Logs are maintained on the iSeries through the Go Cleanup menu. These options cleanup joblogs in qezjoblog, history logs, system and workstation logs, user message queues and system journals. You can schedule this job to run nightly. You can specify cleanup options based on your companies preferences. I personally leave history out there for 30 days, joblogs for 14 days. User messages 7. The user addition are maintained in the Audit log if you have that running on your iSeries. You can check to see if your have audit running by looking at 2 system values, Quadlvl, Qaudctl. If Qaudctl is set to *none, auditing is not running. You can set it up by creating a audit journal receiver, usually audrcv00001 and then a audit journal Qaudjrn in qsys library. Then turn on the journalling by setting Qaudlvl to appropriate settings and change Qaudctl system value to audlvl. For users information, you will want to specify *security for Qaudlvl. You can display the audit journal by using the DSPJRN cmd.
Note that "the Go Cleanup menu" is not how logs are maintained. The CLEANUP menu is used to maintain an automated cleanup schedule, where some types of 'logs' may be specified for automatic deletion after so many days.
Maintenance begins with enabling.
The system audit journal (audit log) is enabled by creating a journal receiver first, then creating journal QAUDJRN in library QSYS and attaching the receiver to it. (The receiver should be created in an administrative library that is scheduled for regular backups.) Once the journal exists, the audit options are set through the QAUDCTL and QAUDLVL as noted above.
Job logs are maintained through job descriptions by setting the logging level. Jobs that run under each job description will generate joblogs according to their setting. The CLEANUP schedule can be used to automate deletion of joblogs after a time limit.
The audit journal, and other journals, and joblogs may be deleted manually.
Numerous journal are used by different parts of the system. Job accounting is an example of an area that is tracked through its particular journal, separate from system audit events and separate from, for example, database journals.