Yorkshireman   3200 pts.  |   Aug 11 2009  2:19PM GMT

Checking DSPLOG or a journal seems to be indicated.

Do you still have joblogs on the system?

RonKoontz   1355 pts.  |   Aug 11 2009  2:28PM GMT

no they have singed off. Unless they are stored somewhere?

Whatis23   4040 pts.  |   Aug 11 2009  3:31PM GMT

Joblogs are deleted dependent upon your cleanup settings. Type CHGCLNUP and F4 to display, the default is 30 days so you should still have them on your system unless someone deletes them manually.

If you’re using DSPOBJD to view the changed date, check further down to see if the object is audited or currently journaled. If so, the journal will capture the info regarding who or what changed it. Journal entries with a journal code of D contain file level info about changes for a PF, E for DTAARAs, F for PF members, Q for DTAQs, etc.

If no objects are journaled in the library, try to narrow your search by time range according to the change date/time and find which job(s) started during that time via the history log then view its joblog.

RonKoontz   1355 pts.  |   Aug 11 2009  3:35PM GMT

Its not journaled and I can only see the last used date not time.
How can I find the right joblog?

Yorkshireman   3200 pts.  |   Aug 12 2009  2:40PM GMT

OK
So we have established that,
in one library, all objects have been ‘touched’ and the ‘last used date’ updated.

We know that it was ‘last sunday’

We have established ? that you have joblogs for 30 days history?
we suppose? that the user does not know about joblogs, nor how to delete one?

we want to know what process did this, and which user started the process.

1) Have we discounted system processes? I can’t say that i know all the ways this field is updated - stuff like saves, reorganizes, copy library etc. Someone else here probably does

2) Assuming joblogs are in QEZJOBLOG, then WRKOUTQ QEZJOBLOG, find the logs for the date in question, and you can probably inspect the ones for a Sunday and quickly discount normal processes from their identity and user.

3) you can inspect potential ones using the library name as a search term whilst using 5=Display on the log. (type the library name and F16 in the search box)

4) If you have a good number of the little devils, then either write a quick CL or otherwise use CPYSPLF to place all the liekly logs into a file and search *that*

If you have the joblog, you have the full story - dates, times, user id, what was being run… .

TomLiotta   7785 pts.  |   Oct 14 2009  7:24AM GMT

What’s unusual is the “all objects got changed” part of it. There are general ways that that can happen:

 <a href="http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rbam6/detob.htm" title="http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rbam6/detob.htm" target="_blank">http://publib.boulder.ibm.com/infocenter…</a>

A CPYLIB command would “use” every object in a library. A PDM option [3=Copy] against a list of objects in a library could do the same. Some IFS type commands can specify generic paths (e.g., ‘/QSYS.LIB/MyLib.LIB/*’) to affect every object in a single command.

DSPLOG could indicate all jobs that started before the date/time and ended after. That may or may not help.

Are there any objects with *PUBLIC *EXCLUDE authority? That should reduce possibilities quite a bit. Is any form of system auditing enabled? QUADJRN entries at that time should show things.

Tom

TomLiotta   7785 pts.  |   Oct 27 2009  1:48AM GMT

Best info I’ve found — Relationship of object Change Date/Time to audit records

Although that’s in the V6R1 Info Center, the concept and most of the info is applicable to previous releases. A similar topic can also be found in the same relative location in the V5R4 Security Reference, the first time it was added. I think the V6R1 version does a little better job.

Tom