name must
identify a valid journal receiver.
If ending-receiver-name is not specified, *CURRENT is used.
- starting-timestamp
- A timestamp value that specifies the starting timestamp to use1.
A value cannot be specified for both starting-timestamp and starting-sequence.
If no starting timestamp is specified, CURRENT DATE - 1 DAY is used.
- ending-timestamp
- A timestamp value that specifies the ending timestamp to use1.
A value cannot be specified for both ending-timestamp and ending-sequence.
If no ending timestamp is specified, CURRENT TIMESTAMP is used.
- user-name
- A character or graphic string expression that identifies the user profile name for the current user of the job. If user-name is not specified, *ALL is used.
- job
- A character or graphic string expression that identifies the name of a job. Two forms of a job
name are supported:
- A fully qualified job name in the form job-number/job-user/job-name.
- The first 10 characters are the job name, the second 10 characters are the user name, and the last 6 characters are the job number.
- program
- A character or graphic string expression that identifies the name of a program. If program is not specified, *ALL is used.
- starting-sequence
- A decimal expression that identifies the starting sequence number to use. This is the value
shown in the SEQUENCE_NUMBER column in the QSYS2.DISPLAY_JOURNAL results. If the
starting-sequence value is not found in the receiver range, an error is returned.
A value cannot be specified for both starting-timestamp and starting-sequence.
If no starting sequence is specified, *FIRST is used.
- ending-sequence
- A decimal expression that identifies the ending sequence number to use. If the
ending-sequence value is not found in the receiver range, an error is returned.
A value cannot be specified for both ending-timestamp and ending-sequence.
If no ending sequence is specified, *LAST is used.
When ending-sequence is used, the query results will end when the first ending sequence value is encountered. If the journal has had its sequence numbers reset, ending-sequence will only return results through the first match of ending-sequence.
- starting-receiver-library
- A character or graphic string expression that identifies the library that contains starting-receiver-name.
- ending-receiver-library
- A character or graphic string expression that identifies the library that contains ending-receiver-name.
The special values supported for the function arguments are the same as for the Display Journal (DSPJRN) CL command.
The first set of columns returned by each of the audit journal functions are information from the audit journal entry's common header. They have the format shown in the following table. All the columns are nullable.
Column Name | Data Type | Description |
---|---|---|
ENTRY_TIMESTAMP | TIMESTAMP | The system date and time when the journal entry was added to the journal receiver. |
SEQUENCE_NUMBER | DECIMAL(21,0) | A number assigned by the system to each journal entry. |
USER_NAME | VARCHAR(10) | The name of the effective user profile under which the thread was
running when the entry was created. Contains *NONE if the effective user profile is not available. |
QUALIFIED_JOB_NAME | VARCHAR(28) | The qualified job name that added the entry. Contains the null value if the system job is running in a task rather than a process. |
JOB_NAME | VARCHAR(10) | The name of the job that added the entry. |
JOB_USER | VARCHAR(10) | The user profile that started the job. Contains the null value if the system job is running in a task rather than a process. |
JOB_NUMBER | VARCHAR(6) | The job number of the job that added the entry. Contains the null value if the system job is running in a task rather than a process. |
THREAD | BIGINT | Identifies the thread within the process that added the journal
entry. Contains the null value if the system job is running in a task rather than a process. |
PROGRAM_LIBRARY | VARCHAR(10) | The name of the library that contains PROGRAM_NAME. Contains *NONE if PROGRAM_NAME returns *NONE. |
PROGRAM_NAME | VARCHAR(10) | The name of the program that caused the journal entry to be added. This can also be the name of a service program or the partial name of a class file used in a compiled Java™ program. If an application program or CL program did not cause the entry, contains the name of a system-supplied program such as QCMD. Contains *NONE if one of the following conditions
is true:
|
PROGRAM_LIBRARY_ASP_DEVICE | VARCHAR(10) | The name of the ASP device that contains PROGRAM_NAME. |
PROGRAM_LIBRARY_ASP_NUMBER | INTEGER | The number for the auxiliary storage pool that contains PROGRAM_NAME. |
REMOTE_PORT | INTEGER | The port number of the remote address associated with this
journal entry. Contains the null value if a remote port is not available. |
REMOTE_ADDRESS | VARCHAR(46) | The remote address associated with the journal entry in IPv4 or
IPv6 format. Contains the null value if a remote address is not available. |
SYSTEM_NAME | VARCHAR(8) | The name of the system on which the entry is being retrieved. |
SYSTEM_SEQUENCE_NUMBER | DECIMAL(21,0) | The system sequence number which indicates the relative sequence of when this journal entry was deposited into the journal. |
RECEIVER_LIBRARY | VARCHAR(10) | The name of the library containing RECEIVER_NAME. |
RECEIVER_NAME | VARCHAR(10) | The name of the receiver holding the journal entry. |
RECEIVER_ASP_DEVICE | VARCHAR(10) | The name of the ASP device containing RECEIVER_NAME. |
RECEIVER_ASP_NUMBER | INTEGER | The number for the auxiliary storage pool containing RECEIVER_NAME. |
ARM_NUMBER | INTEGER | The number of the disk arm that contains the journal entry. |