AUDIT_JOURNAL_CD (Command String) table function

The AUDIT_JOURNAL_CD table function returns rows from the audit journal that contain information from the CD (Command String) journal entries.

Every audit journal table function shares a common authorization requirement and a common set of parameters. These are described in AUDIT JOURNAL table function common information.

The result of the function is a table containing rows with the format shown in the following table. All the columns are nullable.

Table 1. AUDIT_JOURNAL_CD table function
Column Name	Data Type	Description
The first columns returned by this table function are from the common audit journal entry header. See Common columns returned from the audit journal entry header for the column definitions. After the common columns are the following columns that describe the entry specific data for the CD audit journal entry.
ENTRY_TYPE	CHAR(1)	The type of entry. C Command run L OCL statement O Operator control command P S/36 procedure S Command run after command substitution took place U Utility control statement X Proxy command
ENTRY_TYPE_DETAIL	VARCHAR(200)	Descriptive text that corresponds to the entry type.
OBJECT_LIBRARY	VARCHAR(10)	The name of the library where the object is stored.
OBJECT_NAME	VARCHAR(10)	The name of the object.
OBJECT_TYPE	VARCHAR(7)	The type of object.
OBJECT_ASP_NAME	VARCHAR(10)	The name of the auxiliary storage pool (ASP) in which the object resides. A value of *SYSBAS indicates the system ASP and all basic user ASPs.
OBJECT_ASP_NUMBER	INTEGER	The number of the ASP device. 1 indicates the system ASP.
WHERE_RUN	CHAR(1)	Where the CL command was run. B In a batch job but not for any of the reason listed under Y, R, or E. Typical case would be that the CL command was run using STRDBRDR or SBMDBJOB command or was specified on the CMD parameter of the SBMJOB command. E The command string was passed as a parameter to one of the Command Analyzer APIs: QCMDEXC, QCAPCMD, or QCAEXEC N Interactively from a command line or by choosing a menu option that runs a CL command R From a REXX procedure Y From a compiled OPM CL program or an ILE CL program
WHERE_RUN_DETAIL	VARCHAR(200)	Descriptive text that corresponds to where the CL command was run.
COMMAND_STRING	VARCHAR(6000)	The command that was run, with parameters. Contains the null value if no command was run.

Example

List any change commands that were run this week.

SELECT *
  FROM TABLE (
      SYSTOOLS.AUDIT_JOURNAL_CD (STARTING_TIMESTAMP => CURRENT TIMESTAMP - 7 DAYS)
    )
  WHERE ENTRY_TYPE = 'C' AND 
        OBJECT_LIBRARY = 'QSYS' AND
        OBJECT_NAME LIKE 'CHG%' ;