AS400 Historical Job Logs

rodneygray
rodneygray used Ask the Experts™
on
Is there any way to display historical job log information for a particular user? I know that I can use dspjoblog prior to the operator closing the session. However, I need to examine the job log from a prior time period (last week) to see which jobs the operator ran.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Gary PattersonVP Technology / Senior Consultant

Commented:
Jobs can be configured to print out the job log at completion, or to only generate a job log the job ended in error.

A job's logging level is set in various way.  For example, the job can get it from an associated jobd description object (JOBD), or from the SBMJOB command that was used to submit a batch job, or manually using the CHGJOB command.

The parameter is the same: LOG().

If the operator's interactive job was configured to produce a job log, and the job log hasn't been cleaned up yet, you can use the WRKUSRJOB command to find any jobs in the system for that particular user, and then view the spooled job log.  

Be aware that even if a job log was printed, your system probably has an automated cleanup process in place, and it is common to delete old job logs after a few days.

If you can't find the operator's job log, you might be able to to get a clue what happened by looking at the system history log using the DSPLOG command for the user and/or time period in question.  If the user ran a bunch of interactive programs, then the history log probably won't help, but if they submitted batch jobs, you should find a CPF1124 / CPF1164 message pair for each submitted job.  There isn't much information in these messages, other than date, time, and job name, but sometimes that is enough to give you a clue what happened.

Other thoughts:  

Do your applications produce audit or security logs, or reports that you might be able to look for that would help you figure out what happened?

Does your security team use the AS400 system audit journal or other tools to log user activity?  If so, they may be able to produce audit journal entries that can help.

If your system uses database journaling, you may be able to examine journal receivers for key files.  When journaling is enabled on a file, a journal receiver entry containing the date, time, job name, program name, and other useful information is generally written out for every operation that causes a file change, and sometimes even if a file is just opened for READ.

In general, if you need detailed logs of user activities, you need to do some planning and setup - and the best way to do it depends on how the users access the system.

Hope that help.

- Gary Patterson
There are four general possibilities that depend on your OS version/release, your general system configuration, the user's configuration and the user's activities.

Joblogs are created while a job runs. During run-time, various messages can get sent to what's called the job's external message queue. This message queue is what is shown when you run DSPJOBLOG against an active job.

When the job ends, the content of the job's external message queue may be spooled to a printer file for retention. The attributes of the job determine whether spooling is done at all, which messages to include based on message 'severity', and how much detail about the message is included based on the 'Message logging: Text' attribute.

After a job ends, the spooled file is also referred to as 'the joblog'. In general, if the external message queue was not spooled, then the record of the joblog is erased when the job ends. Also, system cleanup options can automatically delete spooled joblogs after a period of time. Use GO CLEANUP to investigate how your system handles this.

In recent OS releases, an additional possibility exists -- joblogs may exist in "Pending" status after a job ends. IBM doesn't explain what that actually means, but it looks as if the job's external message queue continues to exist until you either explicitly erase or you tell the system to spool it to a printer file. The "Pending" behavior depends on some system configuration items that you choose. The QLOGOUTPUT system value sets the system configuration to spool or to 'pend' joblogs. This allows the "joblog" to remain viewable with DSPJOBLOG after a job ends without generating a spooled printer file.

For "historical" joblogs, then, the basic possibilities are:

1. Spooled joblog

The joblog will be a spooled file. Use WRKJOB or WRKSPLF for the user to find jobs that continue to exist because they have spooled files associated with them. Look for the QPJOBLOG files.

2. Not retained

The job attributes had *NOLIST for the 'Message logging: Text' attribute. No joblog was kept when the jeb ended.

3. 'Pending' joblogs

The joblogs are in 'Pending' status. Use WRKJOB for the user and use option 10 to view the job's external message queue. Or if you know the full job name, use the DSPJOBLOG command.

4. Deleted spoolfile

The user (or anyone else with authority) can delete spooled files. Any spooled joblog can be deleted just like any other spooled file. No record of content is kept.Beyond those, a number of possible functions could be programmed to do just about anything you want. Archiving, converting to different format... whatever. It depends on products you might have installed or programs your staff has written. There's no way for us to know about stuff like that.

Tom

Author

Commented:
Thanks for the information, I will give it a try and see if it works for me.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial