Avatar of rodneygray
Flag for United States of America asked on

AS400 Historical Job Logs

Is there any way to display historical job log information for a particular user? I know that I can use dspjoblog prior to the operator closing the session. However, I need to examine the job log from a prior time period (last week) to see which jobs the operator ran.
IBM System i

Avatar of undefined
Last Comment

8/22/2022 - Mon
Gary Patterson, CISSP

Jobs can be configured to print out the job log at completion, or to only generate a job log the job ended in error.

A job's logging level is set in various way.  For example, the job can get it from an associated jobd description object (JOBD), or from the SBMJOB command that was used to submit a batch job, or manually using the CHGJOB command.

The parameter is the same: LOG().

If the operator's interactive job was configured to produce a job log, and the job log hasn't been cleaned up yet, you can use the WRKUSRJOB command to find any jobs in the system for that particular user, and then view the spooled job log.  

Be aware that even if a job log was printed, your system probably has an automated cleanup process in place, and it is common to delete old job logs after a few days.

If you can't find the operator's job log, you might be able to to get a clue what happened by looking at the system history log using the DSPLOG command for the user and/or time period in question.  If the user ran a bunch of interactive programs, then the history log probably won't help, but if they submitted batch jobs, you should find a CPF1124 / CPF1164 message pair for each submitted job.  There isn't much information in these messages, other than date, time, and job name, but sometimes that is enough to give you a clue what happened.

Other thoughts:  

Do your applications produce audit or security logs, or reports that you might be able to look for that would help you figure out what happened?

Does your security team use the AS400 system audit journal or other tools to log user activity?  If so, they may be able to produce audit journal entries that can help.

If your system uses database journaling, you may be able to examine journal receivers for key files.  When journaling is enabled on a file, a journal receiver entry containing the date, time, job name, program name, and other useful information is generally written out for every operation that causes a file change, and sometimes even if a file is just opened for READ.

In general, if you need detailed logs of user activities, you need to do some planning and setup - and the best way to do it depends on how the users access the system.

Hope that help.

- Gary Patterson

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

Thanks for the information, I will give it a try and see if it works for me.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck