IBM Support

Create a Report of Restore Operations.

How To


Summary

How to create a report of Restore Operations on the System using the Audit Function.

Environment

This procedure makes use of the AUDIT_JOURNAL_OR table function SYSTOOLS Audit Journal Entry Services.  

Steps

Before you start, verify that the QAUDJRN exists and that you are tracking for restore operations.
Use the DSPSECAUD command and make sure the following settings are configured on your system:
 
Security journal QAUDJRN exists . . . . . :  YES    
Current QAUDCTL system value  . . . . . . :  *AUDLV
Current QAUDLVL system value  . . . . . . :  *SAVRST
 
The QAUDJRN should be set to *YES and the QAUDCTL system value must include *AUDLVL and QAUDLVL must include *SAVRST. If not listed, use the CHGSECAUD command to add it to your system.
 
Using the AUDIT_JOURNAL_OR table function, you can create a report for restore operations: 
 
 
Option 1:  To list objects all objects that were restored in a time period: 
 
Using the ACS Run SQL Scripts tool, run the following SQL Statement:
 
SELECT JOB_NAME,
       JOB_USER,
       JOB_NUMBER,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       OBJECT_LIBRARY,
       OBJECT_NAME,
       OBJECT_TYPE,
       OBJECT_ATTRIBUTE,
       PATH_NAME,
       PATH_NAME_INDICATOR,
       IFS_OBJECT_NAME
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_OR(STARTING_TIMESTAMP => CURRENT TIMESTAMP - 3 DAYS)
        )
image-20250422094419-1
 
NOTE:  The report will include all objects in both Libraries and IFS directories that were restored in the last 3 days.
 
 
Option 2:  To list objects that were restored in a specific library:
 
Using the ACS Run SQL Scripts tool, run the following SQL Statement:
 
SELECT JOB_NAME,
       JOB_USER,
       JOB_NUMBER,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       OBJECT_LIBRARY,
       OBJECT_NAME,
       OBJECT_TYPE,
       OBJECT_ATTRIBUTE,
       PATH_NAME,
       PATH_NAME_INDICATOR,
       IFS_OBJECT_NAME
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_OR(STARTING_TIMESTAMP => CURRENT TIMESTAMP - 3 DAYS)
        )
        
        where object_library = 'V6CASTIL'  -- specify the name of the library
 
image-20250422093304-1
 
 
Option 3:  To list objects that were restored to the IFS:
 
Using the ACS Run SQL Scripts tool, run the following SQL Statement:
 
SELECT JOB_NAME,
       JOB_USER,
       JOB_NUMBER,
       ENTRY_TYPE,
       ENTRY_TYPE_DETAIL,
       PATH_NAME,
       IFS_OBJECT_NAME
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_OR(STARTING_TIMESTAMP => CURRENT TIMESTAMP - 3 DAYS)
        )
        
        where PATH_NAME notnull
 
 
More information on the AUDIT_JOURNAL_OR table:
 
 

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CHyAAM","label":"Security"}],"ARM Case Number":"TS019116951","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"and future releases;7.4.0;7.5.0;7.6.0"}]

Document Information

Modified date:
26 November 2025

UID

ibm17231518

Page Feedback