AS/400 command: Changing Date Last Used On Object

1780 pts.
Tags:
AS/400 command keys
AS/400 Library
I have a library that all objects got changed to last sundays date. I was wondering if anyone knew how I can tell what command did it. I looked in the history and don't see anything. I need to know who did it and what command ran to change it. Thanks

Answer Wiki

Thanks. We'll let you know when a new response is added.

Are you saying the
creation date got changed?
last changed date got changed?
last used date got changed?

Last used date would be changed during a back-up.
Phil

Last Used Data Got Changed. No other libraries got changed. and we backup up everynight.
Out test box does not have thoes objects changed either. Its weird that its only one library so I want to know who did it.

Are you auditing your admins & developers?
If so you could check the audit journals for activity over that weekend.
If you’re not auditing high power accounts you should…

Discuss This Question: 7  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Yorkshireman
    Checking DSPLOG or a journal seems to be indicated. Do you still have joblogs on the system?
    5,580 pointsBadges:
    report
  • RonKoontz
    no they have singed off. Unless they are stored somewhere?
    1,780 pointsBadges:
    report
  • Whatis23
    Joblogs are deleted dependent upon your cleanup settings. Type CHGCLNUP and F4 to display, the default is 30 days so you should still have them on your system unless someone deletes them manually. If you're using DSPOBJD to view the changed date, check further down to see if the object is audited or currently journaled. If so, the journal will capture the info regarding who or what changed it. Journal entries with a journal code of D contain file level info about changes for a PF, E for DTAARAs, F for PF members, Q for DTAQs, etc. If no objects are journaled in the library, try to narrow your search by time range according to the change date/time and find which job(s) started during that time via the history log then view its joblog.
    5,665 pointsBadges:
    report
  • RonKoontz
    Its not journaled and I can only see the last used date not time. How can I find the right joblog?
    1,780 pointsBadges:
    report
  • Yorkshireman
    OK So we have established that, in one library, all objects have been 'touched' and the 'last used date' updated. We know that it was 'last sunday' We have established ? that you have joblogs for 30 days history? we suppose? that the user does not know about joblogs, nor how to delete one? we want to know what process did this, and which user started the process. 1) Have we discounted system processes? I can't say that i know all the ways this field is updated - stuff like saves, reorganizes, copy library etc. Someone else here probably does 2) Assuming joblogs are in QEZJOBLOG, then WRKOUTQ QEZJOBLOG, find the logs for the date in question, and you can probably inspect the ones for a Sunday and quickly discount normal processes from their identity and user. 3) you can inspect potential ones using the library name as a search term whilst using 5=Display on the log. (type the library name and F16 in the search box) 4) If you have a good number of the little devils, then either write a quick CL or otherwise use CPYSPLF to place all the liekly logs into a file and search *that* If you have the joblog, you have the full story - dates, times, user id, what was being run... .
    5,580 pointsBadges:
    report
  • TomLiotta
    What's unusual is the "all objects got changed" part of it. There are general ways that that can happen: http://publib.boulder.ibm.com/infocenter/iseries/v5r4/index.jsp?topic=/rbam6/detob.htm A CPYLIB command would "use" every object in a library. A PDM option [3=Copy] against a list of objects in a library could do the same. Some IFS type commands can specify generic paths (e.g., '/QSYS.LIB/MyLib.LIB/*') to affect every object in a single command. DSPLOG could indicate all jobs that started before the date/time and ended after. That may or may not help. Are there any objects with *PUBLIC *EXCLUDE authority? That should reduce possibilities quite a bit. Is any form of system auditing enabled? QUADJRN entries at that time should show things. Tom
    125,585 pointsBadges:
    report
  • TomLiotta
    Best info I've found -- Relationship of object Change Date/Time to audit records Although that's in the V6R1 Info Center, the concept and most of the info is applicable to previous releases. A similar topic can also be found in the same relative location in the V5R4 Security Reference, the first time it was added. I think the V6R1 version does a little better job. Tom
    125,585 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following