VP (Network) journal entries

This table provides the format of the VP (Network) journal entries.

Information from this audit journal entry can be queried with the SYSTOOLS.AUDIT_JOURNAL_VP table function: AUDIT_JOURNAL_VP

Table 1. VP (Network) journal entries. QASYVPJE/J4/J5 Field Description File
Offset			Field	Format	Description
JE	J4	J5	Field	Format	Description
1	1	1			Heading fields common to all entry types. See Standard heading fields for audit journal entries QJORDJE5 Record Format (TYPE5),Standard heading fields for audit journal entries QJORDJE4 Record Format (TYPE4), and Standard heading fields for audit journal entries QJORDJE2 Record Format (*TYPE2) for field listing.
156	224	610	Entry Type	Char(1)	The type of entry. P Password error D NetServer user disabled A Authorization list (AUTL) permission failure C SMB server or share connection established E SMB server or share connection ended S SMB Share modified U SMB unknown user attempt to connect or guest connection
157	225	611	Server Name	Char(10)	The name of the network server description that registered the event. *NETSERVER
167	235	621	Server Date	Char(6)	The date on which the event was logged on the network server.
173	241	627	Server Time	Zoned(6,0)	The time when the event was logged on the network server.
179	247	633	Computer Name	Char(8)	The name of the computer initiating the request. This field is no longer used and will contain blanks.
187	255	641	User	Char(10)	The name of the user.
		651	Long Computer Name	Char(46)	The name or IP address of the computer initiating the request.
		697	Share name	Char(12)	When Entry type (J5 offset 610) is A, C, E or S this field contains the name of the share. This field will contain *SERVER if the action is scoped to the server instead of a shared resource.
		709	Authorization list name	Char(10)	When Entry type (J5 offset 610) is A or S this field contains the name of the authorization list assigned to the file share or server.
		719	(Reserved area)	Char(20)
		739	Correlation ID	Char(8)	When Entry type (J5 offset 610) is C or E this field contains the correlation identifier for a server connection. All share actions with the same correlation id refer to the same server connection. Share connections with a matching correlation id are also ended when an Entry type E server entry is recorded regardless of whether individual Entry type E share entries are recorded.
		747	Share type	Char(1)	When Entry type (J5 offset 610) is A, C, E, or S this field contains the type of shared resource accessed by the action. F File share P Printer share S The entry is server scoped. No share type applies.
		748	Share action	Char(1)	When Entry type (J5 offset 610) is S this field contains the action performed on the shared resource. A Share added C Share changed R Share removed
		749	Encryption	Char(1)	When Entry type (J5 offset 610) is C or S this field contains the encryption setting for the share or connection. Y Encryption is required N Encryption is not required
		750	Permissions	Char(2)	When Entry type (J5 offset 610) is C or S this field contains the access permission allowed for the share or connection. RO Share access is read-only RW Share access is read/write
		752	(Reserved area)	Char(57)
		809	Text conversion	Char(1)	When Entry type (J5 offset 610) is S this field contains the text conversion setting for the share. C Complex text conversion is enabled S Simple text conversion is enabled N Text conversion is disabled
		810	Text conversion CCSID	Bin(5)	When Entry type (J5 offset 610) is S this field contains the coded character set identifier for share text conversion.
		814	Output queue name	Char(10)	When Entry type (J5 offset 610) is S and the share type (J5 offset 747) is P this field contains the output queue name for the share.
		824	Output queue library	Char(10)	When Entry type (J5 offset 610) is S and the share type (J5 offset 747) is P this field contains the output queue library for the share.
		834	(Reserved area)	Char(100)
		934	File system path CCSID	Bin(5)	When Entry type (J5 offset 610) is S and the share type (J5 offset 747) is F this field contains the coded character set identifier for shared file system path.
		938	File system path length	Bin(4)	When Entry type (J5 offset 610) is S and the share type (J5 offset 747) is F this field contains the length of the shared file system path.
		940	File system path	Char(1028)¹	When Entry type (J5 offset 610) is S and the share type (J5 offset 747) is F this field contains the file system path for the share.
¹ This is a variable length field. The first two bytes contain the length of the field.