995 pts.
 An OUTQ has been deleted from our system, unable to find even using dspjrne
We have an OUTQ which got deleted yesterday, however we tried checking thru DSPJRNE and other means as LOGs, however it doesn't show up. The only thing which comes in the log is when the writer has ended. The obj deletion is not coming up.

Software/Hardware used:
ASKED: February 15, 2013  3:27 PM
UPDATED: February 15, 2013  4:02 PM

Answer Wiki:
Last Wiki Answer Submitted:  Be the first to answer this question.
All Answer Wiki Contributors:  Be the first to answer this question. Michael Tidmarsh   13,930 pts.
To see all answers submitted to the Answer Wiki: View Answer History.


Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _


 

If DSPJRN doesn’t show a T/DO entry for the *OUTQ, then object deletions were not being audited at the time it was deleted or you need to look in earlier receivers in the receiver chain. — Tom

 109,975 pts.

 

Or… DSPAUDJRNE ENTTYP(DO) OUTPUT(*)   

 670 pts.

 

DSPAUDJRNE can be used for general browsing and simple research. However, it should not be used for serious audit research. According to Using Object Auditing to Track Use of Print-Related Commands, “…the DSPAUDJRNE command is not supported…”. And MustGather: Security Issues and other IBM docs explicitly warn against relying on DSPAUDJRNE over DSPJRN for QAUDJRN. — Tom

 109,975 pts.