AUDIT JOURNAL table function common information

Each of the AUDIT_JOURNAL_xx table functions returns information from the audit journal specific to an individual entry type. The invocation of every function and the first set of columns returned by the function are identical. This common information is described in this section.

Authorization: The caller must have:

*USE authority to the audit journal and to all requested journal receivers, and
*OBJEXIST authority to the audit journal

The schema is SYSTOOLS.

The function name, identified as AUDIT_JOURNAL_xx in the syntax diagram, represents any of the audit journal functions. For example, to invoke the AUDIT_JOURNAL_PW function, replace the xx with PW.

starting-receiver-name

A character or graphic string expression that identifies the name of the starting journal receiver. The special values *CURRENT, *CURCHAIN, *CURAVLCHN, and *CURSEQCHN are supported. Otherwise, starting-receiver-name must identify a valid journal receiver.

If no journal receiver is specified, *CURAVLCHN is used.

ending-receiver-name

A character or graphic string expression that identifies the name of the ending journal receiver. The special value *CURRENT is supported. Otherwise, ending-receiver-name must identify a valid journal receiver.

If ending-receiver-name is not specified, *CURRENT is used.

starting-timestamp

A timestamp value that specifies the starting timestamp to use^¹.

A value cannot be specified for both starting-timestamp and starting-sequence.

If no starting timestamp is specified, CURRENT DATE - 1 DAY is used.

ending-timestamp

A timestamp value that specifies the ending timestamp to use^¹.

A value cannot be specified for both ending-timestamp and ending-sequence.

If no ending timestamp is specified, CURRENT TIMESTAMP is used.

user-name

A character or graphic string expression that identifies the user profile name for the current user of the job. If user-name is not specified, *ALL is used.

job

A character or graphic string expression that identifies the name of a job. Two forms of a job name are supported:

A fully qualified job name in the form job-number/job-user/job-name.
The first 10 characters are the job name, the second 10 characters are the user name, and the last 6 characters are the job number.

If job is not specified, *ALL is used.

program

A character or graphic string expression that identifies the name of a program. If program is not specified, *ALL is used.

starting-sequence

A decimal expression that identifies the starting sequence number to use. This is the value shown in the SEQUENCE_NUMBER column in the QSYS2.DISPLAY_JOURNAL results. If the starting-sequence value is not found in the receiver range, an error is returned.

A value cannot be specified for both starting-timestamp and starting-sequence.

If no starting sequence is specified, *FIRST is used.

ending-sequence

A decimal expression that identifies the ending sequence number to use. If the ending-sequence value is not found in the receiver range, an error is returned.

A value cannot be specified for both ending-timestamp and ending-sequence.

If no ending sequence is specified, *LAST is used.

When ending-sequence is used, the query results will end when the first ending sequence value is encountered. If the journal has had its sequence numbers reset, ending-sequence will only return results through the first match of ending-sequence.

starting-receiver-library

A character or graphic string expression that identifies the library that contains starting-receiver-name.

ending-receiver-library

A character or graphic string expression that identifies the library that contains ending-receiver-name.

The special values supported for the function arguments are the same as for the Display Journal (DSPJRN) CL command.

The first set of columns returned by each of the audit journal functions are information from the audit journal entry's common header. They have the format shown in the following table. All the columns are nullable.

Table 1. Common columns returned from the audit journal entry header
Column Name	Data Type	Description
ENTRY_TIMESTAMP	TIMESTAMP	The system date and time when the journal entry was added to the journal receiver.
SEQUENCE_NUMBER	DECIMAL(21,0)	A number assigned by the system to each journal entry.
USER_NAME	VARCHAR(10)	The name of the effective user profile under which the thread was running when the entry was created. Contains *NONE if the effective user profile is not available.
QUALIFIED_JOB_NAME	VARCHAR(28)	The qualified job name that added the entry. Contains the null value if the system job is running in a task rather than a process.
JOB_NAME	VARCHAR(10)	The name of the job that added the entry.
JOB_USER	VARCHAR(10)	The user profile that started the job. Contains the null value if the system job is running in a task rather than a process.
JOB_NUMBER	VARCHAR(6)	The job number of the job that added the entry. Contains the null value if the system job is running in a task rather than a process.
THREAD	BIGINT	Identifies the thread within the process that added the journal entry. Contains the null value if the system job is running in a task rather than a process.
PROGRAM_LIBRARY	VARCHAR(10)	The name of the library that contains PROGRAM_NAME. Contains NONE if PROGRAM_NAME returns NONE.
PROGRAM_NAME	VARCHAR(10)	The name of the program that caused the journal entry to be added. This can also be the name of a service program or the partial name of a class file used in a compiled Java program. If an application program or CL program did not cause the entry, contains the name of a system-supplied program such as QCMD. Contains *NONE if one of the following conditions is true: The program name does not apply to this entry type. The program name was not available.
PROGRAM_LIBRARY_ASP_DEVICE	VARCHAR(10)	The name of the ASP device that contains PROGRAM_NAME.
PROGRAM_LIBRARY_ASP_NUMBER	INTEGER	The number for the auxiliary storage pool that contains PROGRAM_NAME.
REMOTE_PORT	INTEGER	The port number of the remote address associated with this journal entry. Contains the null value if a remote port is not available.
REMOTE_ADDRESS	VARCHAR(46)	The remote address associated with the journal entry in IPv4 or IPv6 format. Contains the null value if a remote address is not available.
SYSTEM_NAME	VARCHAR(8)	The name of the system on which the entry is being retrieved.
SYSTEM_SEQUENCE_NUMBER	DECIMAL(21,0)	The system sequence number which indicates the relative sequence of when this journal entry was deposited into the journal.
RECEIVER_LIBRARY	VARCHAR(10)	The name of the library containing RECEIVER_NAME.
RECEIVER_NAME	VARCHAR(10)	The name of the receiver holding the journal entry.
RECEIVER_ASP_DEVICE	VARCHAR(10)	The name of the ASP device containing RECEIVER_NAME.
RECEIVER_ASP_NUMBER	INTEGER	The number for the auxiliary storage pool containing RECEIVER_NAME.
ARM_NUMBER	INTEGER	The number of the disk arm that contains the journal entry.

¹ The accuracy of the entry timestamp stored in journal receivers is only accurate to 16 microseconds. Hence, a value passed as a starting-timestamp and ending-timestamp will be truncated such that the actual timestamps being searched for may be from 0 to 15 microseconds less than the specified value.