How To
Summary
How to create a report that lists the User Profiles that were deleted from the System is specified time frame.
Environment
Using the SQL Service AUDIT_JOURNAL_DO table function to create a report that lists User Profile Delete Operations for a specified time frame.
Note: This method is only available on versions 7.3, 7.4, 7.5 of the Operating System.
Before you start, verify that the QAUDJRN journal exists and that you are tracking for *DELETE operations.
Use the DSPSECAUD command and make sure the following settings are configured on your system:
Security journal QAUDJRN exists . . . . . : YES
Current QAUDCTL system value . . . . . . : *AUDLVL
Current QAUDLVL system value . . . . . . : *DELETE
If not there, use the CHGSECAUD command to add them to your system. Keep in mind that the auditing values must to be active on your system before the user profiles were deleted.
Steps
Using the Run SQL Scripts tool, run the following SQL Statement:
SELECT ENTRY_TIMESTAMP AS Date_Time_for_delete,
OBJECT_NAME AS User_ID_Deleted,
ENTRY_TYPE_DETAIL,
OBJECT_TYPE,
USER_NAME AS User_ID_Who_Deleted_Profile
FROM TABLE (
SYSTOOLS.AUDIT_JOURNAL_DO(STARTING_TIMESTAMP => CURRENT TIMESTAMP - 30 DAYS) -- Specify the time frame
)
WHERE OBJECT_TYPE = '*USRPRF';
NOTE: Adjust the time frame on the SQL; the sample creates a report of User Profile Delete operations for the last 30 days.
If you would like to find the objects that were deleted as part of the operations to delete the user profiles, refer to the link:
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"7.3.0;7.4.0;7.5.0"}]
Was this topic helpful?
Document Information
Modified date:
11 March 2025
UID
ibm17185362