Link to home
Start Free TrialLog in
Avatar of rodneygray
rodneygrayFlag for United States of America

asked on

AS400 Historical Job Logs

Is there any way to display historical job log information for a particular user? I know that I can use dspjoblog prior to the operator closing the session. However, I need to examine the job log from a prior time period (last week) to see which jobs the operator ran.
Avatar of Gary Patterson, CISSP
Gary Patterson, CISSP
Flag of United States of America image

Jobs can be configured to print out the job log at completion, or to only generate a job log the job ended in error.

A job's logging level is set in various way.  For example, the job can get it from an associated jobd description object (JOBD), or from the SBMJOB command that was used to submit a batch job, or manually using the CHGJOB command.

The parameter is the same: LOG().

If the operator's interactive job was configured to produce a job log, and the job log hasn't been cleaned up yet, you can use the WRKUSRJOB command to find any jobs in the system for that particular user, and then view the spooled job log.  

Be aware that even if a job log was printed, your system probably has an automated cleanup process in place, and it is common to delete old job logs after a few days.

If you can't find the operator's job log, you might be able to to get a clue what happened by looking at the system history log using the DSPLOG command for the user and/or time period in question.  If the user ran a bunch of interactive programs, then the history log probably won't help, but if they submitted batch jobs, you should find a CPF1124 / CPF1164 message pair for each submitted job.  There isn't much information in these messages, other than date, time, and job name, but sometimes that is enough to give you a clue what happened.

Other thoughts:  

Do your applications produce audit or security logs, or reports that you might be able to look for that would help you figure out what happened?

Does your security team use the AS400 system audit journal or other tools to log user activity?  If so, they may be able to produce audit journal entries that can help.

If your system uses database journaling, you may be able to examine journal receivers for key files.  When journaling is enabled on a file, a journal receiver entry containing the date, time, job name, program name, and other useful information is generally written out for every operation that causes a file change, and sometimes even if a file is just opened for READ.

In general, if you need detailed logs of user activities, you need to do some planning and setup - and the best way to do it depends on how the users access the system.

Hope that help.

- Gary Patterson
ASKER CERTIFIED SOLUTION
Avatar of Member_2_276102
Member_2_276102

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of rodneygray

ASKER

Thanks for the information, I will give it a try and see if it works for me.